Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
31-10-2024 08:29
Behavioral task
behavioral1
Sample
2024-10-31_a5933583b59085fea46a3f1b39644156_cryptolocker.exe
Resource
win7-20241010-en
General
-
Target
2024-10-31_a5933583b59085fea46a3f1b39644156_cryptolocker.exe
-
Size
69KB
-
MD5
a5933583b59085fea46a3f1b39644156
-
SHA1
028fbeb42c3b2a9cbd8951ae0d5e24de2f74bf5a
-
SHA256
271fa4a425ea28bfd8cd812bec0daf34de4ba4c0c2a8c7387ae2a7975a640b79
-
SHA512
0ceb2dcae2ad5e0ae39ead37094508aaffdeaabc591f5397a0eec6888d118be0b6a6a20b33f5322dd875f8fee4470bf5d2942e19025b93d6002c0af324a7df69
-
SSDEEP
1536:P8mnK6QFElP6n+gymddpMOtEvwDpjYibAoQRw:1nK6a+qdOOtEvwDpj9
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2900 asih.exe -
Loads dropped DLL 1 IoCs
pid Process 2204 2024-10-31_a5933583b59085fea46a3f1b39644156_cryptolocker.exe -
resource yara_rule behavioral1/memory/2204-0-0x0000000000500000-0x000000000050F311-memory.dmp upx behavioral1/files/0x000c000000012262-11.dat upx behavioral1/memory/2204-16-0x0000000000500000-0x000000000050F311-memory.dmp upx behavioral1/memory/2900-17-0x0000000000500000-0x000000000050F311-memory.dmp upx behavioral1/memory/2900-26-0x0000000000500000-0x000000000050F311-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-31_a5933583b59085fea46a3f1b39644156_cryptolocker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language asih.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2204 wrote to memory of 2900 2204 2024-10-31_a5933583b59085fea46a3f1b39644156_cryptolocker.exe 30 PID 2204 wrote to memory of 2900 2204 2024-10-31_a5933583b59085fea46a3f1b39644156_cryptolocker.exe 30 PID 2204 wrote to memory of 2900 2204 2024-10-31_a5933583b59085fea46a3f1b39644156_cryptolocker.exe 30 PID 2204 wrote to memory of 2900 2204 2024-10-31_a5933583b59085fea46a3f1b39644156_cryptolocker.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-31_a5933583b59085fea46a3f1b39644156_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-31_a5933583b59085fea46a3f1b39644156_cryptolocker.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2900
-
Network
-
Remote address:8.8.8.8:53Requestemrlogistics.comIN AResponseemrlogistics.comIN CNAMEtraff-6.hugedomains.comtraff-6.hugedomains.comIN CNAMEhdr-nlb10-d66bbad0736f8259.elb.us-east-2.amazonaws.comhdr-nlb10-d66bbad0736f8259.elb.us-east-2.amazonaws.comIN A18.119.154.66hdr-nlb10-d66bbad0736f8259.elb.us-east-2.amazonaws.comIN A3.140.13.188
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
52 B 1
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
69KB
MD56a1fac3a67ceb4d57e2cbe496d87dbaf
SHA113193860e3f4ac5a332a9d2687dcc0761743b3ed
SHA25694f93a27195651c9a0e4a9d9a4313cdf548b51d41130b6b5153c25735a81f520
SHA5120daa94f79b8414b6933fd1ff1c684ad917486b67497b666ef2a713316230e5d453ecbc56b68fd18e5ec42b64fc8edf0a4d455f334acb665595d748a96808bbaf