Analysis
-
max time kernel
102s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20250313-en -
resource tags
arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system -
submitted
18/03/2025, 01:46
Behavioral task
behavioral1
Sample
2025-03-18_7e8bef0e5baa023171cb93339e761b86_ryuk.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
2025-03-18_7e8bef0e5baa023171cb93339e761b86_ryuk.exe
Resource
win10v2004-20250313-en
General
-
Target
2025-03-18_7e8bef0e5baa023171cb93339e761b86_ryuk.exe
-
Size
11.8MB
-
MD5
7e8bef0e5baa023171cb93339e761b86
-
SHA1
5c2b59771c1e0af962cd6e44ebd008da53b6823d
-
SHA256
e19d00767aa93ad6e6de89901fe2a2ad389dd3824036ac9a796fdd50723e0707
-
SHA512
5837eea02955d99ebcb01fe8fe427985bd45d8088e4c8d02bbc348fa1666b9cbc7c7961cfc313e15ab6b85d824fdd0ea278a8369cb626b2844485412d398d486
-
SSDEEP
196608:pT0OqTXrTaXPA4pzxw9BK+GIgr9onJ5hrZERpyiU8AdZYJERS48RmU/3ZlsPvar:KTXafVxw9BNPi9c5hlERlAdZYygtN3Z1
Malware Config
Extracted
C:\Users\Admin\Pictures\README.txt
demonware
https://keys.zeznzo.nl
Signatures
-
DemonWare
Ransomware first seen in mid-2020.
-
Demonware family
-
Loads dropped DLL 36 IoCs
pid Process 1916 2025-03-18_7e8bef0e5baa023171cb93339e761b86_ryuk.exe 1916 2025-03-18_7e8bef0e5baa023171cb93339e761b86_ryuk.exe 1916 2025-03-18_7e8bef0e5baa023171cb93339e761b86_ryuk.exe 1916 2025-03-18_7e8bef0e5baa023171cb93339e761b86_ryuk.exe 1916 2025-03-18_7e8bef0e5baa023171cb93339e761b86_ryuk.exe 1916 2025-03-18_7e8bef0e5baa023171cb93339e761b86_ryuk.exe 1916 2025-03-18_7e8bef0e5baa023171cb93339e761b86_ryuk.exe 1916 2025-03-18_7e8bef0e5baa023171cb93339e761b86_ryuk.exe 1916 2025-03-18_7e8bef0e5baa023171cb93339e761b86_ryuk.exe 1916 2025-03-18_7e8bef0e5baa023171cb93339e761b86_ryuk.exe 1916 2025-03-18_7e8bef0e5baa023171cb93339e761b86_ryuk.exe 1916 2025-03-18_7e8bef0e5baa023171cb93339e761b86_ryuk.exe 1916 2025-03-18_7e8bef0e5baa023171cb93339e761b86_ryuk.exe 1916 2025-03-18_7e8bef0e5baa023171cb93339e761b86_ryuk.exe 1916 2025-03-18_7e8bef0e5baa023171cb93339e761b86_ryuk.exe 1916 2025-03-18_7e8bef0e5baa023171cb93339e761b86_ryuk.exe 1916 2025-03-18_7e8bef0e5baa023171cb93339e761b86_ryuk.exe 1916 2025-03-18_7e8bef0e5baa023171cb93339e761b86_ryuk.exe 1916 2025-03-18_7e8bef0e5baa023171cb93339e761b86_ryuk.exe 1916 2025-03-18_7e8bef0e5baa023171cb93339e761b86_ryuk.exe 1916 2025-03-18_7e8bef0e5baa023171cb93339e761b86_ryuk.exe 1916 2025-03-18_7e8bef0e5baa023171cb93339e761b86_ryuk.exe 1916 2025-03-18_7e8bef0e5baa023171cb93339e761b86_ryuk.exe 1916 2025-03-18_7e8bef0e5baa023171cb93339e761b86_ryuk.exe 1916 2025-03-18_7e8bef0e5baa023171cb93339e761b86_ryuk.exe 1916 2025-03-18_7e8bef0e5baa023171cb93339e761b86_ryuk.exe 1916 2025-03-18_7e8bef0e5baa023171cb93339e761b86_ryuk.exe 1916 2025-03-18_7e8bef0e5baa023171cb93339e761b86_ryuk.exe 1916 2025-03-18_7e8bef0e5baa023171cb93339e761b86_ryuk.exe 1916 2025-03-18_7e8bef0e5baa023171cb93339e761b86_ryuk.exe 1916 2025-03-18_7e8bef0e5baa023171cb93339e761b86_ryuk.exe 1916 2025-03-18_7e8bef0e5baa023171cb93339e761b86_ryuk.exe 1916 2025-03-18_7e8bef0e5baa023171cb93339e761b86_ryuk.exe 1916 2025-03-18_7e8bef0e5baa023171cb93339e761b86_ryuk.exe 1916 2025-03-18_7e8bef0e5baa023171cb93339e761b86_ryuk.exe 1916 2025-03-18_7e8bef0e5baa023171cb93339e761b86_ryuk.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3044 wrote to memory of 1916 3044 2025-03-18_7e8bef0e5baa023171cb93339e761b86_ryuk.exe 88 PID 3044 wrote to memory of 1916 3044 2025-03-18_7e8bef0e5baa023171cb93339e761b86_ryuk.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-03-18_7e8bef0e5baa023171cb93339e761b86_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2025-03-18_7e8bef0e5baa023171cb93339e761b86_ryuk.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\2025-03-18_7e8bef0e5baa023171cb93339e761b86_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2025-03-18_7e8bef0e5baa023171cb93339e761b86_ryuk.exe"2⤵
- Loads dropped DLL
PID:1916
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
15KB
MD54b2a7333c46b2b9ff31ea051adfbc3e3
SHA1e70b24eef379174dd1448a224456bd23d029f2da
SHA25632724cd93515e542b24887c714e825d16f38dfc6c762711f566bf65c816a374c
SHA51223ae6237349446706c9e32f7422eb709ec0f37e4b65a9d039ec7a593adec42aa15abb4fdd7886dd7c410c9d2597eeb1966bf05b71ff59cd80ba2638132cdeb55
-
Filesize
13KB
MD5f3685f2d6bafab5c239caea7dc7faf67
SHA125e90e2c4d2a28391d060b8b842a036afa980c61
SHA256be805b0cc32419859fbf0fc06c00fb178e49b51d67add736dc43750495fe0d06
SHA512a502ef565288d4ff14cbbf8ea58f501a15b9565f5d6087e8b4cc2515d23df2b61dea8698562b755051891485acc940be57710799ae0ae75c2bd969d81ff5ffe9
-
Filesize
14KB
MD516c56e3fb3c8b6792aa81fc27e3b3bac
SHA152c089d2e970728062d57f127e51638f657f2898
SHA256cae7b092bf323d5fb9bd97faa8839f9df6e946fe5cc5bf651d04e22b320fd280
SHA512be1f8152fe5fdb788e73ffddad19b670d50af44ae922d7703351c2677c1068b58c4be5952c95f6fd7a207d5e7433f65a3ee3d8196c5dc7a08f98912600177fb1
-
Filesize
14KB
MD55b0ae53ac88cdcc5a8c959b619421f2c
SHA113d6bfd61bdaf72b05b070c79e49f0c57d75b49c
SHA256030ba5b4aafda597cc62c2f340a2b2cdc15280b1f08f52c27a6aca4e34ad3870
SHA512ad8e6bde4eb75ed921432e8d10ca15b1a6d890875f65e9214694a204a987dbbdc99b669c984df2cc6349f18ccc7f812d573856eddb30d8aa7a3646c7857378ad
-
Filesize
11KB
MD5f7d18c30f58bb64108955dcbdbd9e767
SHA1f0678e2a89a18f7b9f777419e1544a2923787fa6
SHA256ed33378b96f14afd0a181594fc6529c5fad386d62e156975151a2d3df3f3043e
SHA5127d101bb7ed27b0ab39c159aa4052181f500ac0213d555afc0e3f43fd07cdb62bf95aeb77a124913623d40e7b052bec4842862063e4cbb1f690f2ad92908b9b6c
-
Filesize
12KB
MD53605b34ca8944fcf8e3f9195ee19a5be
SHA12f55c8a236d5c1894d120b3f1493bc1c71519bc7
SHA256b7cfa8ff75d2717e1ac01f95fa30def3f50b0661c37326f8081d281881305c21
SHA512bb45388ec0794e0ea3d1c35afb3ec7ccd29f2c07fd186669f26069fa2b938f7c7200dd94a6cd8d7bdd46ac26527991f75d14f4383ceefe5f4413af7574737897
-
Filesize
15KB
MD53b0dd732bf6058b1ed797fbb8e3bc9d1
SHA13f13a5e708b1b26f670cfc9aa5b3ecd84382abae
SHA2567d1d5226be5f7e5a64be5c0334d1bc0654f95c4264a4ae188b1f6d3975f7f12d
SHA5129121c1dfd4094a12ffae1e91069020cc3e8fb23197f3674cf14279200448c12bd6377dbf18479473e139ea22375b09058f052c2db716d59f90a832210d1a4754
-
Filesize
17KB
MD50824637de685a4bc801deddd2e519243
SHA1046f08ad0751b5add4b7b74fbf0247979ddb8432
SHA2563f56f08f3ceaec70cec7b45bd69c83999446ba0dfddc6636c05f0cde2fb9b1e6
SHA512968dbd28dfe1d91e3a393a49f0baec2a5663925264cd253ae489e67b92d606c9787049481aee4c3370344f2ea46e9320de5c1ead828f71fae727f45d926d2cb9
-
Filesize
19KB
MD599252cd54dac09c53ada74e50d6d14ef
SHA1b6e06d8fcecac0f7b48deda17e02fc4874c4f3fc
SHA256da5a46d672008f2da7e016d47e8d10b8d343e386f5a1ed534d9986b9dc3ab821
SHA512da6207291d26f201acd2a26131de2846caa7d61f1a48618e8ccf7f3bdb05012bf70fb5bec69320505b5f00e07a4b2bdc6fefc2d00ed22bb6c500d16f270f90ee
-
Filesize
22KB
MD59928250fbb57d753734ae34b41f6dc28
SHA1674944db6d4bb0718ab6c5327f6896df01f78470
SHA2562a1a9df342e7261425e7e83b674b32fc49918b970f147c728ca018cd9f3dffa5
SHA512799184eab64a273dd4c5d76b780fd8a86bb535557957f360fe8d85254a52c14a461ee9f4fce14dd892faf12235150d8ecd8afebc38fae1222e128ee7b7ba96aa
-
Filesize
14KB
MD54dce36fbe7945cc481540ed01ca8a9ad
SHA1a42ca12a1fd10fc4344e22ff0cf04636ed2cf079
SHA256b2094f11fdb9ed8db33fe33e86a8c4ac96c56679fbef7a20a15fe63e505811b3
SHA51238f2adc35dcbc3524e0cb31ae13b7ce324ec04b2f2b5bef748399110cc6025f123494204fe62ebca493d68da4807b6e803c14d6060ea1feda0cd2b5057d79188
-
Filesize
13KB
MD5f869255edd2c17f103d9330a3daf18d7
SHA1f1d9e5fc4406685ce966a82c8b7ed33e3520fd95
SHA2569dacae80d6127546f0ceb0a36bfcaf34ac1cdc12ab30bf6165df15997a91a7c8
SHA5126194dcf030d5e87cdf6e1a8da0ed2304969279c6dbdecc73baf09ffa5fc65a449a68a233db987507846598c6d97f6acd6165f7a60ec42dcf980b69f830f1a0c8
-
Filesize
13KB
MD51509827b82033c9497af8b2ab5d2ebdd
SHA1f8d7ea32b981274136e7bbacdd1b47984cfeb0a7
SHA25620a9494be4478051f62c18e98bb726be67d2d74df00c66afa754cbebf009616f
SHA51221c752339467b7478e29d1c4e6b0ec6534dcd5abdabc69189acd3898bef51b823b6a0ca25e9c18599f594e2c2dd0b8a0273f7355737345718f3820ab105a799f
-
Filesize
11KB
MD5852d4fb59d01b9d1de79fe3d0f281c03
SHA1e8a4f36abb041c1928b92fc57f51510a3bac86e3
SHA2564aee6a9621fe296fd2608364d34bdada63a34f64606623e73466e5183e9b6f8e
SHA5123f047f90240e54a6b7b289fa740bb02e8fa101fa5d85898b55365eadebc894994c374ccd5da24ff658c98ac740f060a396bc3882e78d2aa36ca3141e398ff207
-
Filesize
11KB
MD5138500067f9c2e9ff72a108e13b3e182
SHA10ffaa57ab0193eb3fdda315e32f41f8dd5c9c649
SHA256c8da8ad5af56d5d5ba7d338ab23f5f78239229218a6ac2735564b5d08b2da3f3
SHA5122887553b7358475795d8f7394e60321998355516065b46a436de4e488dbbf6b4104c45def6ad714bdd3105c3602838aab9306cb1742c02512c1056b53ad4fc33
-
Filesize
2.5MB
MD54c4c592134096ab72192312149953b77
SHA10d7b8524e37648b8694766310cf29b7ee6894846
SHA256c565c21a3a42752ca70a21747a9f96b46ee778ad5531c77535ea1d1be8998ac9
SHA5126e73a990e11e55d9699284ae5fa7fc63dfb1ca189511967cb9b2d73b9779a9a3454ba2abcea75bb64b4193e1a2a736753a52e2b5b54c7c115d1fbecc8d8b363b
-
Filesize
99KB
MD58697c106593e93c11adc34faa483c4a0
SHA1cd080c51a97aa288ce6394d6c029c06ccb783790
SHA256ff43e813785ee948a937b642b03050bb4b1c6a5e23049646b891a66f65d4c833
SHA512724bbed7ce6f7506e5d0b43399fb3861dda6457a2ad2fafe734f8921c9a4393b480cdd8a435dbdbd188b90236cb98583d5d005e24fa80b5a0622a6322e6f3987
-
Filesize
83KB
MD56c7565c1efffe44cb0616f5b34faa628
SHA188dd24807da6b6918945201c74467ca75e155b99
SHA256fe63361f6c439c6aa26fd795af3fd805ff5b60b3b14f9b8c60c50a8f3449060a
SHA512822445c52bb71c884461230bb163ec5dee0ad2c46d42d01cf012447f2c158865653f86a933b52afdf583043b3bf8ba7011cc782f14197220d0325e409aa16e22
-
Filesize
122KB
MD529da9b022c16da461392795951ce32d9
SHA10e514a8f88395b50e797d481cbbed2b4ae490c19
SHA2563b4012343ef7a266db0b077bbb239833779192840d1e2c43dfcbc48ffd4c5372
SHA5125c7d83823f1922734625cf69a481928a5c47b6a3bceb7f24c9197175665b2e06bd1cfd745c55d1c5fe1572f2d8da2a1dcc1c1f5de0903477bb927aca22ecb26a
-
Filesize
172KB
MD5048ea61f0c0f7fd42dfe8ca3203d5e99
SHA1369227dce4b047b0fa7996fd21542e0b2fbdab8e
SHA2569b9abf5672bec167b854a106eb25701433b34a0c877ed5e363202247e5bada58
SHA512d1d2ac291739e42f143cc11ffda05263a92124d27eeab9457946c997ac2e03a968eae01eb2185b10e41db63026cbb0fb7c02a83721ea0e1059f042290dd30463
-
Filesize
63KB
MD5f377a418addeeb02f223f45f6f168fe6
SHA15d8d42dec5d08111e020614600bbf45091c06c0b
SHA2569551431425e9680660c6baf7b67a262040fd2efceb241e4c9430560c3c1fafac
SHA5126f60bfac34ed55ff5d6ae10c6ec5511906c983e0650e5d47dac7b8a97a2e0739266cae009449cced8dff59037e2dbfc92065fbbdfde2636d13679e1629650280
-
Filesize
157KB
MD5b5355dd319fb3c122bb7bf4598ad7570
SHA1d7688576eceadc584388a179eed3155716c26ef5
SHA256b9bc7f1d8aa8498cb8b5dc75bb0dbb6e721b48953a3f295870938b27267fb5f5
SHA5120e228aa84b37b4ba587f6d498cef85aa1ffec470a5c683101a23d13955a8110e1c0c614d3e74fb0aa2a181b852bceeec0461546d0de8bcbd3c58cf9dc0fb26f5
-
Filesize
77KB
MD5f5dd9c5922a362321978c197d3713046
SHA14fbc2d3e15f8bb21ecc1bf492f451475204426cd
SHA2564494992665305fc9401ed327398ee40064fe26342fe44df11d89d2ac1cc6f626
SHA512ce818113bb87c6e38fa85156548c6f207aaab01db311a6d8c63c6d900d607d7beff73e64d717f08388ece4b88bf8b95b71911109082cf4b0c0a9b0663b9a8e99
-
Filesize
62KB
MD507392b548d2049e35981b7049dfecac7
SHA115914110949d98a5fa65705e27f9c11df9e3bab6
SHA256879839e906969afbfaaed0ef4b58d0d4276d9b4c483decc883fe6b63bd9b67ad
SHA512448272fd92a9ca6ad2da7a156f7872e2f61ef7e7af210c61893d4103960186eac9118f4d8b123e8a4d953e35bf607ef13f2d46a9553f395d3e131db8d93c4e68
-
Filesize
767KB
MD59f335e85222df2bf0135f93bae154898
SHA125fd6bc58c6c76cc35287341c13edd16efd6f5bc
SHA256a49f9f4a09c4450aa7dab31ea3028efbc80ed5e747b349eb36421554e12d72ed
SHA512a9e4303d1fee7c923651c269e72da53811a4919043dbd785f5a81d743050c8aa94698b55b1782b9b27f39f072cd55fe2fc76174d814558ad7e415dc46c44aca6
-
Filesize
3.2MB
MD5cc4cbf715966cdcad95a1e6c95592b3d
SHA1d5873fea9c084bcc753d1c93b2d0716257bea7c3
SHA256594303e2ce6a4a02439054c84592791bf4ab0b7c12e9bbdb4b040e27251521f1
SHA5123b5af9fbbc915d172648c2b0b513b5d2151f940ccf54c23148cd303e6660395f180981b148202bef76f5209acc53b8953b1cb067546f90389a6aa300c1fbe477
-
Filesize
32KB
MD5eef7981412be8ea459064d3090f4b3aa
SHA1c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
-
Filesize
1KB
MD5d67bc153fed4560ceb331087b13dae8c
SHA1bb61d6806e3c5567a335acf38bd2912fa26825aa
SHA2560c66d699d5c7490715774dab9b1a9631dfc47233c35ac952ef58fe9e59105a6a
SHA512dbb67444d9becbdfb6650bea64aa4f2641b66188a690faa4535359faefd25291fd3646a05c87536446af239a8dfdbcc8f453b1b398697bc4dcdb517955e2cb7e
-
Filesize
184KB
MD50dc9848a5fce6ec03799ac65602dc053
SHA1ddfd97a45c0db5117e047bf45d66873b53160978
SHA256adc9c63f92629ed4b860fc1855400b59a1ae73dd489fd49db326dcfcad48550e
SHA512d1b2f71000cab1115971d44c690fdb8966b9b402216b87ec1f1e8e8a1cca3ce1e1145b8d650c8ad737e6e24c59503aaf9310de3e96a0ac6596187c800013ac71
-
Filesize
4.3MB
MD511c051f93c922d6b6b4829772f27a5be
SHA142fbdf3403a4bc3d46d348ca37a9f835e073d440
SHA2560eabf135bb9492e561bbbc5602a933623c9e461aceaf6eb1ceced635e363cd5c
SHA5121cdec23486cffcb91098a8b2c3f1262d6703946acf52aa2fe701964fb228d1411d9b6683bd54527860e10affc0e3d3de92a6ecf2c6c8465e9c8b9a7304e2a4a6
-
Filesize
26KB
MD57a442bbcc4b7aa02c762321f39487ba9
SHA10fcb5bbdd0c3d3c5943e557cc2a5b43e20655b83
SHA2561dd7bba480e65802657c31e6d20b1346d11bca2192575b45eb9760a4feb468ad
SHA5123433c46c7603ae0a73aa9a863b2aecd810f8c0cc6c2cd96c71ef6bde64c275e0fceb4ea138e46a5c9bf72f66dcdea3e9551cf2103188a1e98a92d8140879b34c
-
Filesize
1.6MB
MD5c0b23815701dbae2a359cb8adb9ae730
SHA15be6736b645ed12e97b9462b77e5a43482673d90
SHA256f650d6bc321bcda3fc3ac3dec3ac4e473fb0b7b68b6c948581bcfc54653e6768
SHA512ed60384e95be8ea5930994db8527168f78573f8a277f8d21c089f0018cd3b9906da764ed6fcc1bd4efad009557645e206fbb4e5baef9ab4b2e3c8bb5c3b5d725
-
Filesize
1KB
MD55900f51fd8b5ff75e65594eb7dd50533
SHA12e21300e0bc8a847d0423671b08d3c65761ee172
SHA25614df3ae30e81e7620be6bbb7a9e42083af1ae04d94cf1203565f8a3c0542ace0
SHA512ea0455ff4cd5c0d4afb5e79b671565c2aede2857d534e1371f0c10c299c74cb4ad113d56025f58b8ae9e88e2862f0864a4836fed236f5730360b2223fde479dc
-
Filesize
1.4MB
MD5fdc8a5d96f9576bd70aa1cadc2f21748
SHA1bae145525a18ce7e5bc69c5f43c6044de7b6e004
SHA2561a6d0871be2fa7153de22be008a20a5257b721657e6d4b24da8b1f940345d0d5
SHA512816ada61c1fd941d10e6bb4350baa77f520e2476058249b269802be826bab294a9c18edc5d590f5ed6f8dafed502ab7ffb29db2f44292cb5bedf2f5fa609f49c
-
Filesize
575B
MD5efd54055b28e173ea64831fc59a0aca8
SHA1cdf18b0692a53cbeed66ee14fa0f54666cf04013
SHA256e3cf65e96fcf774320e0ae4a42d6544f1aef476cd67184432465b2c595180a99
SHA5125ecf69dbdf824a6e0221e7f953ed58889bbd76ee563e9fc7e5d95b68245d0f4af0e0ec5f13f002975b65bacf0cd29027964b9f8c4174134ed08358e41b58f4d5