Analysis
-
max time kernel
61s -
max time network
112s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
16-04-2021 01:16
Static task
static1
Behavioral task
behavioral1
Sample
daossoft-rar-password-rescuer.exe
Resource
win10v20210410
General
-
Target
daossoft-rar-password-rescuer.exe
-
Size
3.2MB
-
MD5
b11ebc222d8e3ef1d307edab1f9d6912
-
SHA1
8408ca9375858485cd310ff376936025dc69f043
-
SHA256
7bec8fd7702e2d5e6c9b1a28f1233447c530db81bdfc960130cff97381595a42
-
SHA512
d66908e5a52979571985e29cde71766c235b53aae2658822cda2e2cbd7439e7dee62f307a8cce5583a424d9995772fb046b8df15b3b0588d2fceb1ed46d5f904
Malware Config
Extracted
C:\Program Files (x86)\Daossoft RAR Password Rescuer\DaossoftDictionary.txt
ryuk
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Executes dropped EXE 1 IoCs
pid Process 3896 RARPasswordRescuer.exe -
resource yara_rule behavioral1/files/0x000100000001ab75-115.dat upx behavioral1/files/0x000100000001ab75-116.dat upx -
Loads dropped DLL 2 IoCs
pid Process 3232 daossoft-rar-password-rescuer.exe 3896 RARPasswordRescuer.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 19 IoCs
description ioc Process File created C:\Program Files (x86)\Daossoft RAR Password Rescuer\RARPasswordRescuer.exe daossoft-rar-password-rescuer.exe File created C:\Program Files (x86)\Daossoft RAR Password Rescuer\cudart.dll daossoft-rar-password-rescuer.exe File created C:\Program Files (x86)\Daossoft RAR Password Rescuer\DaossoftDictionary.txt daossoft-rar-password-rescuer.exe File created C:\Program Files (x86)\Daossoft RAR Password Rescuer\Images\Button_Top_BuyNow.png daossoft-rar-password-rescuer.exe File created C:\Program Files (x86)\Daossoft RAR Password Rescuer\Images\Button_Top_Help.png daossoft-rar-password-rescuer.exe File created C:\Program Files (x86)\Daossoft RAR Password Rescuer\Images\Button_Top_Stop.png daossoft-rar-password-rescuer.exe File created C:\Program Files (x86)\Daossoft RAR Password Rescuer\Images\Dlg_Common_Top.bmp daossoft-rar-password-rescuer.exe File created C:\Program Files (x86)\Daossoft RAR Password Rescuer\License.rtf daossoft-rar-password-rescuer.exe File created C:\Program Files (x86)\Daossoft RAR Password Rescuer\uninst.exe daossoft-rar-password-rescuer.exe File created C:\Program Files (x86)\Daossoft RAR Password Rescuer\Images\Button_OpenFile.png daossoft-rar-password-rescuer.exe File created C:\Program Files (x86)\Daossoft RAR Password Rescuer\Images\Button_Top_About.png daossoft-rar-password-rescuer.exe File created C:\Program Files (x86)\Daossoft RAR Password Rescuer\Images\Button_Top_OpenFile.png daossoft-rar-password-rescuer.exe File created C:\Program Files (x86)\Daossoft RAR Password Rescuer\Images\Button_Top_Start.png daossoft-rar-password-rescuer.exe File created C:\Program Files (x86)\Daossoft RAR Password Rescuer\RAR.dll daossoft-rar-password-rescuer.exe File created C:\Program Files (x86)\Daossoft RAR Password Rescuer\sample\sample.rar daossoft-rar-password-rescuer.exe File created C:\Program Files (x86)\Daossoft RAR Password Rescuer\unrar.dll daossoft-rar-password-rescuer.exe File created C:\Program Files (x86)\Daossoft RAR Password Rescuer\Images\Tab_Background.bmp daossoft-rar-password-rescuer.exe File created C:\Program Files (x86)\Daossoft RAR Password Rescuer\Images\Tab_Item.bmp daossoft-rar-password-rescuer.exe File opened for modification C:\Program Files (x86)\Daossoft RAR Password Rescuer\Daossoft RAR Password Rescuer.url daossoft-rar-password-rescuer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3896 RARPasswordRescuer.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3896 RARPasswordRescuer.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 3896 RARPasswordRescuer.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3896 RARPasswordRescuer.exe 3896 RARPasswordRescuer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\daossoft-rar-password-rescuer.exe"C:\Users\Admin\AppData\Local\Temp\daossoft-rar-password-rescuer.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
PID:3232
-
C:\Program Files (x86)\Daossoft RAR Password Rescuer\RARPasswordRescuer.exe"C:\Program Files (x86)\Daossoft RAR Password Rescuer\RARPasswordRescuer.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3896