Overview

overview

10

Static

static

3

c682ee4f31...3a.exe

windows7-x64

10

c682ee4f31...3a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c682ee4f31bf55339dc6e34c5f6242015888729465c0335e3eb60af05847633a

  • Size

    144KB

  • Sample

    240810-q22fvasakr

  • MD5

    0d1ef0e9b611dcc79ad1d134990811d3

  • SHA1

    95cd22a171745294e6e13843c274a427cc6acdda

  • SHA256

    c682ee4f31bf55339dc6e34c5f6242015888729465c0335e3eb60af05847633a

  • SHA512

    90a9bf17aa09d01607b090566050459ccafc7dff7a1cc0515e5f1fa1ef82f795d918198704388a1b29eec1b959d1164df090e3243136807fa975097e32e05bb0

  • SSDEEP

    3072:eOFqYZEtiRjB+OpBmUHkRCBMmn3T/znyS4:eO8xwjBx8UHkt2DJ4

Score
10/10
ryukcredential_accessdiscoveryransomwarestealer

Malware Config

Targets

    • Target

      c682ee4f31bf55339dc6e34c5f6242015888729465c0335e3eb60af05847633a

    • Size

      144KB

    • MD5

      0d1ef0e9b611dcc79ad1d134990811d3

    • SHA1

      95cd22a171745294e6e13843c274a427cc6acdda

    • SHA256

      c682ee4f31bf55339dc6e34c5f6242015888729465c0335e3eb60af05847633a

    • SHA512

      90a9bf17aa09d01607b090566050459ccafc7dff7a1cc0515e5f1fa1ef82f795d918198704388a1b29eec1b959d1164df090e3243136807fa975097e32e05bb0

    • SSDEEP

      3072:eOFqYZEtiRjB+OpBmUHkRCBMmn3T/znyS4:eO8xwjBx8UHkt2DJ4

    Score
    10/10
    ryukcredential_accessdiscoveryransomwarestealer

    • Ryuk

      Ransomware distributed via existing botnets, often Trickbot or Emotet.

      ransomwareryuk

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Renames multiple (8013) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

      credential_accessstealer

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks