Overview

overview

10

Static

static

3

2025-03-18...uk.exe

windows7-x64

7

2025-03-18...uk.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    102s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250313-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/03/2025, 01:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2025-03-18_7e8bef0e5baa023171cb93339e761b86_ryuk.exe
  • Size 11.8MB
  • Sample250318-b64pfastdv
  • SHA256 e19d00767aa93ad6e6de89901fe2a2ad389dd3824036ac9a796fdd50723e0707
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
demonwareransomware

Malware Config

Extracted

Path

  • C:\Users\Admin\Pictures\README.txt

  • demonware

Ransom Note
  • Tango Down! Seems like you got hit by DemonWare ransomware! Don't Panic, you get have your files back! DemonWare uses a basic encryption script to lock your files. This type of ransomware is known as CRYPTO. You'll need a decryption key in order to unlock your files. Your files will be deleted when the timer runs out, so you better hurry. You have 10 hours to find your key C'mon, be glad I don't ask for payment like other ransomware. Please visit: https://keys.zeznzo.nl and search for your IP/hostname to get your key. Kind regards, Zeznzo
URLs

  • https://keys.zeznzo.nl

Signatures

  • DemonWare

    Ransomware first seen in mid-2020.

    ransomwaredemonware
  • Demonware family
    demonware
  • Loads dropped DLL 36 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-03-18_7e8bef0e5baa023171cb93339e761b86_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-03-18_7e8bef0e5baa023171cb93339e761b86_ryuk.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3044
    • C:\Users\Admin\AppData\Local\Temp\2025-03-18_7e8bef0e5baa023171cb93339e761b86_ryuk.exe
      "C:\Users\Admin\AppData\Local\Temp\2025-03-18_7e8bef0e5baa023171cb93339e761b86_ryuk.exe"
      2⤵
      • Loads dropped DLL
      PID:1916

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        _Salsa20.cp39-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30442\Crypto\Cipher\_Salsa20.cp39-win_amd64.pyd
        • Size 15KB
        • SHA256 32724cd93515e542b24887c714e825d16f38dfc6c762711f566bf65c816a374c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _raw_cbc.cp39-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30442\Crypto\Cipher\_raw_cbc.cp39-win_amd64.pyd
        • Size 13KB
        • SHA256 be805b0cc32419859fbf0fc06c00fb178e49b51d67add736dc43750495fe0d06
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _raw_cfb.cp39-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30442\Crypto\Cipher\_raw_cfb.cp39-win_amd64.pyd
        • Size 14KB
        • SHA256 cae7b092bf323d5fb9bd97faa8839f9df6e946fe5cc5bf651d04e22b320fd280
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _raw_ctr.cp39-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30442\Crypto\Cipher\_raw_ctr.cp39-win_amd64.pyd
        • Size 14KB
        • SHA256 030ba5b4aafda597cc62c2f340a2b2cdc15280b1f08f52c27a6aca4e34ad3870
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _raw_ecb.cp39-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30442\Crypto\Cipher\_raw_ecb.cp39-win_amd64.pyd
        • Size 11KB
        • SHA256 ed33378b96f14afd0a181594fc6529c5fad386d62e156975151a2d3df3f3043e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _raw_ofb.cp39-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30442\Crypto\Cipher\_raw_ofb.cp39-win_amd64.pyd
        • Size 12KB
        • SHA256 b7cfa8ff75d2717e1ac01f95fa30def3f50b0661c37326f8081d281881305c21
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _BLAKE2s.cp39-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30442\Crypto\Hash\_BLAKE2s.cp39-win_amd64.pyd
        • Size 15KB
        • SHA256 7d1d5226be5f7e5a64be5c0334d1bc0654f95c4264a4ae188b1f6d3975f7f12d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _MD5.cp39-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30442\Crypto\Hash\_MD5.cp39-win_amd64.pyd
        • Size 17KB
        • SHA256 3f56f08f3ceaec70cec7b45bd69c83999446ba0dfddc6636c05f0cde2fb9b1e6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _SHA1.cp39-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30442\Crypto\Hash\_SHA1.cp39-win_amd64.pyd
        • Size 19KB
        • SHA256 da5a46d672008f2da7e016d47e8d10b8d343e386f5a1ed534d9986b9dc3ab821
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _SHA256.cp39-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30442\Crypto\Hash\_SHA256.cp39-win_amd64.pyd
        • Size 22KB
        • SHA256 2a1a9df342e7261425e7e83b674b32fc49918b970f147c728ca018cd9f3dffa5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _ghash_clmul.cp39-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30442\Crypto\Hash\_ghash_clmul.cp39-win_amd64.pyd
        • Size 14KB
        • SHA256 b2094f11fdb9ed8db33fe33e86a8c4ac96c56679fbef7a20a15fe63e505811b3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _ghash_portable.cp39-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30442\Crypto\Hash\_ghash_portable.cp39-win_amd64.pyd
        • Size 13KB
        • SHA256 9dacae80d6127546f0ceb0a36bfcaf34ac1cdc12ab30bf6165df15997a91a7c8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _scrypt.cp39-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30442\Crypto\Protocol\_scrypt.cp39-win_amd64.pyd
        • Size 13KB
        • SHA256 20a9494be4478051f62c18e98bb726be67d2d74df00c66afa754cbebf009616f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _cpuid_c.cp39-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30442\Crypto\Util\_cpuid_c.cp39-win_amd64.pyd
        • Size 11KB
        • SHA256 4aee6a9621fe296fd2608364d34bdada63a34f64606623e73466e5183e9b6f8e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _strxor.cp39-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30442\Crypto\Util\_strxor.cp39-win_amd64.pyd
        • Size 11KB
        • SHA256 c8da8ad5af56d5d5ba7d338ab23f5f78239229218a6ac2735564b5d08b2da3f3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _imaging.cp39-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30442\PIL\_imaging.cp39-win_amd64.pyd
        • Size 2.5MB
        • SHA256 c565c21a3a42752ca70a21747a9f96b46ee778ad5531c77535ea1d1be8998ac9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30442\VCRUNTIME140.dll
        • Size 99KB
        • SHA256 ff43e813785ee948a937b642b03050bb4b1c6a5e23049646b891a66f65d4c833
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30442\_bz2.pyd
        • Size 83KB
        • SHA256 fe63361f6c439c6aa26fd795af3fd805ff5b60b3b14f9b8c60c50a8f3449060a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30442\_ctypes.pyd
        • Size 122KB
        • SHA256 3b4012343ef7a266db0b077bbb239833779192840d1e2c43dfcbc48ffd4c5372
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _elementtree.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30442\_elementtree.pyd
        • Size 172KB
        • SHA256 9b9abf5672bec167b854a106eb25701433b34a0c877ed5e363202247e5bada58
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30442\_hashlib.pyd
        • Size 63KB
        • SHA256 9551431425e9680660c6baf7b67a262040fd2efceb241e4c9430560c3c1fafac
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30442\_lzma.pyd
        • Size 157KB
        • SHA256 b9bc7f1d8aa8498cb8b5dc75bb0dbb6e721b48953a3f295870938b27267fb5f5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30442\_socket.pyd
        • Size 77KB
        • SHA256 4494992665305fc9401ed327398ee40064fe26342fe44df11d89d2ac1cc6f626
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _tkinter.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30442\_tkinter.pyd
        • Size 62KB
        • SHA256 879839e906969afbfaaed0ef4b58d0d4276d9b4c483decc883fe6b63bd9b67ad
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30442\base_library.zip
        • Size 767KB
        • SHA256 a49f9f4a09c4450aa7dab31ea3028efbc80ed5e747b349eb36421554e12d72ed
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libcrypto-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30442\libcrypto-1_1.dll
        • Size 3.2MB
        • SHA256 594303e2ce6a4a02439054c84592791bf4ab0b7c12e9bbdb4b040e27251521f1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libffi-7.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30442\libffi-7.dll
        • Size 32KB
        • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        payload.exe.manifest
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30442\payload.exe.manifest
        • Size 1KB
        • SHA256 0c66d699d5c7490715774dab9b1a9631dfc47233c35ac952ef58fe9e59105a6a
        • MD5 SHA1 SHA512
        Submit Download

        pyexpat.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30442\pyexpat.pyd
        • Size 184KB
        • SHA256 adc9c63f92629ed4b860fc1855400b59a1ae73dd489fd49db326dcfcad48550e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        python39.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30442\python39.dll
        • Size 4.3MB
        • SHA256 0eabf135bb9492e561bbbc5602a933623c9e461aceaf6eb1ceced635e363cd5c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30442\select.pyd
        • Size 26KB
        • SHA256 1dd7bba480e65802657c31e6d20b1346d11bca2192575b45eb9760a4feb468ad
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        tcl86t.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30442\tcl86t.dll
        • Size 1.6MB
        • SHA256 f650d6bc321bcda3fc3ac3dec3ac4e473fb0b7b68b6c948581bcfc54653e6768
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        cp1252.enc
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30442\tcl\encoding\cp1252.enc
        • Size 1KB
        • SHA256 14df3ae30e81e7620be6bbb7a9e42083af1ae04d94cf1203565f8a3c0542ace0
        • MD5 SHA1 SHA512
        Submit Download

        tk86t.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30442\tk86t.dll
        • Size 1.4MB
        • SHA256 1a6d0871be2fa7153de22be008a20a5257b721657e6d4b24da8b1f940345d0d5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        README.txt
        • Path C:\Users\Admin\Pictures\README.txt
        • Size 575B
        • SHA256 e3cf65e96fcf774320e0ae4a42d6544f1aef476cd67184432465b2c595180a99
        • MD5 SHA1 SHA512
        Submit Download