ryuk | 59a777daa0a5b26077c69c7cb26b7f72be6b38604b7caea7c6aef0e89991c748

Analysis

max time kernel
133s
max time network
115s
platform
windows7_x64
resource
win7v20201028
submitted
30-03-2021 11:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
Size

140KB
MD5

75a3cf8ced873ee7bc415e27e108496b
SHA1

ac94165d63c75f4adf1728aa2ecb776ac7c1c18e
SHA256

5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed
SHA512

7c3e166ff75ad32f70bfb355167333be4f9bc5b5740a231b4a1fb5c391bd8e137ebea6a3ba5370797f016cbdb83631bb5e459e0bc64beb3246ed9605b3bdb903

Score

10^/10

ryuk discovery ransomware

Malware Config

Extracted

Path

C:\$Recycle.Bin\RyukReadMe.html

Family

ryuk

Ransom Note

contact balance of shadow universe Ryuk $password = '5PcRSFW'; $torlink = 'http://rk2zzyh63g5avvii4irkhymha3irblchdfj7prk6zwy23f6kahidkpqd.onion'; function info(){alert("INSTRUCTION:\r\n1. Download tor browser.\r\n2. Open link through tor browser: " + $torlink + "\r\n3. Fill the form, your password: "+ $password +"\r\nWe will contact you shortly.\r\nAlways send files for test decryption.");};

URLs

http://rk2zzyh63g5avvii4irkhymha3irblchdfj7prk6zwy23f6kahidkpqd.onion

Signatures

Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
ransomware ryuk

Executes dropped EXE 2 IoCs

pid	Process
1524	dpcaSYZyrrep.exe
1580	AZKXDjpROlan.exe

Loads dropped DLL 4 IoCs

pid	Process
780	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
780	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
780	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
780	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
808	icacls.exe
616	icacls.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 780 wrote to memory of 1524	780	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe	29
PID 780 wrote to memory of 1524	780	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe	29
PID 780 wrote to memory of 1524	780	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe	29
PID 780 wrote to memory of 1524	780	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe	29
PID 780 wrote to memory of 1580	780	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe	30
PID 780 wrote to memory of 1580	780	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe	30
PID 780 wrote to memory of 1580	780	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe	30
PID 780 wrote to memory of 1580	780	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe	30

C:\Users\Admin\AppData\Local\Temp\5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
"C:\Users\Admin\AppData\Local\Temp\5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:780
- C:\Users\Admin\AppData\Local\Temp\dpcaSYZyrrep.exe
  "C:\Users\Admin\AppData\Local\Temp\dpcaSYZyrrep.exe" 9 REP
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Users\Admin\AppData\Local\Temp\AZKXDjpROlan.exe
  "C:\Users\Admin\AppData\Local\Temp\AZKXDjpROlan.exe" 8 LAN
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Users\Admin\AppData\Local\Temp\jvSryUKbPlan.exe
  "C:\Users\Admin\AppData\Local\Temp\jvSryUKbPlan.exe" 8 LAN
  2⤵
  PID:1060
- C:\Windows\SysWOW64\icacls.exe
  icacls "D:\*" /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:808
- C:\Windows\SysWOW64\icacls.exe
  icacls "C:\*" /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:616

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/780-2-0x0000000076071000-0x0000000076073000-memory.dmp

Filesize
8KB

Download