44fb7c7bf17a578aecd2cedcd19909ff1430f0dfde901e64389972291bd2b7d7

General

Target

44fb7c7bf17a578aecd2cedcd19909ff1430f0dfde901e64389972291bd2b7d7.exe
Size

252KB
MD5

3658efb3751becc47a57ef543a3d80b0
SHA1

41af972ef1392ab78c8ec855ee73d7465601a31a
SHA256

44fb7c7bf17a578aecd2cedcd19909ff1430f0dfde901e64389972291bd2b7d7
SHA512

dcc9ee4c7abf780001f3310163480d5fcdd0bc57ca0301651fddd52f5143e554702c3cb739a15bfeda009328174b67514ded0e555c6e036e38d5c07bf58c822e
SSDEEP

3072:grAcHx7LaXusNvZ0OgRqTAJcLGGO/xuiEyJeOOeGs5oxnkNzQKtjby:grCuCx/ZLA4PmG6de

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

44fb7c7bf17a578aecd2cedcd19909ff1430f0dfde901e64389972291bd2b7d7.exeriuato.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	44fb7c7bf17a578aecd2cedcd19909ff1430f0dfde901e64389972291bd2b7d7.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	riuato.exe

Executes dropped EXE 1 IoCs

Processes:

riuato.exe

pid process

4288 riuato.exe

pid	process
4288	riuato.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

44fb7c7bf17a578aecd2cedcd19909ff1430f0dfde901e64389972291bd2b7d7.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	44fb7c7bf17a578aecd2cedcd19909ff1430f0dfde901e64389972291bd2b7d7.exe

Adds Run key to start application 2 TTPs 55 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

riuato.exe44fb7c7bf17a578aecd2cedcd19909ff1430f0dfde901e64389972291bd2b7d7.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riuato = "C:\\Users\\Admin\\riuato.exe /o"	riuato.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riuato = "C:\\Users\\Admin\\riuato.exe /j"	riuato.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riuato = "C:\\Users\\Admin\\riuato.exe /W"	riuato.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riuato = "C:\\Users\\Admin\\riuato.exe /G"	riuato.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riuato = "C:\\Users\\Admin\\riuato.exe /d"	riuato.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riuato = "C:\\Users\\Admin\\riuato.exe /i"	riuato.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riuato = "C:\\Users\\Admin\\riuato.exe /A"	riuato.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riuato = "C:\\Users\\Admin\\riuato.exe /V"	riuato.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riuato = "C:\\Users\\Admin\\riuato.exe /m"	riuato.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riuato = "C:\\Users\\Admin\\riuato.exe /f"	riuato.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riuato = "C:\\Users\\Admin\\riuato.exe /w"	44fb7c7bf17a578aecd2cedcd19909ff1430f0dfde901e64389972291bd2b7d7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riuato = "C:\\Users\\Admin\\riuato.exe /c"	riuato.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riuato = "C:\\Users\\Admin\\riuato.exe /M"	riuato.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riuato = "C:\\Users\\Admin\\riuato.exe /T"	riuato.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riuato = "C:\\Users\\Admin\\riuato.exe /O"	riuato.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riuato = "C:\\Users\\Admin\\riuato.exe /v"	riuato.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riuato = "C:\\Users\\Admin\\riuato.exe /C"	riuato.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riuato = "C:\\Users\\Admin\\riuato.exe /l"	riuato.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riuato = "C:\\Users\\Admin\\riuato.exe /z"	riuato.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riuato = "C:\\Users\\Admin\\riuato.exe /Z"	riuato.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riuato = "C:\\Users\\Admin\\riuato.exe /B"	riuato.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riuato = "C:\\Users\\Admin\\riuato.exe /n"	riuato.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riuato = "C:\\Users\\Admin\\riuato.exe /a"	riuato.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riuato = "C:\\Users\\Admin\\riuato.exe /u"	riuato.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riuato = "C:\\Users\\Admin\\riuato.exe /N"	riuato.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riuato = "C:\\Users\\Admin\\riuato.exe /w"	riuato.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riuato = "C:\\Users\\Admin\\riuato.exe /b"	riuato.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run\	riuato.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riuato = "C:\\Users\\Admin\\riuato.exe /I"	riuato.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riuato = "C:\\Users\\Admin\\riuato.exe /h"	riuato.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riuato = "C:\\Users\\Admin\\riuato.exe /s"	riuato.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riuato = "C:\\Users\\Admin\\riuato.exe /r"	riuato.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riuato = "C:\\Users\\Admin\\riuato.exe /U"	riuato.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run\	44fb7c7bf17a578aecd2cedcd19909ff1430f0dfde901e64389972291bd2b7d7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riuato = "C:\\Users\\Admin\\riuato.exe /y"	riuato.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riuato = "C:\\Users\\Admin\\riuato.exe /F"	riuato.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riuato = "C:\\Users\\Admin\\riuato.exe /k"	riuato.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riuato = "C:\\Users\\Admin\\riuato.exe /P"	riuato.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riuato = "C:\\Users\\Admin\\riuato.exe /e"	riuato.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riuato = "C:\\Users\\Admin\\riuato.exe /J"	riuato.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riuato = "C:\\Users\\Admin\\riuato.exe /t"	riuato.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riuato = "C:\\Users\\Admin\\riuato.exe /x"	riuato.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riuato = "C:\\Users\\Admin\\riuato.exe /D"	riuato.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riuato = "C:\\Users\\Admin\\riuato.exe /L"	riuato.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riuato = "C:\\Users\\Admin\\riuato.exe /K"	riuato.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riuato = "C:\\Users\\Admin\\riuato.exe /Q"	riuato.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riuato = "C:\\Users\\Admin\\riuato.exe /E"	riuato.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riuato = "C:\\Users\\Admin\\riuato.exe /H"	riuato.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riuato = "C:\\Users\\Admin\\riuato.exe /q"	riuato.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riuato = "C:\\Users\\Admin\\riuato.exe /g"	riuato.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riuato = "C:\\Users\\Admin\\riuato.exe /p"	riuato.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riuato = "C:\\Users\\Admin\\riuato.exe /S"	riuato.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riuato = "C:\\Users\\Admin\\riuato.exe /X"	riuato.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riuato = "C:\\Users\\Admin\\riuato.exe /Y"	riuato.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riuato = "C:\\Users\\Admin\\riuato.exe /R"	riuato.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

44fb7c7bf17a578aecd2cedcd19909ff1430f0dfde901e64389972291bd2b7d7.exeriuato.exe

pid	process
2768	44fb7c7bf17a578aecd2cedcd19909ff1430f0dfde901e64389972291bd2b7d7.exe
2768	44fb7c7bf17a578aecd2cedcd19909ff1430f0dfde901e64389972291bd2b7d7.exe
4288	riuato.exe
4288	riuato.exe
4288	riuato.exe
4288	riuato.exe
4288	riuato.exe
4288	riuato.exe
4288	riuato.exe
4288	riuato.exe
4288	riuato.exe
4288	riuato.exe
4288	riuato.exe
4288	riuato.exe
4288	riuato.exe
4288	riuato.exe
4288	riuato.exe
4288	riuato.exe
4288	riuato.exe
4288	riuato.exe
4288	riuato.exe
4288	riuato.exe
4288	riuato.exe
4288	riuato.exe
4288	riuato.exe
4288	riuato.exe
4288	riuato.exe
4288	riuato.exe
4288	riuato.exe
4288	riuato.exe
4288	riuato.exe
4288	riuato.exe
4288	riuato.exe
4288	riuato.exe
4288	riuato.exe
4288	riuato.exe
4288	riuato.exe
4288	riuato.exe
4288	riuato.exe
4288	riuato.exe
4288	riuato.exe
4288	riuato.exe
4288	riuato.exe
4288	riuato.exe
4288	riuato.exe
4288	riuato.exe
4288	riuato.exe
4288	riuato.exe
4288	riuato.exe
4288	riuato.exe
4288	riuato.exe
4288	riuato.exe
4288	riuato.exe
4288	riuato.exe
4288	riuato.exe
4288	riuato.exe
4288	riuato.exe
4288	riuato.exe
4288	riuato.exe
4288	riuato.exe
4288	riuato.exe
4288	riuato.exe
4288	riuato.exe
4288	riuato.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

44fb7c7bf17a578aecd2cedcd19909ff1430f0dfde901e64389972291bd2b7d7.exeriuato.exe

pid process

2768 44fb7c7bf17a578aecd2cedcd19909ff1430f0dfde901e64389972291bd2b7d7.exe
4288 riuato.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

44fb7c7bf17a578aecd2cedcd19909ff1430f0dfde901e64389972291bd2b7d7.exe

description	pid	process	target process
PID 2768 wrote to memory of 4288	2768	44fb7c7bf17a578aecd2cedcd19909ff1430f0dfde901e64389972291bd2b7d7.exe	riuato.exe
PID 2768 wrote to memory of 4288	2768	44fb7c7bf17a578aecd2cedcd19909ff1430f0dfde901e64389972291bd2b7d7.exe	riuato.exe
PID 2768 wrote to memory of 4288	2768	44fb7c7bf17a578aecd2cedcd19909ff1430f0dfde901e64389972291bd2b7d7.exe	riuato.exe

C:\Users\Admin\AppData\Local\Temp\44fb7c7bf17a578aecd2cedcd19909ff1430f0dfde901e64389972291bd2b7d7.exe
"C:\Users\Admin\AppData\Local\Temp\44fb7c7bf17a578aecd2cedcd19909ff1430f0dfde901e64389972291bd2b7d7.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2768

C:\Users\Admin\riuato.exe
"C:\Users\Admin\riuato.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4288

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

1

T1158

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\riuato.exe
Filesize
252KB

MD5
c2f5b43f34d0c34bb1eb04c9051ec203

SHA1
5ba7279458c455df82bc6706bf87fd92f4748345

SHA256
46dbcd49a5c8b966cdfc90c3abf725515a85624ef3c23b8cdadd0a4e7d7953e5

SHA512
dd3d763d6385566faf31a4ce0d3b06a101c7c65bf63106718d03c7c12b90390271e2ddaf2fceb53ea556a72697da2008425451a822d45dedecede52ec0b4f157

Download Submit
C:\Users\Admin\riuato.exe
Filesize
252KB

MD5
c2f5b43f34d0c34bb1eb04c9051ec203

SHA1
5ba7279458c455df82bc6706bf87fd92f4748345

SHA256
46dbcd49a5c8b966cdfc90c3abf725515a85624ef3c23b8cdadd0a4e7d7953e5

SHA512
dd3d763d6385566faf31a4ce0d3b06a101c7c65bf63106718d03c7c12b90390271e2ddaf2fceb53ea556a72697da2008425451a822d45dedecede52ec0b4f157

Download Submit
memory/4288-134-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads