Analysis
-
max time kernel
114s -
max time network
134s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
23-03-2021 07:50
Static task
static1
Behavioral task
behavioral1
Sample
FR1000144787_1.bin.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
FR1000144787_1.bin.exe
Resource
win10v20201028
General
-
Target
FR1000144787_1.bin.exe
-
Size
387KB
-
MD5
e45cca363f250cf25222ee278d8d7599
-
SHA1
bd9a368a2f8ae2ae2946093bf5328770171ad56f
-
SHA256
713984a9d714e58c92b1338df4c54b55da27753d18c09d6a45427fd85c145454
-
SHA512
be1ad98b0bc0f690bdbc11c0915ec971bb168c6359f823e9cb1bc47293b280ea84f4c7a9740f7fa1452b0095faa6a0a1bec862b34b6e40119720efade255affb
Malware Config
Extracted
C:\Boot\memtest.exe.txt
ryuk
Extracted
C:\Boot\Fonts\jpn_boot.ttf.txt
ryuk
Extracted
C:\Recovery\WindowsRE\Winre.wim.txt
ryuk
Extracted
C:\Users\Admin\AppData\Local\Microsoft\GameDVR\KnownGameList.bin.txt
ryuk
Extracted
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe.txt
ryuk
Extracted
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncApi.dll.txt
ryuk
Extracted
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncViews.dll.txt
ryuk
Extracted
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ipcfile.dll.txt
ryuk
Extracted
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ipcsecproc.dll.txt
ryuk
Extracted
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe.txt
ryuk
Extracted
Protocol: smtp- Host:
smtp.ionos.fr - Port:
587 - Username:
[email protected] - Password:
8p<@MrL3
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bntyhxd.js FR1000144787_1.bin.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1192 FR1000144787_1.bin.exe