Analysis

  • max time kernel
    132s
  • max time network
    139s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    09/10/2024, 05:00 UTC

General

  • Target

    2024-10-09_fbe89883a8e3a7edb2c3138db6ba974b_cryptolocker.exe

  • Size

    49KB

  • MD5

    fbe89883a8e3a7edb2c3138db6ba974b

  • SHA1

    f14030f21fc424cc9fd88c328eae9fc45649af25

  • SHA256

    5dec6d51bcd24e36ed44b70184034611355bcc8d3544be336a7b303156c49126

  • SHA512

    e33975af06666e02829a344124050a131dc11c53f114187c284d51c6341d7a5a5c7d2ba1b7247109d6f39b17102c5a4258729c65aa3f531c81000a32dc3abb9c

  • SSDEEP

    768:26LsoVEeegiZPvEhHSP+gDdQtOOtEvwDpjtMLZdzuqpXsiE8Wq/DpkITXx:26Q0ElP6G+gBQMOtEvwDpjgWMl7TXx

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-10-09_fbe89883a8e3a7edb2c3138db6ba974b_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-10-09_fbe89883a8e3a7edb2c3138db6ba974b_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2540
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2680

Network

  • flag-us
    DNS
    emrlogistics.com
    asih.exe
    Remote address:
    8.8.8.8:53
    Request
    emrlogistics.com
    IN A
    Response
    emrlogistics.com
    IN CNAME
    traff-1.hugedomains.com
    traff-1.hugedomains.com
    IN CNAME
    hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com
    hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com
    IN A
    54.209.32.212
    hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com
    IN A
    52.71.57.184
  • 54.209.32.212:443
    emrlogistics.com
    asih.exe
    152 B
    3
  • 52.71.57.184:443
    emrlogistics.com
    asih.exe
    152 B
    3
  • 54.209.32.212:443
    emrlogistics.com
    asih.exe
    152 B
    3
  • 52.71.57.184:443
    emrlogistics.com
    asih.exe
    152 B
    3
  • 54.209.32.212:443
    emrlogistics.com
    asih.exe
    152 B
    3
  • 52.71.57.184:443
    emrlogistics.com
    asih.exe
    152 B
    3
  • 54.209.32.212:443
    emrlogistics.com
    asih.exe
    152 B
    3
  • 8.8.8.8:53
    emrlogistics.com
    dns
    asih.exe
    62 B
    192 B
    1
    1

    DNS Request

    emrlogistics.com

    DNS Response

    54.209.32.212
    52.71.57.184

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    49KB

    MD5

    7e1d2b31bfadb67f59bf604855c1cf80

    SHA1

    5fc6435ec266c46a16448e365577fb904673a14d

    SHA256

    7e01f778718b5a0c7b0e366114d4e474e53aaf88a4b372ede361ee4f339f3b56

    SHA512

    10aa5953e9350ab0ef4fb665c3f0fc0a270744d5fd2bc8a0b435721c178a2f38af976d9da47d75247f5e78f7682958c1add10a5330bd91168050c1753cf6a5ea

  • memory/2540-0-0x0000000000500000-0x000000000050B000-memory.dmp

    Filesize

    44KB

  • memory/2540-2-0x00000000003F0000-0x00000000003F6000-memory.dmp

    Filesize

    24KB

  • memory/2540-9-0x00000000001C0000-0x00000000001C6000-memory.dmp

    Filesize

    24KB

  • memory/2540-1-0x00000000001C0000-0x00000000001C6000-memory.dmp

    Filesize

    24KB

  • memory/2540-13-0x0000000002170000-0x000000000217B000-memory.dmp

    Filesize

    44KB

  • memory/2540-15-0x0000000000500000-0x000000000050B000-memory.dmp

    Filesize

    44KB

  • memory/2680-25-0x00000000003B0000-0x00000000003B6000-memory.dmp

    Filesize

    24KB

  • memory/2680-26-0x0000000000500000-0x000000000050B000-memory.dmp

    Filesize

    44KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.