Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    19-11-2024 01:08

General

  • Target

    2024-11-19_4d3ab23846b9dedc7b0ed695e873fced_ponmocup_ryuk.exe

  • Size

    12.7MB

  • MD5

    4d3ab23846b9dedc7b0ed695e873fced

  • SHA1

    82e6b2fca15eb28accaba9541b08dba74c19fb43

  • SHA256

    05214e5aa2516af0f07882ab92a4c9e7a565e721e16eb96c7fda7bd2f980dfbf

  • SHA512

    05114eec1919e473b2c0342c76be05caae90105720df0f9c5c0f338cc1cbcc7fa6f9beeef681a7ff2ef7878c662f2ce98b35eca8caf2e8462d9841591db5b1c8

  • SSDEEP

    393216:nl4Dgt/xPBgn9c5hlERsMRFJzFcguYtN3ZWqg2j:l4UQEhksqZtN3dg

Score
10/10

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\README.txt

Family

demonware

Ransom Note
Tango Down! Seems like you got hit by DemonWare ransomware! Don't Panic, you get have your files back! DemonWare uses a basic encryption script to lock your files. This type of ransomware is known as CRYPTO. You'll need a decryption key in order to unlock your files. Your files will be deleted when the timer runs out, so you better hurry. You have 10 hours to find your key C'mon, be glad I don't ask for payment like other ransomware. Please visit: https://keys.zeznzo.nl and search for your IP/hostname to get your key. Kind regards, Zeznzo
URLs

https://keys.zeznzo.nl

Signatures

  • DemonWare

    Ransomware first seen in mid-2020.

  • Demonware family
  • Loads dropped DLL 55 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-11-19_4d3ab23846b9dedc7b0ed695e873fced_ponmocup_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-11-19_4d3ab23846b9dedc7b0ed695e873fced_ponmocup_ryuk.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2532
    • C:\Users\Admin\AppData\Local\Temp\2024-11-19_4d3ab23846b9dedc7b0ed695e873fced_ponmocup_ryuk.exe
      "C:\Users\Admin\AppData\Local\Temp\2024-11-19_4d3ab23846b9dedc7b0ed695e873fced_ponmocup_ryuk.exe"
      2⤵
      • Loads dropped DLL
      PID:900

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI25322\VCRUNTIME140.dll

    Filesize

    99KB

    MD5

    18571d6663b7d9ac95f2821c203e471f

    SHA1

    3c186018df04e875d6b9f83521028a21f145e3be

    SHA256

    0b040a314c19ff88f38fd9c89dca2d493113a6109adb8525733c3f6627da888f

    SHA512

    c8cbca1072b8cb04f9d82135c91ff6d7a539cb7a488671cecb6b5e2f11a4807f47ad9af5a87ebee44984ab71d7c44fc87850f9d04fd2c5019ec1b6a1b483ca21

  • C:\Users\Admin\AppData\Local\Temp\_MEI25322\_bz2.pyd

    Filesize

    84KB

    MD5

    fc0d862a854993e0e51c00dee3eec777

    SHA1

    20203332c6f7bd51f6a5acbbc9f677c930d0669d

    SHA256

    e5de23dbac7ece02566e79b3d1923a8eeae628925c7fb4b98a443cad94a06863

    SHA512

    b3c2ade15cc196e687e83dd8d21ce88b83c8137a83cfc20bc8f2c8f3ab72643ef7ca08e1dc23de0695f508ba0080871956303ac30f92ab865f3e4249d4d65c2f

  • C:\Users\Admin\AppData\Local\Temp\_MEI25322\_ctypes.pyd

    Filesize

    123KB

    MD5

    8adb1345c717e575e6614e163eb62328

    SHA1

    f1ee3fff6e06dc4f22a5eb38c09c54580880e0a3

    SHA256

    65edc348db42347570578b979151b787ceebfc98e0372c28116cc229494a78a8

    SHA512

    0f11673854327fd2fcd12838f54c080edc4d40e4bcb50c413fe3f823056d189636dc661ea79207163f966719bf0815e1ffa75e2fb676df4e56ed6321f1ff6cae

  • C:\Users\Admin\AppData\Local\Temp\_MEI25322\_hashlib.pyd

    Filesize

    45KB

    MD5

    5fa7c9d5e6068718c6010bbeb18fbeb3

    SHA1

    93e8875d6d0f943b4226e25452c2c7d63d22b790

    SHA256

    2e98f91087f56dfdffbbdd951cd55cd7ea771cec93d59cadb86b964ed8708155

    SHA512

    3104aa8b785740dc6a5261c27b2bdc6e14b2f37862fa0fba151b1bc1bfc0e5fb5b6934b95488fa47c5af3fc2b2283f333ff6517b6f8cf0437c52cf171da58bf5

  • C:\Users\Admin\AppData\Local\Temp\_MEI25322\_lzma.pyd

    Filesize

    158KB

    MD5

    60e215bb78fb9a40352980f4de818814

    SHA1

    ff750858c3352081514e2ae0d200f3b8c3d40096

    SHA256

    c4d00582dee45841747b07b91a3e46e55af79e6518ec9f0ce59b989c0acd2806

    SHA512

    398a441de98963873417da6352413d080620faf2ae4b99425d7c9eaf96d5f2fdf1358e21f16870bdff514452115266a58ee3c6783611f037957bfa4bcec34230

  • C:\Users\Admin\AppData\Local\Temp\_MEI25322\_socket.pyd

    Filesize

    77KB

    MD5

    1d53841bb21acdcc8742828c3aded891

    SHA1

    cdf15d4815820571684c1f720d0cba24129e79c8

    SHA256

    ab13258c6da2c26c4dca7239ff4360ca9166ea8f53bb8cc08d2c7476cab7d61b

    SHA512

    0266bcbcd7ca5f6c9df8dbeea00e1275932dacc38e5dd83a47bfbb87f7ca6778458a6671d8b84a63ae9216a65975da656ba487ac28d41140122f46d0174fa9f9

  • C:\Users\Admin\AppData\Local\Temp\_MEI25322\api-ms-win-core-file-l1-2-0.dll

    Filesize

    18KB

    MD5

    31e207b01e67b6563d2cf9110d06a1d2

    SHA1

    f12832e055c0f0d70fc44b4cb0215c17aa948332

    SHA256

    6b31a206c051815be9f7b366d2a9d2464747a56888a7307a924ecdac558271e1

    SHA512

    8a19324c8719ad6e7509de44fe79c6614c064daa47c4206a2b6ba4124b45bc4d8785cd51b8877c9ae5a1e0768ee1bba8f98e8d8c17b700aa8dadbd2801035a92

  • C:\Users\Admin\AppData\Local\Temp\_MEI25322\api-ms-win-core-file-l2-1-0.dll

    Filesize

    18KB

    MD5

    f2d12342c68e51aa748d4937f3ec7ded

    SHA1

    22368cebce89feb929004f73bd0f7236f7050e36

    SHA256

    6ba964ad55822f55eea14f73a48deb164b337639a82da677fc6efc1c539fe81e

    SHA512

    1e1440c97237716a6ac63e038d932edd0e7962230bfd6956b8aafa378b344daf92da696f0d1a57b0d71fef3722296b0d02f59b0fc9551e7944c445cc6b2b26a4

  • C:\Users\Admin\AppData\Local\Temp\_MEI25322\api-ms-win-core-localization-l1-2-0.dll

    Filesize

    20KB

    MD5

    9b43f5733a98e5c6095996916f889987

    SHA1

    01ba4d84cb2adf3536c31b1c41375d141dcd2ba1

    SHA256

    2b7e6b54ebc2b9556e2f75e7372d4b2d16758f928b79395b8a55c7acdca93341

    SHA512

    b3497f31c155049c68b18d2f28383843bd8b8c078db119c07d63ec1900a6204e266a3bc1503734fd85c3766bddb25029880291e4f6060afe5df82717af6ae092

  • C:\Users\Admin\AppData\Local\Temp\_MEI25322\api-ms-win-core-processthreads-l1-1-1.dll

    Filesize

    18KB

    MD5

    95b0eb891b1e869568a2bf9ab67eab0f

    SHA1

    09cf1cbb3089fc418eb933d1b4611cca0d4ad327

    SHA256

    5129795d6e0aeca2fa56aaa56d71d2e9809c2ad77c14265abcb51fe832105e00

    SHA512

    7b2a74278fb7e51242006dc1e60d0e7cc3ed763eb4e7ed7e9da87797ea81fdb05857de838b745fac03468f85c755fe86331746466c30f87f127172de5524f057

  • C:\Users\Admin\AppData\Local\Temp\_MEI25322\api-ms-win-core-timezone-l1-1-0.dll

    Filesize

    18KB

    MD5

    69d1c46b9927d1c7cad8dfb5e18ab7ab

    SHA1

    1917be91adb466085678ebe036643cb187a7f4d5

    SHA256

    23f035627abed3460e6dbe8436e5b608c7c30f69091011f655f10ee49ebfd282

    SHA512

    365dbc3811b9bc2417937e433b7b748080c3ca1f4fc1b361117db46fd9dcfe49d948407dca33ca75d307b0e7f7919cc3550caa16e6950f10b0f46d16cbd36172

  • C:\Users\Admin\AppData\Local\Temp\_MEI25322\api-ms-win-crt-conio-l1-1-0.dll

    Filesize

    19KB

    MD5

    3f14aadfaf34257f399ddb6c554d8a51

    SHA1

    695f7a5d42fd16109ad744a2b215dbd4543e2b84

    SHA256

    edf658d7655b524f5158b69a189d9715f87ceac701a055acc23ce608e4ea0774

    SHA512

    002a34bb9210401270f321eb973afd1fd807a3dc395fcd69adbcabca413d77ea748f78f70c61818da52902a74d38ffc9a5b655887d9336a02355072b421cae22

  • C:\Users\Admin\AppData\Local\Temp\_MEI25322\api-ms-win-crt-convert-l1-1-0.dll

    Filesize

    22KB

    MD5

    e3495c380c381670908355181787d7ea

    SHA1

    30b2d379cf483e3394a462a5824092e555974f26

    SHA256

    b353bd22b97fd3704557a99359c9ea0b4e0ad8b7e43b5e21700dabd1a1d84923

    SHA512

    be973074be09fb0e11d4819c0a04d07daad5bf82d3b2c689ab9a5a6d74d39bd24cf526bcfd926f69f5986f0dbfce2d3b4e21a2449ad8e6e9a8a2cfd52b572868

  • C:\Users\Admin\AppData\Local\Temp\_MEI25322\api-ms-win-crt-environment-l1-1-0.dll

    Filesize

    18KB

    MD5

    5746d1dc01f0a069f009ecd7f8738c41

    SHA1

    5d8696c5cfab3b9c91806a95c9a84d539a4500a3

    SHA256

    325e7bb5c8a3c7f9db8698a570b7d9d9424a028d51f937a2dff3dc5ff0b6e457

    SHA512

    c73d63216f0bfda185928172b737aa652ba30d88471b22c5161b162bd5d68d7b60c3b90af648cc7c1c2b409af416383db106abf8366733ba4c61f3f104c8db41

  • C:\Users\Admin\AppData\Local\Temp\_MEI25322\api-ms-win-crt-filesystem-l1-1-0.dll

    Filesize

    20KB

    MD5

    c8211d9a8f2595c9ee6f75c9b6d5cb29

    SHA1

    f90ee7350a2d922f5ab614a43c81a42604a86306

    SHA256

    b78607f566599e92bfa8ff5de0f28c439207abf17f274a045500a0d107287d41

    SHA512

    846583349a448d2df8b4a9957a72b6734b0e394135cef6b03bdf197c6752c9e688e47c7d51ce4825f20f47d933ff9133b481b4daec6b0ec729a739b157617377

  • C:\Users\Admin\AppData\Local\Temp\_MEI25322\api-ms-win-crt-heap-l1-1-0.dll

    Filesize

    19KB

    MD5

    28579ca40c9e19cc6dc23dfb8b6871cd

    SHA1

    804cdccdb65ad15e016072b5d6f9843096140864

    SHA256

    a57d8275c34c1094f6a4535e23c7bee4759532e08776ff84c5fe487c0f925eb4

    SHA512

    9489cdc3d5df75dd2686ea82dd689aae0a4fd503d2831091c10bc53820320b4947cd9f321501448d258b219516e5d9aaf6790f13189248835ba20b2f86674b9c

  • C:\Users\Admin\AppData\Local\Temp\_MEI25322\api-ms-win-crt-locale-l1-1-0.dll

    Filesize

    18KB

    MD5

    4140ee5c6ea9f933c483615141fd54fe

    SHA1

    3ef9da0df943f56f1838853fc5406280b2823516

    SHA256

    29abdc8c5396132b004e6751464641b8f0562249333b2257a1d2eb4aecc8d9dc

    SHA512

    1cc86a050dcd1619e9e2cc9aa37c76da21e4a4d8f1700916c5ff6ed883d3c4218df17b1980a4875c803f5a5de5b80b45ebe5f0fd20b38726fe6cd8d8039d49a2

  • C:\Users\Admin\AppData\Local\Temp\_MEI25322\api-ms-win-crt-math-l1-1-0.dll

    Filesize

    26KB

    MD5

    6c7d9c87af17330357fdb7f39751080b

    SHA1

    3a1dd4a6290d0c9764e43f430bb447ae4cce674d

    SHA256

    6a9dd5a4e52c1aa0e341e35e9dc1a6fbf476ebacd64add3a53c146f019a9a4c6

    SHA512

    d03b8c177b81dd7d55cb1c2dc76301d52ff6d0cbef61398bffd9d113814fa64801196414abefb2f635cbc3e28de3960a47f4b6d6170fe252ac0642701de75d27

  • C:\Users\Admin\AppData\Local\Temp\_MEI25322\api-ms-win-crt-process-l1-1-0.dll

    Filesize

    19KB

    MD5

    7c1742b5617456344965156c650af627

    SHA1

    4b83cae841ca3360ed998c48816ec4ea71cb86f7

    SHA256

    e31fd2a662773f4b2d84d29dc312d5614992b8e1b700840a2f5ae539ad9a21c2

    SHA512

    9fe82e00b1921e9566ae07226b7c4305aebacd169e8cae4a286183acdb70391ce64ca62fb029dff10a280775218ff0772e3fc953fc31b7fa2ace518904cd5ed8

  • C:\Users\Admin\AppData\Local\Temp\_MEI25322\api-ms-win-crt-runtime-l1-1-0.dll

    Filesize

    21KB

    MD5

    f576fd38085005b4ab2ff1dacd293c48

    SHA1

    75074cfc7543b34f0bcace916370413055dee2ae

    SHA256

    6e794d0fad29cc5bdd5d0511fd923d3434ed122cff0ed697903900c93c807582

    SHA512

    3887ba832965e3bbe248002e926b0ea8374b4755e6b736c25850088287790e20052d3334000eb7afc2c86fd2a14ba05d5e564c1bd811d8baa8e524f4f7fcfc25

  • C:\Users\Admin\AppData\Local\Temp\_MEI25322\api-ms-win-crt-stdio-l1-1-0.dll

    Filesize

    24KB

    MD5

    1cec55e31418a818093c73e96bd41973

    SHA1

    69a57fb9c17ccfd607749d8e9c8e80792904ea44

    SHA256

    513bb1dd16be7491ced8fa2494b604257285f76062525685c2991391d0c048c3

    SHA512

    31f0e1f4ec0e8b94f4fe403f182596839c916f5d810b8d81c1f399868d18c68192a1362f03f9983d92cb7b7c8575421da12c345838321c95d056c20517ee9b55

  • C:\Users\Admin\AppData\Local\Temp\_MEI25322\api-ms-win-crt-string-l1-1-0.dll

    Filesize

    24KB

    MD5

    e730cd977ac7f60f0824775e39c8fd2c

    SHA1

    fdfaf759a360293687bd2838b7d9feb628edaf5b

    SHA256

    63de06332e8ff15a5bff699e70ed2537a9d273ba62463fa16265d261f3c5bb31

    SHA512

    d6a30e82a061f7e5f27aaa928819ebefff2bb5963ab7d4be33d41e0099576b1e7d0c671082fa08ce0e1bd8e89c4dc8ae427a22f0162ac05b8a0259392bb50fe8

  • C:\Users\Admin\AppData\Local\Temp\_MEI25322\api-ms-win-crt-time-l1-1-0.dll

    Filesize

    20KB

    MD5

    090027e2a3ef8d8ebf9ced36fdc7b492

    SHA1

    bc75462090e7b95a44c9d22ddec394da30d4b6e4

    SHA256

    803b6f86f178e71f462dfdd6521c9f4791059c1fab5dc86de17c34c25e55f8bd

    SHA512

    4ba291e44be86ab8e2f3619155ad503d68e65f84eab0870844c23893b5c169a1fe85fb1feb6cd0ba692373d84b40db3e8fcec3ad231899a0f3ffbecc971fe48b

  • C:\Users\Admin\AppData\Local\Temp\_MEI25322\api-ms-win-crt-utility-l1-1-0.dll

    Filesize

    18KB

    MD5

    6bc85715c6a0006cdeff1b3d7ffd796f

    SHA1

    fac4bdf44990b06c7a1c2ffed214ebd710264b3f

    SHA256

    7a578dd2ceb4387ae8f67f6a82ab553ca1570d1588ab6645859e5625585af95c

    SHA512

    a8ed5d78d973efd248971795dc1e3a6e27421746d2c7d47740e846a7e19f3153e7a7e508327a20edf9a2354dbc82da6985e1e212474a066c905a00a32de99bc7

  • C:\Users\Admin\AppData\Local\Temp\_MEI25322\base_library.zip

    Filesize

    767KB

    MD5

    a57bf309a834af323f02f9fc86f6041f

    SHA1

    cbce0d3a238afe0d9c12b5315f31622922bacf69

    SHA256

    124e2bf84d69508ebbb9a0e02dea974799cc886ee65e8cb7a8cfd46831fe0842

    SHA512

    e69bf1ff46bf34d2cdc1dfe1ee8d0fb28aa2e5b0e3af150f2a0dffeb3e277249459cb57f67cc45b2ac28acf86adb20cb594b5546ae6c4c51fc0374a511332e5b

  • C:\Users\Admin\AppData\Local\Temp\_MEI25322\libcrypto-1_1.dll

    Filesize

    3.2MB

    MD5

    cc4cbf715966cdcad95a1e6c95592b3d

    SHA1

    d5873fea9c084bcc753d1c93b2d0716257bea7c3

    SHA256

    594303e2ce6a4a02439054c84592791bf4ab0b7c12e9bbdb4b040e27251521f1

    SHA512

    3b5af9fbbc915d172648c2b0b513b5d2151f940ccf54c23148cd303e6660395f180981b148202bef76f5209acc53b8953b1cb067546f90389a6aa300c1fbe477

  • C:\Users\Admin\AppData\Local\Temp\_MEI25322\libffi-7.dll

    Filesize

    32KB

    MD5

    eef7981412be8ea459064d3090f4b3aa

    SHA1

    c60da4830ce27afc234b3c3014c583f7f0a5a925

    SHA256

    f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

    SHA512

    dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

  • C:\Users\Admin\AppData\Local\Temp\_MEI25322\payload.exe.manifest

    Filesize

    1KB

    MD5

    dd599af0347cd04ed71a484ac5e5ce8c

    SHA1

    0fb19ed1e1a753e6d4ce08a0abce998e7c15d862

    SHA256

    b3a30939dfb1abd2bdd1e06b9a0fb9dd1752984c42a0815ccfbb4f5541fc7455

    SHA512

    aed0715386cf78a76a2e98487ca624df00c6a8ff1f0620efb183a5955196ebe82f7f184e3708d7d9c8877c4f947abf4a2cb7a692a912832b8c8b6ca05293566f

  • C:\Users\Admin\AppData\Local\Temp\_MEI25322\pyexpat.pyd

    Filesize

    184KB

    MD5

    11a886189eb726d5786926cc09f9e116

    SHA1

    d94295368a1285681fb03bac0553eb1495d43805

    SHA256

    dc38bdbe10cfaa99799e0c87aa8444fc062d445b87686d6593ffca46cc938031

    SHA512

    405c56487a91ad1209029ca6ea125642076251f0a8c069eef0e30ce484381db7bf24d2f5cd74b83d1c8c1358f92f35fa6ed7b75601ace611cf36bb2331588684

  • C:\Users\Admin\AppData\Local\Temp\_MEI25322\python38.dll

    Filesize

    4.0MB

    MD5

    1f2688b97f9827f1de7dfedb4ad2348c

    SHA1

    a9650970d38e30835336426f704579e87fcfc892

    SHA256

    169eeb1bdf99ed93ca26453d5ca49339e5ae092662cd94cde09fbb10046f83fc

    SHA512

    27e56b2d73226e36b0c473d8eb646813997cbdf955397d0b61fcae37ed1f2c3715e589f9a07d909a967009ed2c664d14007ccf37d83a7df7ce2a0fefca615503

  • C:\Users\Admin\AppData\Local\Temp\_MEI25322\select.pyd

    Filesize

    26KB

    MD5

    a2ab334e18222738dcb05bf820725938

    SHA1

    2f75455a471f95ac814b8e4560a023034480b7b5

    SHA256

    7ba95624370216795ea4a087c326422cfcbccc42b5ada21f4d85c532c71afad7

    SHA512

    72e891d1c7e5ea44a569283b5c8bd8c310f2ee3d3cc9c25c6a7d7d77a62cb301c822c833b0792c3163cf0b0d6272da2f667e6bc74b07ed7946082433f77d9679

  • C:\Users\Admin\AppData\Local\Temp\_MEI25322\ucrtbase.dll

    Filesize

    977KB

    MD5

    5b1c91b53ac3c3026d50de8c05aba139

    SHA1

    b9c2d160b1ce856d9904a340362236473a3d559c

    SHA256

    d804ea40eacfc22a5e029b66d6d4f83d81f76a7ead80313b33839253f90af6b7

    SHA512

    8e01056830e65320d684245bf055305e03ef136545efb51aad484a5b1b006f7d534c30b7973da8628f49c31710ae23d3420f941156c941172b97efe9e1ef9a1f

  • C:\Users\Admin\Desktop\README.txt

    Filesize

    577B

    MD5

    827f7da7ad47cb8c6647c0478042301e

    SHA1

    7e45a7f3bdc0eb7e98bab2dfd020cb796efd8d84

    SHA256

    35e838bc9daeb0357da9211c4da95d3e557a9600d986cf6e74deabd1ac8db839

    SHA512

    370a5b6e2622945353ae12b5d25ae0be7baa7cf19006e4dba68e8fe629e284d062a3ba9911aa4243de837de921c97eab008524b3d2122f41f9a24401eb0a45b0

  • \Users\Admin\AppData\Local\Temp\_MEI25322\_elementtree.pyd

    Filesize

    173KB

    MD5

    4d1c727663b949fa6aba4f9a71693dc9

    SHA1

    fe77deb2b1da2bd30206e50d48d67ac8b9c84fd6

    SHA256

    bcd6f366a7125de7e33ade6f20032cb134e530883c5af9fca74fcdfa2151648a

    SHA512

    df51023da0de97624b354451829b2b2c6bb9d90db5c022dd3d38cdb5e3d4c329c5250e2c34879e95af2e270d454e4bc599a52b4ebaf8ca023f5d60f1a1537ffe