Analysis
-
max time kernel
126s -
max time network
134s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
23-03-2021 07:49
Static task
static1
Behavioral task
behavioral1
Sample
784577477.bin.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
784577477.bin.exe
Resource
win10v20201028
General
-
Target
784577477.bin.exe
-
Size
647KB
-
MD5
8524294a17274452361d886d9278de32
-
SHA1
8999a4b47f44f07f8cb2da8dc9934b21dd0e2507
-
SHA256
1367648c61fa272ebb3baed76d9df6075a81338bb646e887f2cd4ba9dc374f59
-
SHA512
8ffa313e486df4dda0413fd022c59374f4625ccf4e1e42b141709f86dfb29ddf006c17e3e1cb7b9c1d5892cb72921de791c5fa5222a32fb1b5c898ccd316f2ec
Malware Config
Extracted
C:\bootmgr.txt
https
http://diehard4uty2z5cs.onion/
Extracted
C:\BOOTNXT.txt
https
http://diehard4uty2z5cs.onion/
Extracted
C:\BOOTSECT.BAK.txt
https
http://diehard4uty2z5cs.onion/
Extracted
C:\vcredist2010_x64.log.html.txt
https
http://diehard4uty2z5cs.onion/
Extracted
C:\vcredist2012_x64_0_vcRuntimeMinimum_x64.log.txt
https
http://diehard4uty2z5cs.onion/
Extracted
C:\vcredist2012_x64_1_vcRuntimeAdditional_x64.log.txt
https
http://diehard4uty2z5cs.onion/
Extracted
C:\vcredist2013_x64_000_vcRuntimeMinimum_x64.log.txt
https
http://diehard4uty2z5cs.onion/
Extracted
C:\vcredist2013_x64_001_vcRuntimeAdditional_x64.log.txt
https
http://diehard4uty2z5cs.onion/
Extracted
C:\vcredist2019_x64_000_vcRuntimeMinimum_x64.log.txt
https
http://diehard4uty2z5cs.onion/
Extracted
C:\vcredist2019_x64_001_vcRuntimeAdditional_x64.log.txt
https
http://diehard4uty2z5cs.onion/
Extracted
Protocol: smtp- Host:
smtp.ionos.fr - Port:
587 - Username:
[email protected] - Password:
pilote30
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cougolio.js 784577477.bin.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1152 784577477.bin.exe