36c497ce1c187e8e5a5f659a428c2886768f3953d90fa7a518a68bda4b264728 | Triage

Sharing

General

Target

36c497ce1c187e8e5a5f659a428c2886768f3953d90fa7a518a68bda4b264728
Size

518KB
Sample

241005-x51r2sveng
MD5

5437d6a05afdc45c48dec6bfac4e60c2
SHA1

3e5e57705553f6e015e200c22c6136a41119eac1
SHA256

36c497ce1c187e8e5a5f659a428c2886768f3953d90fa7a518a68bda4b264728
SHA512

c976b3be0b2229ce03b759db5ea47d11519637dbc45e11252f88d91875b184e28e992fd2815ba9444945ad31b4e67f29c6381263975735ded70800729b58df6b
SSDEEP

6144:Reynlu0+eH9Bpox4I3ANJuBN0PDGxWSqqcfrj8XzL/3upuqs8j8IvwvWGEuTt3ny:Nnb9ZNJuzVrcX8GW8j5veWpuTtMMo

Score

9^/10

discovery ransomware

Malware Config

Targets

- Target
  
  36c497ce1c187e8e5a5f659a428c2886768f3953d90fa7a518a68bda4b264728
- Size
  
  518KB
- MD5
  
  5437d6a05afdc45c48dec6bfac4e60c2
- SHA1
  
  3e5e57705553f6e015e200c22c6136a41119eac1
- SHA256
  
  36c497ce1c187e8e5a5f659a428c2886768f3953d90fa7a518a68bda4b264728
- SHA512
  
  c976b3be0b2229ce03b759db5ea47d11519637dbc45e11252f88d91875b184e28e992fd2815ba9444945ad31b4e67f29c6381263975735ded70800729b58df6b
- SSDEEP
  
  6144:Reynlu0+eH9Bpox4I3ANJuBN0PDGxWSqqcfrj8XzL/3upuqs8j8IvwvWGEuTt3ny:Nnb9ZNJuzVrcX8GW8j5veWpuTtMMo
Score

9^/10

discovery ransomware
- Renames multiple (576) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryransomware

behavioral2

discoveryransomware