1de90d5e4c6c3c6ed25dbfac8864097800e8d4c7d6971e2eade35336170ed259

Analysis

max time kernel
133s
max time network
140s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 07:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-11-21_553b9ebc3c02b29d05a807c42f5f7223_cryptolocker.exe
Size

55KB
MD5

553b9ebc3c02b29d05a807c42f5f7223
SHA1

514732f17b62fefb639e5ec73626ff72789e9366
SHA256

1de90d5e4c6c3c6ed25dbfac8864097800e8d4c7d6971e2eade35336170ed259
SHA512

fe6d98dc0c5f36dcc84484102317ae30e9cc8c20a4c4522970e30944eeb10151d9a325ea57d85ae1088c5dd76edbdad70d034c54af22ec030ddf7257d9af1ccf
SSDEEP

768:bco/2n1TCraU6GD1P2wZEjbhxnbcuyD7U9kXDn62tH/1/LpPFPw:b7/y28wZEjbnouy8G76iH/NLpm

Score

7^/10

discovery upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

rewok.exe

pid process

768 rewok.exe
Loads dropped DLL 1 IoCs

Processes:

2024-11-21_553b9ebc3c02b29d05a807c42f5f7223_cryptolocker.exe

pid process

1924 2024-11-21_553b9ebc3c02b29d05a807c42f5f7223_cryptolocker.exe

pid	process
768	rewok.exe

pid	process
1924	2024-11-21_553b9ebc3c02b29d05a807c42f5f7223_cryptolocker.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1924-0-0x0000000000400000-0x000000000040E000-memory.dmp	upx
\Users\Admin\AppData\Local\Temp\rewok.exe	upx
behavioral1/memory/768-17-0x0000000000400000-0x000000000040E000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

2024-11-21_553b9ebc3c02b29d05a807c42f5f7223_cryptolocker.exerewok.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-11-21_553b9ebc3c02b29d05a807c42f5f7223_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rewok.exe

Suspicious use of UnmapMainImage 2 IoCs

Processes:

2024-11-21_553b9ebc3c02b29d05a807c42f5f7223_cryptolocker.exerewok.exe

pid process

1924 2024-11-21_553b9ebc3c02b29d05a807c42f5f7223_cryptolocker.exe
768 rewok.exe

pid	process
1924	2024-11-21_553b9ebc3c02b29d05a807c42f5f7223_cryptolocker.exe
768	rewok.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-11-21_553b9ebc3c02b29d05a807c42f5f7223_cryptolocker.exe

description	pid	process	target process
PID 1924 wrote to memory of 768	1924	2024-11-21_553b9ebc3c02b29d05a807c42f5f7223_cryptolocker.exe	rewok.exe
PID 1924 wrote to memory of 768	1924	2024-11-21_553b9ebc3c02b29d05a807c42f5f7223_cryptolocker.exe	rewok.exe
PID 1924 wrote to memory of 768	1924	2024-11-21_553b9ebc3c02b29d05a807c42f5f7223_cryptolocker.exe	rewok.exe
PID 1924 wrote to memory of 768	1924	2024-11-21_553b9ebc3c02b29d05a807c42f5f7223_cryptolocker.exe	rewok.exe

C:\Users\Admin\AppData\Local\Temp\2024-11-21_553b9ebc3c02b29d05a807c42f5f7223_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-21_553b9ebc3c02b29d05a807c42f5f7223_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Users\Admin\AppData\Local\Temp\rewok.exe
  "C:\Users\Admin\AppData\Local\Temp\rewok.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of UnmapMainImage
  PID:768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\rewok.exe

Filesize
55KB

MD5
ba4f46e7032a0f2ba298e0fa11c9cf17

SHA1
3a8e99bebbae0557094e1dd9c83239b0df3329c1

SHA256
97512ef97e8b1694ed5658328e010541782f31dafb1c51a1e4ab4bbd1758266d

SHA512
08a2bbcd985650d5e9cf3857ed33df67a6148cf2532fbe2d45f77fb5711b4564762c92a45708dedd769e59414fc18263446479c09ae1ff54e116d6de869fd42c

Download Submit
memory/768-17-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/768-26-0x0000000000390000-0x0000000000396000-memory.dmp

Filesize
24KB

Download
memory/1924-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1924-1-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/1924-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1924-8-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/1924-15-0x00000000004B0000-0x00000000004BE000-memory.dmp

Filesize
56KB

Download