ryuk | 60c16e45c5cbe88a38911f1e3176d90444e4884261d8481d4d719acec1bc5025

General

Target

60c16e45c5cbe88a38911f1e3176d90444e4884261d8481d4d719acec1bc5025.exe
Size

136KB
MD5

45295780f2ba837be42ccf50710bd2b5
SHA1

f937b1b7b3593a38702f870077658a891974edda
SHA256

60c16e45c5cbe88a38911f1e3176d90444e4884261d8481d4d719acec1bc5025
SHA512

588666aa108f01334c2e0adc03aa68d5e3ebb68ee773939b668a5a6ca1eacf03570b7608d4ca3c936dd7f7ec6edd4063a05b1cef7d446661c8f00f8520e72f8b

Score

10^/10

ryuk discovery ransomware

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\RyukReadMe.html

Family

ryuk

Ransom Note

contact balance of shadow universe Ryuk $password = 'spyZ3Hxws'; $torlink = 'http://smtpys6pvcvdvram6xucwecfv7rdhs6fmxzivrbcrncdeiphryhb75id.onion'; function info(){alert("INSTRUCTION:\r\n1. Download tor browser.\r\n2. Open link through tor browser: " + $torlink + "\r\n3. Fill the form, your password: "+ $password +"\r\nWe will contact you shortly.\r\nAlways send files for test decryption.");};

URLs

http://smtpys6pvcvdvram6xucwecfv7rdhs6fmxzivrbcrncdeiphryhb75id.onion

Signatures

Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
ransomware ryuk

Executes dropped EXE 2 IoCs

pid	Process
1684	YGnuTcxQDrep.exe
744	FNhVCISQWlan.exe

Loads dropped DLL 4 IoCs

pid	Process
1824	60c16e45c5cbe88a38911f1e3176d90444e4884261d8481d4d719acec1bc5025.exe
1824	60c16e45c5cbe88a38911f1e3176d90444e4884261d8481d4d719acec1bc5025.exe
1824	60c16e45c5cbe88a38911f1e3176d90444e4884261d8481d4d719acec1bc5025.exe
1824	60c16e45c5cbe88a38911f1e3176d90444e4884261d8481d4d719acec1bc5025.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
568	icacls.exe
1108	icacls.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 1684	1824	60c16e45c5cbe88a38911f1e3176d90444e4884261d8481d4d719acec1bc5025.exe	29
PID 1824 wrote to memory of 1684	1824	60c16e45c5cbe88a38911f1e3176d90444e4884261d8481d4d719acec1bc5025.exe	29
PID 1824 wrote to memory of 1684	1824	60c16e45c5cbe88a38911f1e3176d90444e4884261d8481d4d719acec1bc5025.exe	29
PID 1824 wrote to memory of 1684	1824	60c16e45c5cbe88a38911f1e3176d90444e4884261d8481d4d719acec1bc5025.exe	29
PID 1824 wrote to memory of 744	1824	60c16e45c5cbe88a38911f1e3176d90444e4884261d8481d4d719acec1bc5025.exe	30
PID 1824 wrote to memory of 744	1824	60c16e45c5cbe88a38911f1e3176d90444e4884261d8481d4d719acec1bc5025.exe	30
PID 1824 wrote to memory of 744	1824	60c16e45c5cbe88a38911f1e3176d90444e4884261d8481d4d719acec1bc5025.exe	30
PID 1824 wrote to memory of 744	1824	60c16e45c5cbe88a38911f1e3176d90444e4884261d8481d4d719acec1bc5025.exe	30

C:\Users\Admin\AppData\Local\Temp\60c16e45c5cbe88a38911f1e3176d90444e4884261d8481d4d719acec1bc5025.exe
"C:\Users\Admin\AppData\Local\Temp\60c16e45c5cbe88a38911f1e3176d90444e4884261d8481d4d719acec1bc5025.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Users\Admin\AppData\Local\Temp\YGnuTcxQDrep.exe
  "C:\Users\Admin\AppData\Local\Temp\YGnuTcxQDrep.exe" 9 REP
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Users\Admin\AppData\Local\Temp\FNhVCISQWlan.exe
  "C:\Users\Admin\AppData\Local\Temp\FNhVCISQWlan.exe" 8 LAN
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Users\Admin\AppData\Local\Temp\UYDAmZoGWlan.exe
  "C:\Users\Admin\AppData\Local\Temp\UYDAmZoGWlan.exe" 8 LAN
  2⤵
  PID:756
- C:\Windows\SysWOW64\icacls.exe
  icacls "C:\*" /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:568
- C:\Windows\SysWOW64\icacls.exe
  icacls "D:\*" /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:1108
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  PID:2388
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:1660
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  PID:2360
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:1324
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:1508
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:2540
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:684
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:2848

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

1

T1222

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1824-60-0x0000000075631000-0x0000000075633000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing