ryuk | 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6

General

Target

0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
Size

219KB
MD5

c4d162f04eb0464adc841390f42431ed
SHA1

a25bcbafb2b70ab2b214a7fe0446abee02602045
SHA256

0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6
SHA512

07fd20fa8f27e2d236333dbec7bf4318000207f321544944d9f4c83a808b475d7904ad411f94cb8c1407c95ea0a49a72c784991ef7b4a158c5554e87e07a91af

Score

10^/10

ryuk ransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html

Family

ryuk

Ransom Note

<html><body><p style="font-weight:bold;font-size:125%;top:0;left:0;"> [email protected] <br> </p><p style="position:absolute;bottom:0;right:1%;font-weight:bold;font-size:170%">balance of shadow universe</p><div style="font-size: 550%;font-weight:bold;width:50%;height:50%;overflow:auto;margin:auto;position:absolute;top:35%;left:40%;">Ryuk</div></body></html��

Emails

[email protected]

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html

Family

ryuk

Ransom Note

[email protected] balance of shadow universe Ryuk

Emails

[email protected]

Signatures

Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
ransomware ryuk
Executes dropped EXE 1 IoCs

Processes:

FOABCWP.exe

pid process

1392 FOABCWP.exe

pid	process
1392	FOABCWP.exe

Loads dropped DLL 2 IoCs

Processes:

0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe

pid	process
788	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
788	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

Processes:

0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exeFOABCWP.exe

pid	process
788	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
1392	FOABCWP.exe
788	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
788	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
1392	FOABCWP.exe
788	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
788	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
788	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
788	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
788	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
788	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
788	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
788	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
788	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
788	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
788	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
788	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
788	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
1392	FOABCWP.exe
1392	FOABCWP.exe
1392	FOABCWP.exe
1392	FOABCWP.exe
1392	FOABCWP.exe
1392	FOABCWP.exe
1392	FOABCWP.exe
1392	FOABCWP.exe
1392	FOABCWP.exe
1392	FOABCWP.exe
1392	FOABCWP.exe
1392	FOABCWP.exe
788	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
788	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
788	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
788	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
788	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
788	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
788	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
788	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
788	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
788	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
788	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
788	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exeFOABCWP.exe

description	pid	process
Token: SeBackupPrivilege	788	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
Token: SeBackupPrivilege	1392	FOABCWP.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exeFOABCWP.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 788 wrote to memory of 1392	788	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	FOABCWP.exe
PID 788 wrote to memory of 1392	788	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	FOABCWP.exe
PID 788 wrote to memory of 1392	788	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	FOABCWP.exe
PID 788 wrote to memory of 1392	788	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	FOABCWP.exe
PID 1392 wrote to memory of 2072	1392	FOABCWP.exe	net.exe
PID 1392 wrote to memory of 2072	1392	FOABCWP.exe	net.exe
PID 1392 wrote to memory of 2072	1392	FOABCWP.exe	net.exe
PID 1392 wrote to memory of 2072	1392	FOABCWP.exe	net.exe
PID 788 wrote to memory of 2080	788	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	net.exe
PID 788 wrote to memory of 2080	788	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	net.exe
PID 788 wrote to memory of 2080	788	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	net.exe
PID 788 wrote to memory of 2080	788	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	net.exe
PID 788 wrote to memory of 2144	788	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	net.exe
PID 788 wrote to memory of 2144	788	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	net.exe
PID 788 wrote to memory of 2144	788	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	net.exe
PID 788 wrote to memory of 2144	788	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	net.exe
PID 1392 wrote to memory of 2184	1392	FOABCWP.exe	net.exe
PID 1392 wrote to memory of 2184	1392	FOABCWP.exe	net.exe
PID 1392 wrote to memory of 2184	1392	FOABCWP.exe	net.exe
PID 1392 wrote to memory of 2184	1392	FOABCWP.exe	net.exe
PID 788 wrote to memory of 2196	788	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	net.exe
PID 788 wrote to memory of 2196	788	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	net.exe
PID 788 wrote to memory of 2196	788	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	net.exe
PID 788 wrote to memory of 2196	788	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	net.exe
PID 788 wrote to memory of 2264	788	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	net.exe
PID 788 wrote to memory of 2264	788	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	net.exe
PID 788 wrote to memory of 2264	788	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	net.exe
PID 788 wrote to memory of 2264	788	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	net.exe
PID 2072 wrote to memory of 2388	2072	net.exe	net1.exe
PID 2072 wrote to memory of 2388	2072	net.exe	net1.exe
PID 2072 wrote to memory of 2388	2072	net.exe	net1.exe
PID 2072 wrote to memory of 2388	2072	net.exe	net1.exe
PID 2264 wrote to memory of 2404	2264	net.exe	net1.exe
PID 2264 wrote to memory of 2404	2264	net.exe	net1.exe
PID 2264 wrote to memory of 2404	2264	net.exe	net1.exe
PID 2264 wrote to memory of 2404	2264	net.exe	net1.exe
PID 2184 wrote to memory of 2396	2184	net.exe	net1.exe
PID 2184 wrote to memory of 2396	2184	net.exe	net1.exe
PID 2184 wrote to memory of 2396	2184	net.exe	net1.exe
PID 2184 wrote to memory of 2396	2184	net.exe	net1.exe
PID 2080 wrote to memory of 2380	2080	net.exe	net1.exe
PID 2080 wrote to memory of 2380	2080	net.exe	net1.exe
PID 2080 wrote to memory of 2380	2080	net.exe	net1.exe
PID 2080 wrote to memory of 2380	2080	net.exe	net1.exe
PID 2196 wrote to memory of 2372	2196	net.exe	net1.exe
PID 2196 wrote to memory of 2372	2196	net.exe	net1.exe
PID 2196 wrote to memory of 2372	2196	net.exe	net1.exe
PID 2196 wrote to memory of 2372	2196	net.exe	net1.exe
PID 2144 wrote to memory of 2412	2144	net.exe	net1.exe
PID 2144 wrote to memory of 2412	2144	net.exe	net1.exe
PID 2144 wrote to memory of 2412	2144	net.exe	net1.exe
PID 2144 wrote to memory of 2412	2144	net.exe	net1.exe
PID 788 wrote to memory of 36800	788	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	net.exe
PID 788 wrote to memory of 36800	788	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	net.exe
PID 788 wrote to memory of 36800	788	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	net.exe
PID 788 wrote to memory of 36800	788	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	net.exe
PID 1392 wrote to memory of 36808	1392	FOABCWP.exe	net.exe
PID 1392 wrote to memory of 36808	1392	FOABCWP.exe	net.exe
PID 1392 wrote to memory of 36808	1392	FOABCWP.exe	net.exe
PID 1392 wrote to memory of 36808	1392	FOABCWP.exe	net.exe
PID 36800 wrote to memory of 36848	36800	net.exe	net1.exe
PID 36800 wrote to memory of 36848	36800	net.exe	net1.exe
PID 36800 wrote to memory of 36848	36800	net.exe	net1.exe
PID 36800 wrote to memory of 36848	36800	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
"C:\Users\Admin\AppData\Local\Temp\0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:788

C:\Users\Admin\AppData\Local\Temp\FOABCWP.exe
"C:\Users\Admin\AppData\Local\Temp\FOABCWP.exe" 8 LAN
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1392

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
3⤵
- Suspicious use of WriteProcessMemory
PID:2072

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "audioendpointbuilder" /y
4⤵
PID:2388

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "samss" /y
3⤵
- Suspicious use of WriteProcessMemory
PID:2184

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "samss" /y
4⤵
PID:2396

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "samss" /y
3⤵
PID:36808

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "samss" /y
4⤵
PID:36856

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
2⤵
- Suspicious use of WriteProcessMemory
PID:2080

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "audioendpointbuilder" /y
3⤵
PID:2380

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
2⤵
- Suspicious use of WriteProcessMemory
PID:2144

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "audioendpointbuilder" /y
3⤵
PID:2412

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "samss" /y
2⤵
- Suspicious use of WriteProcessMemory
PID:2196

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "samss" /y
3⤵
PID:2372

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "samss" /y
2⤵
- Suspicious use of WriteProcessMemory
PID:2264

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "samss" /y
3⤵
PID:2404

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "samss" /y
2⤵
- Suspicious use of WriteProcessMemory
PID:36800

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "samss" /y
3⤵
PID:36848

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "samss" /y
2⤵
PID:35844

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "samss" /y
3⤵
PID:35868

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "samss" /y
2⤵
PID:53176

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "samss" /y
3⤵
PID:53068

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "samss" /y
2⤵
PID:52744

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "samss" /y
3⤵
PID:52736

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_3bd845b8-ce6a-4337-9974-31490196462a
MD5
93a5aadeec082ffc1bca5aa27af70f52

SHA1
47a92aee3ea4d1c1954ed4da9f86dd79d9277d31

SHA256
a1a21799e98f97f271657ce656076f33dcb020d9370f1f2671d783cafd230294

SHA512
df388c8d83e779e006d6311b2046fcf9259ec33d379fc0e2c6a4b6b90418f587a12c5c23acd488413a02568ca2d3effe04608ec7c791925c7ed53dc71093ca45

Download Submit
C:\Users\Admin\AppData\Local\Temp\FOABCWP.exe
MD5
c4d162f04eb0464adc841390f42431ed

SHA1
a25bcbafb2b70ab2b214a7fe0446abee02602045

SHA256
0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6

SHA512
07fd20fa8f27e2d236333dbec7bf4318000207f321544944d9f4c83a808b475d7904ad411f94cb8c1407c95ea0a49a72c784991ef7b4a158c5554e87e07a91af

Download Submit
C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html
MD5
5c1543434c0c7e2b00f6709fcf8241fd

SHA1
5791c19f4c38eaaf573192c6c39f8a6cc2c43ffe

SHA256
4b59af349b6a429cb5599090fc74cd00dc435ce39f0dfcd3cdbefb116fcace23

SHA512
034f366ab29e06adebbff1db76093b14fdb174aba916f846472d8b9de3a711afbf208863d20d680f8282a3e31d7c494375e4eb5f14f50b1742ea0275af63dc5b

Download Submit
\Users\Admin\AppData\Local\Temp\FOABCWP.exe
MD5
c4d162f04eb0464adc841390f42431ed

SHA1
a25bcbafb2b70ab2b214a7fe0446abee02602045

SHA256
0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6

SHA512
07fd20fa8f27e2d236333dbec7bf4318000207f321544944d9f4c83a808b475d7904ad411f94cb8c1407c95ea0a49a72c784991ef7b4a158c5554e87e07a91af

Download Submit
\Users\Admin\AppData\Local\Temp\FOABCWP.exe
MD5
c4d162f04eb0464adc841390f42431ed

SHA1
a25bcbafb2b70ab2b214a7fe0446abee02602045

SHA256
0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6

SHA512
07fd20fa8f27e2d236333dbec7bf4318000207f321544944d9f4c83a808b475d7904ad411f94cb8c1407c95ea0a49a72c784991ef7b4a158c5554e87e07a91af

Download Submit
memory/788-55-0x0000000076B81000-0x0000000076B83000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads