Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
20-01-2022 09:11
Static task
static1
Behavioral task
behavioral1
Sample
KD.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
KD.exe
Resource
win10v2004-en-20220113
General
-
Target
KD.exe
-
Size
7KB
-
MD5
ad309c9d2e62a1ceb52cdb76833bb9ff
-
SHA1
f93694b6d153c6a50950f1df29c36fbbae5d1931
-
SHA256
34e4e0f587ea3cbbd417710ec5b90de335dca96f6773fdd4ffb31b97b8913f8d
-
SHA512
addb8b06e6c0791f72b39183cfa850b2553730b60242a38775acc65f6c88e44f431ec3eaadb9bb3c506e639b391f74391890ae6a27c4a2f4e7c3da336b9954a4
Malware Config
Extracted
C:\Users\Admin\AppData\Roaming\dllhost.txt
ryuk
Signatures
-
Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral1/memory/112-63-0x0000000001060000-0x0000000002B38000-memory.dmp disable_win_def behavioral1/memory/112-64-0x0000000001060000-0x0000000002B38000-memory.dmp disable_win_def -
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Executes dropped EXE 1 IoCs
pid Process 112 dllhost.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion dllhost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion dllhost.exe -
Loads dropped DLL 1 IoCs
pid Process 1584 KD.exe -
resource yara_rule behavioral1/files/0x00080000000121f7-59.dat themida behavioral1/files/0x00080000000121f7-58.dat themida behavioral1/memory/112-63-0x0000000001060000-0x0000000002B38000-memory.dmp themida behavioral1/memory/112-64-0x0000000001060000-0x0000000002B38000-memory.dmp themida -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features dllhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" dllhost.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA dllhost.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 112 dllhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1100 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1584 KD.exe Token: SeDebugPrivilege 1100 powershell.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1584 wrote to memory of 112 1584 KD.exe 27 PID 1584 wrote to memory of 112 1584 KD.exe 27 PID 1584 wrote to memory of 112 1584 KD.exe 27 PID 1584 wrote to memory of 112 1584 KD.exe 27 PID 112 wrote to memory of 1100 112 dllhost.exe 28 PID 112 wrote to memory of 1100 112 dllhost.exe 28 PID 112 wrote to memory of 1100 112 dllhost.exe 28 PID 112 wrote to memory of 1100 112 dllhost.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\KD.exe"C:\Users\Admin\AppData\Local\Temp\KD.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Users\Admin\AppData\Roaming\dllhost.exe"C:\Users\Admin\AppData\Roaming\dllhost.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:112 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1100
-
-