Overview

overview

10

Static

static

1

URLScan

urlscan

1

http://34.101.154.50

windows10-2004-x64

10

Resubmissions

22-11-2023 01:16

231122-bm924she63 1

05-06-2023 18:52

230605-xja99sag8x 6

01-06-2023 19:18

230601-x1b8wsgd5x 10

01-06-2023 17:57

230601-wjvhgaff56 10

01-06-2023 16:56

230601-vfpx5sfd87 6

01-06-2023 16:38

230601-t5dqqsfc93 10

01-06-2023 16:19

230601-tsv49afc46 10

01-06-2023 16:10

230601-tmev3sfc22 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    http://34.101.154.50

  • Sample

    230601-wjvhgaff56

Score
10/10
redlineryukxmrigdixdizarockerdiscoveryinfostealerminerpersistenceransomware

Malware Config

Extracted

Path

C:\PerfLogs\RyukReadMe.html

Family

ryuk

Ransom Note
izviawirto1982@protonmail.com balance of shadow universe Ryuk
Emails

izviawirto1982@protonmail.com

Extracted

Family

redline

Botnet

dix

C2

77.91.124.251:19065

Attributes
  • auth_value

    9b544b3d9c88af32e2f5bf8705f9a2fb

Extracted

Family

redline

Botnet

diza

C2

185.161.248.37:4138

83.97.73.127:19045
Attributes
  • auth_value

    0d09b419c8bc967f91c68be4a17e92ee

Extracted

Family

redline

Botnet

rocker

C2

83.97.73.127:19045

Attributes
  • auth_value

    b4693c25843b5a1c7d63376e73e32dae

Targets

    • Target

      http://34.101.154.50

    Score
    10/10
    redlineryukxmrigdixdizarockerdiscoveryinfostealerminerpersistenceransomware

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Ryuk

      Ransomware distributed via existing botnets, often Trickbot or Emotet.

      ransomwareryuk

    • XMRig Miner payload

      miner

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • Renames multiple (7721) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Modifies file permissions

      discovery

    • Adds Run key to start application

      persistence

    • Drops Chrome extension

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

File Permissions Modification

1
T1222

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks