Overview

overview

10

Static

static

3

EIMnwkN.exe

windows10-2004-x64

10

EIMnwkN.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    201105-k5mbfykn9j_pw_infected.zip

  • Size

    75KB

  • Sample

    250128-x3jqrayng1

  • MD5

    ec7272efa9a0993df632125ac6198836

  • SHA1

    405ed20d05b9dbc3be427d69b54d86752a4dd07d

  • SHA256

    55bd3c757e26a7da1cf4a8b4387c2a4d9c322b8ef9239b0056156f34c639817a

  • SHA512

    713ee65707bbbad03b1705d2155f3bab9f7fcc82863ac485a09a85ac774d88cfa51e4329a30be70822006b53eb2efb9af3da12edd5c5df79794e25794ffbd27a

  • SSDEEP

    1536:6zyr4m2fbW97TqrbD9GD754IKXphYrzkWVZWpzoZkVA5QFToE0XuZH:2yr4ZbOHqrbw7QMzkWTEcaEQFTz

Score
10/10
ryukcredential_accessdiscoverypersistenceransomwarestealer

Malware Config

Targets

    • Target

      EIMnwkN.bin

    • Size

      196KB

    • MD5

      484a2bcb1335ac97ee91194f4c0964bc

    • SHA1

      ad11ed52ab33ad05eb9b1e9ade134ca1348acc81

    • SHA256

      40b865d1c3ab1b8544bcf57c88edd30679870d40b27d62feb237a19f0c5f9cd1

    • SHA512

      6e61612bd29425c5ab9b648fa83bc2d8616071247f8659aa316ab9d4adde0a9ceb9301737bb4216db223dfdd371106da75463f6d7e3a88e1c4cdd6c821f3935f

    • SSDEEP

      3072:08CBJvnmQ4VZQY83XS/cIVVEn+GNi4qRGE95jq:RWJOzT+K5Vc+oujq

    Score
    10/10
    ryukcredential_accessdiscoverypersistenceransomwarestealer

    • Ryuk

      Ransomware distributed via existing botnets, often Trickbot or Emotet.

      ransomwareryuk

    • Ryuk family

      ryuk

    • Renames multiple (2941) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

      credential_accessstealer

    • Drops startup file

    • Executes dropped EXE

    • Modifies file permissions

      discovery

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks