Analysis Overview
SHA256
648c3627d2187bdcf2995c98cd147b2640783aa61860526c09691f93da570541
Threat Level: Shows suspicious behavior
The file 2024-11-10_f41e7fdc67c790ad153b34139919681a_cryptolocker was found to be: Shows suspicious behavior.
Malicious Activity Summary
Loads dropped DLL
Checks computer location settings
Executes dropped EXE
UPX packed file
Unsigned PE
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-11-10 06:54
Signatures
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Analysis: behavioral2
Detonation Overview
Submitted
2024-11-10 06:54
Reported
2024-11-10 06:57
Platform
win10v2004-20241007-en
Max time kernel
148s
Max time network
150s
Command Line
Signatures
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\2024-11-10_f41e7fdc67c790ad153b34139919681a_cryptolocker.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\asih.exe | N/A |
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\2024-11-10_f41e7fdc67c790ad153b34139919681a_cryptolocker.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\asih.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2424 wrote to memory of 4828 | N/A | C:\Users\Admin\AppData\Local\Temp\2024-11-10_f41e7fdc67c790ad153b34139919681a_cryptolocker.exe | C:\Users\Admin\AppData\Local\Temp\asih.exe |
| PID 2424 wrote to memory of 4828 | N/A | C:\Users\Admin\AppData\Local\Temp\2024-11-10_f41e7fdc67c790ad153b34139919681a_cryptolocker.exe | C:\Users\Admin\AppData\Local\Temp\asih.exe |
| PID 2424 wrote to memory of 4828 | N/A | C:\Users\Admin\AppData\Local\Temp\2024-11-10_f41e7fdc67c790ad153b34139919681a_cryptolocker.exe | C:\Users\Admin\AppData\Local\Temp\asih.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\2024-11-10_f41e7fdc67c790ad153b34139919681a_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-10_f41e7fdc67c790ad153b34139919681a_cryptolocker.exe"
C:\Users\Admin\AppData\Local\Temp\asih.exe
"C:\Users\Admin\AppData\Local\Temp\asih.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | emrlogistics.com | udp |
| US | 54.161.222.85:443 | emrlogistics.com | tcp |
| US | 8.8.8.8:53 | 97.17.167.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 23.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 149.220.183.52.in-addr.arpa | udp |
| US | 34.205.242.146:443 | emrlogistics.com | tcp |
| US | 8.8.8.8:53 | 50.23.12.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 100.208.201.84.in-addr.arpa | udp |
| US | 54.161.222.85:443 | emrlogistics.com | tcp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| US | 34.205.242.146:443 | emrlogistics.com | tcp |
| US | 54.161.222.85:443 | emrlogistics.com | tcp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.227.111.52.in-addr.arpa | udp |
| US | 34.205.242.146:443 | emrlogistics.com | tcp |
| US | 54.161.222.85:443 | emrlogistics.com | tcp |
| US | 34.205.242.146:443 | emrlogistics.com | tcp |
Files
memory/2424-0-0x0000000000500000-0x000000000050F000-memory.dmp
memory/2424-1-0x0000000000620000-0x0000000000626000-memory.dmp
memory/2424-2-0x0000000000620000-0x0000000000626000-memory.dmp
memory/2424-3-0x0000000000650000-0x0000000000656000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\asih.exe
| MD5 | 0dbdc511560bf70aa445cd75c509a997 |
| SHA1 | b759fa5ee54fc7ef034ff05ccce828a6665d3c48 |
| SHA256 | cc5c1ac4f7c56ba731d60edf4cebea65978b6e7cda224765916622bdd96d546a |
| SHA512 | 080c0e0fee2b316a346d73129baeeb44c16ffc85719c36748e91bad781388f1bb07f4b48c077102d1422a198cdf24d100a21f4a7dc6d4c0edf3b3c8e027915a1 |
memory/2424-18-0x0000000000500000-0x000000000050F000-memory.dmp
memory/4828-20-0x0000000000510000-0x0000000000516000-memory.dmp
memory/4828-26-0x00000000004D0000-0x00000000004D6000-memory.dmp
memory/4828-27-0x0000000000500000-0x000000000050F000-memory.dmp
Analysis: behavioral1
Detonation Overview
Submitted
2024-11-10 06:54
Reported
2024-11-10 06:57
Platform
win7-20241010-en
Max time kernel
149s
Max time network
155s
Command Line
Signatures
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\asih.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\2024-11-10_f41e7fdc67c790ad153b34139919681a_cryptolocker.exe | N/A |
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\2024-11-10_f41e7fdc67c790ad153b34139919681a_cryptolocker.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\asih.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2116 wrote to memory of 2184 | N/A | C:\Users\Admin\AppData\Local\Temp\2024-11-10_f41e7fdc67c790ad153b34139919681a_cryptolocker.exe | C:\Users\Admin\AppData\Local\Temp\asih.exe |
| PID 2116 wrote to memory of 2184 | N/A | C:\Users\Admin\AppData\Local\Temp\2024-11-10_f41e7fdc67c790ad153b34139919681a_cryptolocker.exe | C:\Users\Admin\AppData\Local\Temp\asih.exe |
| PID 2116 wrote to memory of 2184 | N/A | C:\Users\Admin\AppData\Local\Temp\2024-11-10_f41e7fdc67c790ad153b34139919681a_cryptolocker.exe | C:\Users\Admin\AppData\Local\Temp\asih.exe |
| PID 2116 wrote to memory of 2184 | N/A | C:\Users\Admin\AppData\Local\Temp\2024-11-10_f41e7fdc67c790ad153b34139919681a_cryptolocker.exe | C:\Users\Admin\AppData\Local\Temp\asih.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\2024-11-10_f41e7fdc67c790ad153b34139919681a_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-10_f41e7fdc67c790ad153b34139919681a_cryptolocker.exe"
C:\Users\Admin\AppData\Local\Temp\asih.exe
"C:\Users\Admin\AppData\Local\Temp\asih.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | emrlogistics.com | udp |
| US | 3.19.116.195:443 | emrlogistics.com | tcp |
| US | 3.18.7.81:443 | emrlogistics.com | tcp |
| US | 3.19.116.195:443 | emrlogistics.com | tcp |
| US | 3.18.7.81:443 | emrlogistics.com | tcp |
| US | 3.19.116.195:443 | emrlogistics.com | tcp |
| US | 3.18.7.81:443 | emrlogistics.com | tcp |
| US | 3.19.116.195:443 | emrlogistics.com | tcp |
| US | 3.18.7.81:443 | emrlogistics.com | tcp |
Files
memory/2116-0-0x0000000000500000-0x000000000050F000-memory.dmp
memory/2116-1-0x0000000000350000-0x0000000000356000-memory.dmp
memory/2116-3-0x0000000000480000-0x0000000000486000-memory.dmp
memory/2116-2-0x0000000000350000-0x0000000000356000-memory.dmp
\Users\Admin\AppData\Local\Temp\asih.exe
| MD5 | 0dbdc511560bf70aa445cd75c509a997 |
| SHA1 | b759fa5ee54fc7ef034ff05ccce828a6665d3c48 |
| SHA256 | cc5c1ac4f7c56ba731d60edf4cebea65978b6e7cda224765916622bdd96d546a |
| SHA512 | 080c0e0fee2b316a346d73129baeeb44c16ffc85719c36748e91bad781388f1bb07f4b48c077102d1422a198cdf24d100a21f4a7dc6d4c0edf3b3c8e027915a1 |
memory/2116-16-0x0000000000500000-0x000000000050F000-memory.dmp
memory/2184-18-0x00000000002C0000-0x00000000002C6000-memory.dmp
memory/2184-19-0x0000000000450000-0x0000000000456000-memory.dmp
memory/2184-26-0x0000000000500000-0x000000000050F000-memory.dmp