ryuk | 34e4e0f587ea3cbbd417710ec5b90de335dca96f6773fdd4ffb31b97b8913f8d

General

Target

KD.exe
Size

7KB
MD5

ad309c9d2e62a1ceb52cdb76833bb9ff
SHA1

f93694b6d153c6a50950f1df29c36fbbae5d1931
SHA256

34e4e0f587ea3cbbd417710ec5b90de335dca96f6773fdd4ffb31b97b8913f8d
SHA512

addb8b06e6c0791f72b39183cfa850b2553730b60242a38775acc65f6c88e44f431ec3eaadb9bb3c506e639b391f74391890ae6a27c4a2f4e7c3da336b9954a4

Score

10^/10

ryuk evasion ransomware themida trojan

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Roaming\dllhost.txt

Family

ryuk

Ransom Note

TVqQ**M****E****//8**Lg*********Q***********************************************g*****4fug4*t*nNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJ*********BQRQ**T*EH*INL5WE**********O***gEL*Qs**JYm*Q*S********WKB7*Q*g****wCYB**B****g*****g**B**********E**********C*rQE*B***BoJZ*QI*QI***B***B******E***E********B***************Do*JwFQ*****C*n*ZwP*********************************************************************************************************************************************C*gIC*gIC*g*K*m*Q*g****liYB**Q******************C***G*gIC*gIC*gIK*P****wCYBmwY***CaJgE***************B***B*IC*gIC*gIC*M*****O*m*Q8*****oiYB****************Q***Qi5pbXBvcnRz*C******JwE**g***KQm*Q***************E***M*ucnNyYw*****g****ICcB*B****CmJgE***************B***B*LnRoZW1pZGE*YFQ**E*n*Q******tiYB****************Y***4C5ib290*****NQx**CgewFx0jE**LYm*Q***************G***G************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************/DrJbPNIaVBzeGlcE0jZV/oayWj1eGlc*0hpX*NIaTr0GGlZ+UrJbPNIaVzzSGlc80hpXPNIaVzzSGlc80hpXPNIaVzzSGlc80hpXPNIaV8kSDlXo3hpX*NIaGz1yxlc8+E4DPNIi17zaGlV4ghpX5Poy6wVkX4M*0huVRaIaVX4EFls+ErpfPNIyVUbaGlV+Be5bPhBCXwDQWvsE0hpPPho2Wz4QQGM*0FuD*N4bl5zaGlcU0EJP*NBbgjTaG5VE2gZVfX4CVzzKG58Q3huVR*YCVX4GBls+ErpfPNIyV5z2GlcU0qJXqRIKVWDeGlcE0hobPN*SCzzSIl/eFvZXPPoiVxSCEl/UKgJjGW7+VTSOGlfk2F4zPNIiQwy4Xjc80iJWtQoyQXi+GlfkwhJf6PdWfxTGCj14shpX5NIZL/zKya8*5j7rGMhePzzSIlas3hkvEUoaVrTeGlRk3hpX*KIaVwTS3lQ16hoXPNIaVzzSBlS+WhpL*NIaW7Tauj880iL8hMbLqwDSGkcFcu5XPPoaVwVyMlc8yhpUZN4aV8kS*lRo3hpX*NIaGzzGqmMGJgZXPMLJrwFmBjPky1ZvPNhuXzzSC5Og0hp/PNICQ5yiGlfk0qJXyRIKVEzyGlcI0hobP5IOVzzauis80iODtNIaf+TYTtc80iOrBNIaRwYGnlc8+BZHPNIKXUlSGlfmLgpXPMIDg7jSGn0wyhpXDNhO1zzSI6sU0hpHBgaeVzz4Fnc80gpdSVIaV+YuOlc8wgODuNIafTD6GlcM2E7XPNIjq+TSGkcGBp5XPPgWZzzSCl0oxhpXDhaaVzz6Gl0owhpXDhaaVzz6Gl0ozhpXDhaaVzz6Gl0oyhpXDhaaVzz6Gl0o9hpXDhaaVzz6Gl0o8hpXDhaaVzz6Gl0o/hpXDhaaVzz6Gl0o+hpXDhaaVzz6Gl0o5hpXDhaaVzz6Gl0o4hpXDhaaVzz6Gl+dXhpX5NIDowTSGkcWGqJfPhBewzzSI4eU0hpZeUIaV+TS*6ME0hpHuX7zg4zSGn15ShpX5NIDowTSGkVFlgJVfhKyVzz6Gl0oxhpXDVFmQzzSm+8*0huDmNIafXl+Glfk0gOjBNIaR9YWplc8+hpdKMYaVwyIXuM80iJXBiYOVzzCM5yUxhuVeUYaV+YCslc83F7HPNIiVwYmDlc8wphXPNIa09YGilc8+F7PPNIiVwYmDlc8wEBjBNBbl5TSGn882G5HPNIK1iDGGle+agZXPga+Vzz4Xvs80iJXBiYOVzzC/5Bg3hp/PNhuRzzSCg15ZhpX5NIDowzSGkcWGIJDPhBewzzSI4eU0hpZeUIaV+TS*6MM0hpHvvIaVz1Wk4OM0hp9eUoaV+TS*6MM0hpFR/YCVX4Sslc8+hpdKM4aVw1RZkM80pvv*NIbg5jSGn15fhpX5NIDowzSGkfeFqZXPPoaXSjOGlcMiF7jPNIiVwYmNlc8wjOetMYblXlGGlfm*rJXPNxexzzSIlcGJjZXPMKYFzzSGtOWBopXPPhezzzSIlcGJjZXPMBCQwjQW5eU0hp/PNhuTzzSCtYgxhpXvmoGVz4Gvlc8+F77PNIiVwYmNlc8wueQYN4afzzYbk880goNeWYaV+TS*6MU0hpHFhriQz4QXsM80iOHlNIaWXlCGlfk0gOjFNIaR76yGlc9V1ODjNIafXlKGlfk0gOjFNIaRUXWDlV+ErJXPPoaXSj2GlcNUWZDPNKb7wDSG4OY0hp9eX4aV+TS*6MU0hpHphamVzz6Gl0o9hpXDIhe4zzSIlcGJj5XPMIznNTCG5V5RhpX5gKyVzzcXsc80iJXBiY+VzzCmNc80hrQVgKKVzz4Xs880iJXBiY+Vzz*Q6MI0FuXlNIafzzYbnc80grWIMYaV75qBlc+Br5XPPhe+zzSIlcGJj5XPMLvkGDeGn882G53PNIKDXlmGlfk0gOjHNIaRxYYwkc+EF7DPNIjh5TSGll5QhpX5NIDoxzSGke/chpXPVcTg4zSGn15ShpX5NIDoxzSGkVHNg5VfhKyVzz6Gl0o/hpXDVFmQzzSm+8*0huDmNIafXl+Glfk0gOjHNIaR64Wplc8+hpdKP4aVwyIXuM80iJXBiYmVzzCM570whuVeUYaV+YCslc83F7HPNIiVwYmJlc8wpiXPNIa0BYCilc8+F7PPNIiVwYmJlc8wEGDCNBbl5TSGn882G5/PNIK1iDGGle+agZXPga+Vzz4Xvs80iJXBiYmVzzCl5Bg3hp/PNhufzzSCg15ZhpX5NIDo+TSGkcWGiJHPhBewzzSI4eU0hpZeUIaV+TS*6Pk0hpHvzIaVz1X04OM0hp9eUoaV+TS*6Pk0hpFRRYKVX4Sslc8+hpdKOYaVw1RZkM80pvv*NIbg5jSGn15fhpX5NIDo+TSGke2FqZXPPoaXSjmGlcMiF7jPNIiVwYmLlc8wjOcFM4blXlGGlfm*rJXPNxexzzSIlcGJi5XPMKZVzzSGtDW*opXPPhezzzSIlcGJi5XPMBD6wzQW5eU0hp/PNhuZzzSCtYgxhpXvmoGVz4Gvlc8+F77PNIiVwYmLlc8wp55eXoaV+TS*6Po0hpH1haiVzz6Gl+E0hlUPUYaVP3YTuc80iL0bN4afzza/vRw3hp/PNq67zzSIl0o4hpXDhdeVzz6Gl+dahpX5NhuYzzSC5B43hp/PNq67zzSIl0o+hpXDhdeVzz6Gl+dahpX5NhuezzSC5B43hp/PNq67zzSIl0o8hpXDhdeVzz6Gl+dahpX5NhuczzSC5B43hp/PNq67zzSIl0oyhpXDhdeVzz6Gl+dahpX5NhuSzzSC5B43hp/PNq67zzSIl0owhpXDhdeVzz6Gl+dahpX5NhuQzzSC5B43hp/PNh*cwzQWvuU0hp/PNqYtwjSGtWk2hpVSXIaV+Vyulc8+hpdKMYaVw4XWlc8+hpdKMIaVw4XWlc8+hpdKM4aVw4XWlc8+hpdKMoaVw4XWlc8+hpdKPYaVw4XWlc8+hpdKPIaVw4XWlc8+hpdKP4aVw4XWlc8+hpdKPoaVw4XWlc8+hpdKOYaVw4XWlc8+hpdKOIaVw4XWlc8+hpf1XNGVzz6Gv/JEg5VfMIaVwzSGhs+B0JXPPoqdUkCGlfk7iedvM4blXkOGlfk0ieeVM4blXkKGlfk0iYNeTYaV+TSJjF5MhpX5NImMXk+Glfk0iYxeToaV+TSJ5*k3hp/PPIiTXkiGlflS3mrBNIaVxYXalc8+F6vPNIiYxoZoks+EF9TPNIi5/z0QtMQ0FuUON4af9Qq*uM*ts5HwMNWFUVmNlV9ftpXPMoatijGGlcaGCJfPhBfUzzSIuf89ELTENBblDjeGn/UKgLj*LbOR8DDVhVGljZVfX7aVzzKGrUYxhpXGhpCTz4QX1M80iLn/PRC0xDQW5Q43hp/1CoC4wC2zkf*w1YVRUYyVX1+2lc8yhq0yMYaVxoY*nM+EF9TPNIi5/z0QtMQ0FuUON4af9Qq*uM*ts5HwMNWFUcWMlV9ftpXPMoat7jaGlcaGiJzPhBfUzzSIuf89ELTENBblDjeGn/UKgLj*LbOR8DDVhVFHj5VfX7aVzzKGrdo2hpXGhgydz4QX1M80iLn/PRC0xDQW5Q43hp/1CoC4wC2zkf*w1YVRF46VX1+2lc8yhq2WNoaVxobrnc+EF9TPNIi5/z0QtMQ0FuUON4af9Qq*uM*ts5HwMNWFUa6OlV9ftpXPMoatQjaGlcaGn57PhBfUzzSIuf89ELTENBblDjeGn/UKgLj*LbOR8DDVhVFOiZVfX7aVzzKGrT42hpXGhiufz4QX1M80iLn/PRC0xDQW5Q43hp/1CoC4wC2zkf*w1YVR7ImVX1+2lc8yhq3qN4aVxobTn8+EF9TPNIi5/D0Qy/k0FuUON4afGja/gMMngrr/huGfz4Suhc80jJUXGYGVzz0QIfk0FuUNN4afGzqP50w3huVedIaV+VmBjPIwsZEcJxBF+TQWvv80hpPPTFmWzzSP5/I5huVedYaV+Vi1nFFwi5VfhMeVzz6rlvYhgobDW7bnBjiG5eckhpXFNN4dzzSGnFHai5VfhMSVzz6qmsaGw5jPhBfVzzSIuM*ts5HwMNWaURKKlV9ftpXPMoa4KTwQ0/s0FuUNN4afGzqP5wI4huVedIaV+VmBjPIwsZEcOhDh+zQWvv80hpPPWaqcUf6KlV+ExJXPPqqaxobDmM+EF9XPNIi4wC2zkf*w1ZhRCrWVX1+2lc8yhpXFhdqVzz4X1s80iIPNNrOR8DDYecs0hrjtNq6PzzSIvxkxro/PNIiVzzSolfJEg5UON4aVxDSGhs+KipXPMLK9*zeGn/UKgJnHW6CVUW61lV/njZXPNq6KzzSI5*Q3hp9SfYaV+T6MFfs0hpHPioqVzzCLuM89qJXyRIGV+jSGlcU0hobPirWVzzCIuM8yqLfPNgabzzSCvyExsur9NIaRwVy7lc8+hpXBXLeVzzKGlRk3hpXyRICVGjeGlc*0hobPMaqYwYm0lc8wsmv*WYGM+TLVm882G4TPNILk6DSGn880gJDnKIaV+TSolfJEgpXzM4aVwjSGhs/kjJXPNq6KzzSI4O00hp/5NhO1zzSI6v40hpHBgaeVzz4Fhs80gpdSVIaV+Yuxlc8wgODuNIafTCGGlcM2E7XPNIjq8jSGkcGBp5XPPgWCzzSCl1JUhpX5i72VzzC*6P40hpFeV4aV+TS*6P80hpFeV4aV+TS*6P*0hpFeV4aV+TS*6PE0hpFeV4aV+TS*6PI0hpFeV4aV+TS*6PM0hpFeV4aV+TS*6PQ0hpFeV4aV+TS*ve*0hp/PNhuFzzSCk1FZgJVfhKCVzz4SvM80geTiNIafzzYbhc80grXeNYaV7q*Tss80iOTkNIafzzYbhc80guc9MYblXl2Glfk0gOj+NIaR78+*lc9UFJfPNBO9zzSI5Oc0hp/PNhuFzzSCjF5ehpX5NIDo/jSGkfWFqJXPPoaXSieGlcMyEPzBNBbl4TSGn1NdhpX*haOVzz6Gl0onhpXDVJ+UzjSmCVJThpX5ha2Vzz6Gl0onhpXDhgiQz4QXvM80iJXBibaVzzCmLsE0hrVdNoaVUlyGlfmFrpXPPoaXSieGlcMsF7/PNIiVwYm2lc8wvOQZN4afzzYbh880gpNR0YCVX4Sglc8+ErzPNIHk4jSGn882G4fPNIK1zjWGle7QE7LPNIjk5DSGn882G4fPNILnhTGG5V5dhpX5NIDo8DSGke/PgJXPVBSXzzQTvc80iOTnNIafzzYbh880go5eXoaV+TS*6P*0hpH1haiVzz6Gl0ohhpXDMhB0wTQW5eE0hp9TXYaVwIWjlc8+hpdKIYaVw1SPlM40pjlSU4aV+YWtlc8+hpdKIYaVw4a*kM+EF7zPNIiVwYmwlc8wpi7BNIa1XTaGlVJchpX5ha6Vzz6Gl0ohhpXDLhe/zzSIlcGJsJXPMLzkGTeGn882G4HPNIKTUSmDlV+EoJXPPhK8zzSB5OI0hp/PNhuBzzSCtf41hpXuwBOyzzSI5OQ0hp/PNhuBzzSC5w0whuVeXYaV+TS*6PI0hpHvz4CVz1QUl880E73PNIjk5zSGn882G4HPNIKIXl6Glfk0gOjyNIaR9YWolc8+hpdKI4aVwzIQzMI0FuXhNIafU12GlcCFo5XPPoaXSiOGlcNUv5TONKYpUlOGlfmFrZXPPoaXSiOGlcOGGJHPhBe8zzSIlcGJspXPMKYuwTSGtV02hpVSXIaV+YWulc8+hpdKI4aVwygXv880iJXBibKVzzC85Bk3hp/PNhuDzzSCk1Ghg5VfhKCVzz4SvM80geTiNIafzzYbg880grXuNYaV7v*Tss80iOTkNIafzzYbg880gueVMIblXl2Glfk0gOj0NIaR78+*lc9UFJfPNBO9zzSI5Oc0hp/PNhuDzzSCil5ehpX5NIDo9DSGkfWFqJXPPoaX4TSGVQ9RhpU/dhO5zzSIvRs3hp/PNr+9HDeGn882rrvPNIiXSiKGlcOF15XPPoaX51qGlfk2G4LPNILkHjeGn882rrvPNIiXSiCGlcOF15XPPoaX51qGlfk2G4DPNILkHjeGn882rrvPNIiXSiaGlcOF15XPPoaX51qGlfk2G4bPNILkHjeGn882rrvPNIiXSiSGlcOF15XPPoaXUcK1lV9frJXPPoaXSiSGlcOF1pXPPoaXSieGlcOF1pXPPoaXSiaGlcOF1pXPPoaXSiGGlcOF1pXPPoaXSiCGlcOF1pXPPoaXSiOGlcOF1pXPPoaXSiKGlcOF1pXPPoaX9VzRlc8+hr/yRIOV*jeGlcY0hobPgdCVzz6LnFJ*hpX5OI7nbzOG5V5DhpX5NI6XXkKGlfk0joxeT4aV+TSOjF5OhpX5NI7kCTeGn889iJNeSIaV+VKoi8FcuJXPPqiVNE0Zlr35l1T*NIaVcDeGlVtgGeFTkhWkMZIT5VSB4/JSRfDyUoQd4CKS8PIgk+3nG1cV4SKEEPpYkaq1NZIQ4ViEFKsTRda7H0XWue9xHfpTghDzDIXt4lOB4fkbV/biIZvp8DqSGcJemO37DJHfrCBC46IVRtmgE5LWrQhQ8+5Sg+36HWHt4F6CEPEkgNTHVIUS/1yS8PJShB3gIpLz8lMxhpXPPYaVzzeGlc+c8+5Sg+36HXMQ91aeFP0dcenhXJYWuu9hGeFTkhWk*4Hh7FiF77nvYu3nUp4X5*xD1KUdR9SlG1fD4luDHe*kShTzVIMQ91tbpsVUker+Injt7jOE6/JdSuClEp3d8xad0aYjQtb2Epb21gNnwdEgRpMSITqHWiUqw3uifnmDpm6lrK+NLaqjvWnLVDeGldk3hpU9N4aVgjeGleY0hpVrN4aVzzSGlSQxhpXhhIb+z5GG4c+DhufPk4bXz4WG7c9HhrvPf4b6z5eG/M+ThpXPNIa3XzfplSI3EpZUNxCWJDf*lV43HpYRN9SVODcVli*375UkNzbG8DSg5c+fhvDPgIbiz4aG8s92huTPjIagz1qG3s+bhvbPnYbyz1QhsM9WFpZYN+OVUzcdllE37ZUBNxeWVzfSlR03yZVcN+GVJjftlZ8G0pXhhIb+z5GG4c+DhufPk4bXz4WG7c9DhrvPf4b6z5eG/M+ThtUBcoa3XzfplSI3EpZUNxCWJDf*lV43HpYVN9SVODcVli*375UkN3Y*NTeg5c+fhvDPgIbiz4aG8s92huTPjIasz1qG3s+bhvbPnYbyz5Rj/c90hpbPNIaUzjSGl880hpXPNIaZwTSGlTBgGeFTkhWk*4Hh7FiF77nvYu3nUp4X5*xD1KUdR9SlG1fD4luDHe*kShTzVIMQ91tbpsVUker+Injt7jOE6/JdSuClEp3d8xad0aYjQtb2EpaNls80hoIyjhPiJJrU0VGWH/9dnNTXWIMV9182hpXPMML2U5aPl8E0hpX4MYaVzyWDlc80lcXwNI*eP2XPmvkuiJXPNLXeB3Pwlc8z9pXPMYadwTSGlTxxe0DPNIaWUmHP18/adIrYN4aVw53B2g*3hiZ+OJr3xDSGlfiEzs5SN4abjjeGm4423pIyU4aVztLJ0QBjHvTbqh3K63+YlcbtNrbgcI7RxySOtvgk2p6dtoZWrOplS6xqwNer6hxtXRoXRY0cW+2WXBvtSsxEn6jIx+uO3Fj8aZ0+j8U7ogJM9OwIbRlreD74cj1t2eiDeguin5ucjdE3UYI3z2cGvg8jpp//Mw6Q*zYglufEJPmU02rSwNaGxk9f1tz*Bnrc81SIhcS8gNH*1obGT1/GgY85NlgRZga+DyOmn4thi*VuTCCWMLeu1fNUiIXEvIDRwNaGpsvE8oJuK4rGT1/GgY85NjUW0YbGT1/Gge8+tpJHMcKWYTfRaYMqtpJHMcIWNmeBZ9J9srX5JI0dwXCBN89nBr4PI6YTziIqfnJwoJ//Mw6Qoxw0vg8jpp//Mw6Q*zYgljC3rtX7dZGT*zYglj*XvMFPC0WHxLy*0cDWhsZPX8aB7z62kkcWBpMaCW0GRzHClmE3me/iPraSRzHClmE38RXndLK1+SRDxUs28RXndLLtxCOm1F5zgTfPZwa+DyOmn/8zDp*DNuBtLvYI1*hTIJYwt67VTRUJk*M2IJYwt67V81SIhcS8gFHfIOfV81SIhcRqwZKH5LvGT1/Gge8+tpJHMcKWYTfxFfcK/iVhZLQe53SytfmkJ61hN/EV53SytfkkjR3BcIE3z0eaUvYkjR3Bc*HNPzaQYQUjpp//Mw6Q*zYgljC3rtXzV*yV9Nhu*QJRiIXEvIBxprqu1fNUiIXEvIDRwNaGxk9fxpkOBozRwNaGxq8i8hXLy7GSRzHClmE38RXndLK1+SSNHaC0jbjJEzEewXCBN88PGLH5JI0dwXCBN89nBr4PI6af//H36cBnBr4PIx6T9FTH5*M2IJYwt67V81SIhcS8gNH*lp71gLnEruPWhsZPX8brrb+*0cDWhsZPX8aB7z62kkcxQmbylcaB7z62ki12jV2+KPEV53SytfkkjR3BcIE3z2cGjs1sVj*+JQm+DyOmn3/U3zfPZwa+DyOmn/8zDp*DNiCWE*tNjf8zDp*Dtv/Fw*aS3PNUiIXEvIDRwNaGxk9fxoHvsoeDmx8y0eE+qgzB1yE3FoV6bo40mlUuNJtNTtyEV8EIiLhsqzoMWkSiNHRnBmqLJo0dwXCBN89nBr4PI6af/zMOdy6+OKy4oK4ljSJ+LFzoOaEmNZMNjpczRd5UohUjGJrGLupw*W5MIJYwt67V81SIhcS8gNH*1oamy8QU624reSg0N5psOlsb3*X9D7VNX354EvQNUp/+y7kf7t3ExPx3iTC3rtXzVIiFxLy*OJh34/BiyDtpWQUwenpfpinB+f72RXhlW7yauaDjb3GY41Ksc6QSsNYtio1LTjSEDbSWpG/ZOBdjaF7JPU7a5QyBNIEFc3OBN89nBr4PI6afG2aB4BI*JpXLHMZr0KRzQLEj3L0bRt8nCGbmTvRsV*iZrjmPTN4XTp+WWSDkD+GSnWtZYKZ0hy+KyPvIKqjuZxlYlkFuNb3vusREfU4JnX+h68RL2f4zvZ4B+M5e/Fx6jiCi0GE38RXndLK1+TxXljNoR2msBJtpyDhHX4llidzJ5s+0T*14/d8+S6ipSbO*8v0qBZwDwEK17QwTRdqS9KcL4PQfrPPMNuyc+6psFT1atM/liQiaaZQN6zqk0dTMPO13RX71cvfoxo34+b1H7d6VBClPMxapN2j7pDYuPm8P0ENGvyfUXhoHlivWFQJdxwhqfqf3D5HWT0o41Tm6jwiz+Z9PFo6Ui/kkFbDGBfzq92Jy408/+QO2XWpycEjc81SIhcS8gCSVMXHHsGc1FwkY2mSLwEzLv4Elnp+L9gJBcIR7XrRr47kYeyNatIV5LpDg9/Wgx/3Uypfr3ghmlY3KJWurOsFClhUbmVVzB4P2LZ9dDjVQPmefwegoeW*pVgRDp80*JpUbX67NOXXaLETQhEd+tdKpC8uUyPJyz9xODkr1qatWz1V6PKeCEis2QYgvpVQrJFJGtGBS+KpblgJlZ4S6YozzDcpFK84PTtWZ2SjM4QF8RZLJWGiipMdro6D3ZfDnn27Zr*J6UJK9VUW03aoOO0CN/+kvBTWvntXo5Ucg9r12Lx4Q1pG4ua7V81SIhcS8gJgxN5gidqMy1o4UPCZEgMsnBfF05p/nvyyRwRBJtZpm5s0KlhWCZ2+T2D3Fl00GCvVP0Ix+pYmELJXNh2qmdOYeYtEg5pUng1Fw9416JF4J+1ybl0qI*G8JXsXCqL3SywwNCp1BTgpq9SSS7VkBxV104YQ4dht3Tki3/74M8tZQLib88CEsHorIp1liavgfyopWHk4dvkRMBPx1RIul5Bh3GPeW0aUcdwsqDy+5jTIS+I+sC*dwpjapQnpmt897qC06d*UF+s/Z3pWFsjX8NWvuTa+jxd9bBZkRCzFDiSaY*x0fk5Sjp3oewXCBN89nBr6fP40pjMsHYHLUxuyuog5PsXWHlMwIqoxVLYQ+4Kq3I8apmjaPV9aUDErFV14lqf6CJ*9h1egXoUIOkbs3KXpN9gi8C+U0Go3D6UGFHp/XWHEv2OKNCJcp4PehWHEodJLLQN5QxiWkdWLwxFRh0e*CSrhKSY03pV1gloCPLh+S6cwJHJ4RHG98HdC4BfT1hIJ6yFUMkOnL9NlP92/fDpSwH0e2dP35/pMJWGoGXhVFL/Gv16Y+HSzQJjLjtG/+io+9m+r5pR22dM0HDtVDM565yVXn9zj/bPk9Nix3LjJ3hX6bQTfKMrnrh7kSei44P0LRNW0Gq7+*0cDWhsZPX6YpwcChFndavsFH7sDUNBbejBFSFR3ZGGrNHRvV8SBXOT1GX*KrBX3M9eg2ZsZaPKOxyx3ZcrPjsg04J7WrIK5Zr5cYZmqlTJaDrTKG+I87*603H+eDbFWbaoHxwI05N61ugCQEVrRZUX5rztwxBrJGZG/gQrjTLbErTDa4s++SiwYqiTScn8FmlfbuIfEt2p5jZve/XgHINroiGn1RgjDnfxdkmGbIGoMIN8+l*5*7Sjpvpo7PgG2uYGSTixZMiymmpkRGtO2ap+1BBnWK3Z82mb6+tonruJdnZCMD+oq9sq1TH/HvSUkSd08*S3OPbBKqzutl59yKIRzuRvrQkUUivtJ1GU0oMbFnfl/Gge8+tpJHMSskz3liUEQ4fn0WTN/Quy3MZ5KaYaB1sq1XqiXVcB0tMoPmSrcGBWv7lcZG423Y2y4sT7y3tGXdLC*aIkorn3PGvUcaYt4NO20T9oDReO2kb3av1z0z9GppeqM785OPxwdsSja8wa+yrPN4q5yvP*gFvvesFo4lu8gnKzQpEYEHpIKRa5sIHEhnbMSqW/FzID+MU7fBTNu3h6B1p1mxhVKCjI+xFzkIkuThbC3oQyt2HWjfFiovqBE7ro0qlmBhjHXh*v+252U6h7*Rl*7NN71SRpYpLCtD/tduPPKPHNLY52r55QmWklNm6WvLtvbo0*cfKLd3HZJFXsHM+U1voGE77SM1w5oOk15oni/+*xLPDv2DqWTy6LUQ3jVzgTfPZwa+DyO2z8Cawxe8PX/VbZi8ce0dGw5IjKFh4FistiQBYLWdKMY67DY3Ssb6sBaopUZfzh72FHm7DnIYO*p0Rv/ZET5Xip1lqaXT9ZefiC+kfj25vGeTxws4x2mih53lSNuoSv1vYQvay76FyyzilXjnU5U9ZHv6th/d7krLkQk*wgxNjZtEMSO2RY331mkLWSdh3YPE+vaQTSd*3MWjT*+FWgsNbeYKW1tJxl+mxJdeFt5Lhn1gJEaxWHc+upsMXIDr+FZ6cYHLY5axdzeOd/ITj/rBWs+cCrO73gYjSo8Zwni9ywQJPcew5k2WrHwus2EdW6znJHTkEed+vl0ptMv3FHG3rtXzVIiFxLy*uGO3xqzHMr0/+Zx0oYV0jo+CO5Vhik/kusRkzRN2bNEspM4LgwltHCwbJlaiP0iPtH06x0jL5Jwbfz2PZSadb*kqW8iqJyYGHgnqUbV+B+6PTX+DKE/XsRnlbHnRahjfDEq05i4gwR/+ordopPsvPn0zYbODUaqRk3Q/LJwPNpkvddX/*PKglWCk+O5Xwao/uTozRwJwSlzw*BI5rRDsMS*Dd7ol/uQntR1Wdnih8gvK1iaXuuiyByTa/SSP0yNwBgJBGj9CKg3zy9HESdyLZLbLwf8IUBZQsy1rbLncR5YBP*9E1n4+Hl3GQCN2P*fEm4JfbFu*/E+dpXlGCzzPsB*XB0kzpiVSIpOz9LdXjYotdRcL2Dp4O61OVrNBs+NGEfpyJdY2Xdpi7wv21fizSuoMUgNU6/beeoiagVjdDlh8+hR4aJ8/Q4WoxS9hgF5rcO0h6+yajgfTBzEgljC3rtXzVIi5bjF2c+pIe8qGJSVOYPUL6NS*hNdMI+gOH9C9CvfmxkRO32/WppmBssEZHHm1WrKIJgtCxPfyXzFoGphlQbxbyY2Qz64w*Gsn3EwHUf79tKJRG5hPIheYg0JScE+oPt1t188eXusQDESMn+ytRQoPh8MYmHd2DPnzCpauoL4*gxI*HSV9DrXVq5M*JSv0rKB917ftDtZjkKqie/lNVEDED4/yjFBmdve2FP*DJC*gZ*0aeILLhzwFJkjDl56IMIRfJSqp2MPlzgQ00YcnpoyyKR6lakYSK5Q2R7+O89QiH0fG75V62x3/+FBCOS/tCk0NCY0hRsgrp2vxO4dK7BeBq9JUd8iWl0PFXuVXXI3RJJPJKma96sj60IcqQe7uRJpiOjqWq70ErJ0rjgDlzgqWFf4rDi6FOHYFK3+3/Ogu6y2dUV5pebgLExvWBvK7eLJEI17innb1ayN0MBLtzgJWFRyL5hQE/JNRjEoX3/WXnnfP7Tx+gaLseikMmKghBtducbTs3cVwgTfPZwa+DyO2y8C86aBi+uZbIMndpTbnCYsZ227LWqsHpkZUCmZGlV5+3IVy1Qe7r0gGQHBnzrxPyJJIWOFxdvOXF5yafFk2WzaOsUGV/7vinLeyx6ngZgBnT6kY+jtbmqSC*eWcx/2bYthg2rruC*KTR8*hh9cLVL+7Y7duj0Z*R4DodPerdXNPgWMTdgTma4XICmLxn7Lej1UhHonBDI6lVwOvhdplyt1DkUdjtWhnlc0Ma*GHZcZa5TzvEQyMg+*+W7F9Xjv1jd8FD89Qnijhg6QHaiJP3fUuHMQCC+Te6uD3ohuvjoyTxQycjDh49ejLD1CWqM5CF8VS9hWsjON7pPn4Vp*iSrGELMcL3VW3YU+s51GE/UHPD2rjkc4Q5ZMvSJGLg7sP0feCbIRpam8S71Pim8BpHkflwVwfHoI+JO5i0Chs*CrZougB9Xo36pIy7WMpce5udtoYmlfGVcaIxkGIqlYsFmuC8kOhgSS1iZ+YFiFfFECgjiWOpRZVRPCIUXBQ6DzBPi/ckgH85kEEry8ROfyIwND4SIouhRxitPI*JR7TStTxIOt6Sm+StrMxliw97s92lsB7/2Wjto/YW5uqCS5/jEe*co2gxMxeLsfPvwu413mEnTk+SPKQ*jzGnM0XMkDfsjY+ISn*qKUt2tby9e*di1dSlEq5Ul7ty3CaQXu+SMlLiyUaj6IckmT6JnbQG99iueEVi/w5O0dmDjStsjC3rtXzVIiFxMyylYIkbIHrK+SEDOghPPr3dz6HXxa/O/yOy/qeHspC5OH7Tp/X1cLXmZVCL8TBdtbknWCE7L93Dbn/G99bqaZUd8uPrLaqgkB3J2b250OSP13JZ1uhkufxdzQ9pFGZN46deDTw*xyiEGJO1cDn9o/0vnWWdryd1nbdisSv75RCO42NTcknqqekbJUq48f5165PQLXtfEusOjnRTmKUl8RYsWWqh9QlbnazTBI1wJ3wvZFPHsZj6kRco1XcUH4HEQh6YQuiE0UXk4xj1w2USTdvro0rZtoE93Cz6Wj6ZThk0o3RT8WbYjZ*P7mkpyFmGkM5kEzTprNnvFckxDViTlcrZfOudorkDtCv8ORM0a0d268hsHcP5onZSiqz1hgE/pXGPEmL22WS63rt5GOM+fqv*f7n/yPdfq9NVqS2QNbQ1yNXq6nail+9+5XJoJN6jvcdUx3Ie2bR*UPFFf+5jxTPwHhfwEZ3EoxIo+ZWBQX6ldZ9CzI*ig2LPnTDoE8FK89HNsI1y1nBPKy0KZwmk3KFR+Zfh2Zv2Xaugixxek6Dgjz3fBcvHYhsLGah2x5YJIabhnL8Nae6*RbXRVSsik+YzQ08r3WSumF0Q7izvmvENQcG/Ly*0cDWhsavgvC1Hkw3WYFGN7S+EXfirEcMgUbIQT9RbqodNnDgM0KxKmbawoK4+Qt6t0ezTNkSNXQqxaVR4N1FFj71CsDcU8fFxc8XmuP6gSR3L9bq7XdKaosZ7Up/0/egV+kIl+ifmubvoGoUxrKqf76BR4TVyxa2xcL4zkSvWYwJ/USaWp06SpLTOEb2Hkv*ZmvTJrTDE41Zyzxx0CVWocgLdqVRa9Zzl9JT4Nh+FCOd0XEKGH0TwmsvcWbbfNItM//04hs89y+FFbNWqlOW5lSwZ2Y/a4hMNyw3SpwHOeU1ygiaN4g2CFu+B4rFQhyv5bXPNOKlgS2q5mg2dj2cnVX/EguH4TsFMl/FoZ/5e7fXW0OvnoL9T1OExpe2hXmYW0iD7Y1rL5Iszy+hV/72QJCpQu+*RxpyDQkNUObXFx1utNKRe4/*zZWFLBZLdHvvm2jU2u7xLk52afZchp1FDmoSjIISQP/WkYXOnISgg175b4a2+Q50Q9XWuS2diUQjaW+Uup2+TNRQDsxf1Q0skgpH*8S7S47GhZdrwdOlXZ7vxw2kCcfM0YxMr2Z9oL6yg/Xy/Yun8I0sdKd5RBxW+ogfusVhvPaY1jDOeNen6pEqEbK//CRg*MktZwIKZsTky5Ykj7k7r*QkG*zg2YfL+9ZBov3gJIGvE05Gx7YjKCCWMLeu1fOMxYE/Z/aVaiyyjeMUETetZM9ngLdFlc0IGTYN4932VUZsH*sqslFUHNxpfz7StLt6jKN+2PUWWixe7c8swGnJQxal246C*94DQHJIJ0gRHc821TPb4Y6UjBaUgChZJyy20Zu/MLn/kycdHUlOm4PdCwp3UOFj7Y4IpCFt+5UT/cq4j/1UYkRSmHrF7Wo4llCEgeDKkuzxQRa+tcI**J2CZPeax9u91Mrud9Y+ByPFbUshmw6F9/bWTyZ0vT+FjafWuqWOMKITLR/htYDkFtsUPPWll5SGa+YM/Xdh5dhwawaULi*x0Jw68N2Mz4sGtvZM7/0rJ0TNDoPyFpbe*4Q7oj4NGiO+uaQBX7WwCEPdeagzVjbIWy++SflByyUWQw*UB1TyDHRkZ+REESXE4ng42oL*xlKnt9nnS4vLXP7cl2tBRLB*YVGnipj*RgOZZki9dufcKWeEVz+GgKsQgXR0Z1s1iFjvvELERt8BppZq

Signatures

Contains code to disable Windows Defender 2 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
behavioral1/memory/112-63-0x0000000001060000-0x0000000002B38000-memory.dmp	disable_win_def
behavioral1/memory/112-64-0x0000000001060000-0x0000000002B38000-memory.dmp	disable_win_def

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
ransomware ryuk
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Executes dropped EXE 1 IoCs

Processes:

dllhost.exe

pid process

112 dllhost.exe

pid	process
112	dllhost.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

dllhost.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	dllhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	dllhost.exe

Loads dropped DLL 1 IoCs

Processes:

KD.exe

pid process

1584 KD.exe

pid	process
1584	KD.exe

Themida packer 4 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\dllhost.exe	themida
\Users\Admin\AppData\Roaming\dllhost.exe	themida
behavioral1/memory/112-63-0x0000000001060000-0x0000000002B38000-memory.dmp	themida
behavioral1/memory/112-64-0x0000000001060000-0x0000000002B38000-memory.dmp	themida

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

dllhost.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	dllhost.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

dllhost.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA dllhost.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

dllhost.exe

pid process

112 dllhost.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1100 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

KD.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1584 KD.exe
Token: SeDebugPrivilege 1100 powershell.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe

pid	process
112	dllhost.exe

pid	process
1100	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1584	KD.exe
Token: SeDebugPrivilege	1100	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

KD.exedllhost.exe

description	pid	process	target process
PID 1584 wrote to memory of 112	1584	KD.exe	dllhost.exe
PID 1584 wrote to memory of 112	1584	KD.exe	dllhost.exe
PID 1584 wrote to memory of 112	1584	KD.exe	dllhost.exe
PID 1584 wrote to memory of 112	1584	KD.exe	dllhost.exe
PID 112 wrote to memory of 1100	112	dllhost.exe	powershell.exe
PID 112 wrote to memory of 1100	112	dllhost.exe	powershell.exe
PID 112 wrote to memory of 1100	112	dllhost.exe	powershell.exe
PID 112 wrote to memory of 1100	112	dllhost.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\KD.exe
"C:\Users\Admin\AppData\Local\Temp\KD.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1584

C:\Users\Admin\AppData\Roaming\dllhost.exe
"C:\Users\Admin\AppData\Roaming\dllhost.exe"
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:112

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" Get-MpPreference -verbose
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1100

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Disabling Security Tools

2

T1089

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

Virtualization/Sandbox Evasion

1

T1497

System Information Discovery

3

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\dllhost.exe
MD5
c89cc2bc9f5d03991470bb955d0af7b9

SHA1
ff49a64cb8f60ea2cfccdc630ab9bc6452d7f6dd

SHA256
271fd20da630104079b1de33b726d33abc01de725958922efcde1d11f730b4a3

SHA512
49d0bd8e6f415c1c5a101c4ee6b2cfdf99c4887e7009e525cf3d5d1169b4bbd824eb53f348d6b85d6a8b1ceef936179b8760197b5bc48eb5943d7338ba567656

Download Submit
\Users\Admin\AppData\Roaming\dllhost.exe
MD5
c89cc2bc9f5d03991470bb955d0af7b9

SHA1
ff49a64cb8f60ea2cfccdc630ab9bc6452d7f6dd

SHA256
271fd20da630104079b1de33b726d33abc01de725958922efcde1d11f730b4a3

SHA512
49d0bd8e6f415c1c5a101c4ee6b2cfdf99c4887e7009e525cf3d5d1169b4bbd824eb53f348d6b85d6a8b1ceef936179b8760197b5bc48eb5943d7338ba567656

Download Submit
memory/112-63-0x0000000001060000-0x0000000002B38000-memory.dmp

Filesize
26.8MB

Download
memory/112-64-0x0000000001060000-0x0000000002B38000-memory.dmp

Filesize
26.8MB

Download
memory/1100-66-0x0000000001CF0000-0x0000000001CF1000-memory.dmp

Filesize
4KB

Download
memory/1100-67-0x0000000001CF1000-0x0000000001CF2000-memory.dmp

Filesize
4KB

Download
memory/1100-68-0x0000000001CF2000-0x0000000001CF4000-memory.dmp

Filesize
8KB

Download
memory/1584-55-0x0000000000220000-0x0000000000228000-memory.dmp

Filesize
32KB

Download
memory/1584-56-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download
memory/1584-57-0x00000000021B0000-0x0000000004290000-memory.dmp

Filesize
32.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads