ryuk | 60c16e45c5cbe88a38911f1e3176d90444e4884261d8481d4d719acec1bc5025

General

Target

60c16e45c5cbe88a38911f1e3176d90444e4884261d8481d4d719acec1bc5025.exe
Size

136KB
MD5

45295780f2ba837be42ccf50710bd2b5
SHA1

f937b1b7b3593a38702f870077658a891974edda
SHA256

60c16e45c5cbe88a38911f1e3176d90444e4884261d8481d4d719acec1bc5025
SHA512

588666aa108f01334c2e0adc03aa68d5e3ebb68ee773939b668a5a6ca1eacf03570b7608d4ca3c936dd7f7ec6edd4063a05b1cef7d446661c8f00f8520e72f8b

Score

10^/10

ryuk discovery ransomware

Malware Config

Extracted

Path

C:\$Recycle.Bin\RyukReadMe.html

Family

ryuk

Ransom Note

contact balance of shadow universe Ryuk $password = 'spyZ3Hxws'; $torlink = 'http://smtpys6pvcvdvram6xucwecfv7rdhs6fmxzivrbcrncdeiphryhb75id.onion'; function info(){alert("INSTRUCTION:\r\n1. Download tor browser.\r\n2. Open link through tor browser: " + $torlink + "\r\n3. Fill the form, your password: "+ $password +"\r\nWe will contact you shortly.\r\nAlways send files for test decryption.");};

URLs

http://smtpys6pvcvdvram6xucwecfv7rdhs6fmxzivrbcrncdeiphryhb75id.onion

Signatures

Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
ransomware ryuk

Executes dropped EXE 2 IoCs

pid	Process
1664	cZcPGitnsrep.exe
1904	AZaddgnGZlan.exe

Loads dropped DLL 4 IoCs

pid	Process
2032	60c16e45c5cbe88a38911f1e3176d90444e4884261d8481d4d719acec1bc5025.exe
2032	60c16e45c5cbe88a38911f1e3176d90444e4884261d8481d4d719acec1bc5025.exe
2032	60c16e45c5cbe88a38911f1e3176d90444e4884261d8481d4d719acec1bc5025.exe
2032	60c16e45c5cbe88a38911f1e3176d90444e4884261d8481d4d719acec1bc5025.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
268	icacls.exe
532	icacls.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1664	2032	60c16e45c5cbe88a38911f1e3176d90444e4884261d8481d4d719acec1bc5025.exe	29
PID 2032 wrote to memory of 1664	2032	60c16e45c5cbe88a38911f1e3176d90444e4884261d8481d4d719acec1bc5025.exe	29
PID 2032 wrote to memory of 1664	2032	60c16e45c5cbe88a38911f1e3176d90444e4884261d8481d4d719acec1bc5025.exe	29
PID 2032 wrote to memory of 1664	2032	60c16e45c5cbe88a38911f1e3176d90444e4884261d8481d4d719acec1bc5025.exe	29
PID 2032 wrote to memory of 1904	2032	60c16e45c5cbe88a38911f1e3176d90444e4884261d8481d4d719acec1bc5025.exe	30
PID 2032 wrote to memory of 1904	2032	60c16e45c5cbe88a38911f1e3176d90444e4884261d8481d4d719acec1bc5025.exe	30
PID 2032 wrote to memory of 1904	2032	60c16e45c5cbe88a38911f1e3176d90444e4884261d8481d4d719acec1bc5025.exe	30
PID 2032 wrote to memory of 1904	2032	60c16e45c5cbe88a38911f1e3176d90444e4884261d8481d4d719acec1bc5025.exe	30

C:\Users\Admin\AppData\Local\Temp\60c16e45c5cbe88a38911f1e3176d90444e4884261d8481d4d719acec1bc5025.exe
"C:\Users\Admin\AppData\Local\Temp\60c16e45c5cbe88a38911f1e3176d90444e4884261d8481d4d719acec1bc5025.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Users\Admin\AppData\Local\Temp\cZcPGitnsrep.exe
  "C:\Users\Admin\AppData\Local\Temp\cZcPGitnsrep.exe" 9 REP
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Users\Admin\AppData\Local\Temp\AZaddgnGZlan.exe
  "C:\Users\Admin\AppData\Local\Temp\AZaddgnGZlan.exe" 8 LAN
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Users\Admin\AppData\Local\Temp\gyVzdbybilan.exe
  "C:\Users\Admin\AppData\Local\Temp\gyVzdbybilan.exe" 8 LAN
  2⤵
  PID:1992
- C:\Windows\SysWOW64\icacls.exe
  icacls "C:\*" /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:268
- C:\Windows\SysWOW64\icacls.exe
  icacls "D:\*" /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:532
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  PID:2072
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:2100
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  PID:2172
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:2976
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:1076
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:2888
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:1436

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "samss" /y
1⤵
PID:2920

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

1

T1222

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2032-59-0x0000000075C31000-0x0000000075C33000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing