clop | 8e1bbe4cedeb7c334fe780ab3fb589fe30ed976153618ac3402a5edff1b17d64

Analysis

max time kernel
93s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18-09-2024 16:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-09-18_279f5beee9d4bf8c54026e78acba61b1_cobalt-strike_megacortex.exe
Size

248KB
MD5

279f5beee9d4bf8c54026e78acba61b1
SHA1

e473e5b82ce65cb58fde4956ae529453eb0ec24f
SHA256

8e1bbe4cedeb7c334fe780ab3fb589fe30ed976153618ac3402a5edff1b17d64
SHA512

544b1c05e7a7f72871c37794d439d5486ea3b9f252687f13b07bae232aa532a34f5104c80ee8382ec251aae884616b034514237629fafcff35340b23b888442c
SSDEEP

6144:pIqxB9hYLylH4GcbfjBaAsaH4+kwLmNC9fAn+CV:iqxgyp4lD0As+FiC94nL

Score

10^/10

clop discovery ransomware

Malware Config

Signatures

clop
Ransomware discovered in early 2019 which has been actively developed since release.
ransomware clop

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3056	920	WerFault.exe	83
1620	920	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-18_279f5beee9d4bf8c54026e78acba61b1_cobalt-strike_megacortex.exe

C:\Users\Admin\AppData\Local\Temp\2024-09-18_279f5beee9d4bf8c54026e78acba61b1_cobalt-strike_megacortex.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-18_279f5beee9d4bf8c54026e78acba61b1_cobalt-strike_megacortex.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:920
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 920 -s 440
  2⤵
  - Program crash
  PID:3056
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 920 -s 460
  2⤵
  - Program crash
  PID:1620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 920 -ip 920
1⤵
PID:4076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 920 -ip 920
1⤵
PID:396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/920-0-0x00000000004B0000-0x00000000004B1000-memory.dmp

Filesize
4KB

Download
memory/920-1-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/920-2-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/920-3-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download