Malware analysis

HelloKitty: The ransomware affecting CD Projekt Red and Cyberpunk 2077

HelloKitty is one of the recent ransomware samples used to compromise CD Projekt Red and Cyberpunk. The name HelloKitty comes from the group that attacked CD Projekt Red and Cyberpunk 2077 on February 9, 2021. CD Projekt Red is a video game development studio behind Cyberpunk 2077 and The Witcher trilogy. It disclosed a ransomware incident that impacted its internal network and a large group of critical assets including the source code of its popular games.

"An unidentified actor gained unauthorized access to our internal network, collected certain data belonging to CD Projekt capital group, and left a ransom note the content of which we release to the public. Although some devices in our network have been encrypted, our backups remain intact. We have already secured our IT infrastructure and begun restoring the data," the company said in a statement it released.

Become a certified reverse engineer!

Get live, hands-on malware analysis training from anywhere, and become a Certified Reverse Engineering Analyst.

Start Learning

Figure 1: Official statement from CD Projekt Red on Twitter.

An overview of the HelloKitty ransomware

HelloKitty ransomware has been observed since November 2020 and targeted other large companies around the world, including the Brazilian power company CEMIG and a French IT service firm as well.

Figure 2: Ransomware notes dropped by HelloKitty ransomware.

By analyzing the HelloKitty sample, we can see that the timestamp and creation date suggests it was compiled in November 2020 and the export table updated on February 6, 2021, three days before the CD Projekt Red incident.

Figure 3: Timestamp of EAT and binary compilation.

The malware uses crypto calls from ADVAPI32.dll to encrypt the victims’ files and also deletes all the files available in the trash (SHEmptyRecycleBinA).

ADVAPI32.dll CryptReleaseContext

CryptAcquireContextW

CryptGenRandom

SHELL32.dll SHEmptyRecycleBinA

Digging into the details of HelloKitty

The name HelloKitty comes from its mutex name called “HelloKittyMutex” created when the malware is executed. Figure 4 below shows the blocks of code responsible for creating the mutex: ds: CreateMutexW.

Figure 4: HelloKittyMutex created when the ransomware is executed.

Curiously, the ransomware opens a shell terminal exhibiting the output while it is executed. This is not a common behavior observed in many pieces of ransomware, but that can help to identify samples of this particular family of threats.

Figure 5: Output of the ransomware activity presented during run-time.

First, HelloKitty searches for files inside the system folder tree and then encrypts all the files adding a new extension: .crypted. Also, a ransom note file dubbed “read_me_lkdtt.txt” file is dropped into every folder it accesses.

Figure 6: File encryption and ransomware note. HelloKitty ransomware.

Additionally, HelloKitty repeatedly runs taskkill.exe to terminate processes associated with security software, email servers, database servers, backup software and accounting software. some commands are presented below.

"C:\Windows\System32\taskkill.exe" /f /im postg*

"C:\Windows\System32\net.exe" stop MSSQLServerADHelper100

Figure 7: Part of the services stopped by HelloKitty ransomware.

During the encryption process, if the ransomware finds locked files, it then encrypts those files using the Windows Restart Manager API to instantly terminate processes or Windows services that are in use by other applications.

The ransom note is customized, including the volume of compromised and exfiltrated data, and also the name of the target firm. This is a clear indicator that criminals navigate for days through the internal infrastructure, compromising a lot of systems, and finally deploying the ransomware to terminate the kill chain.

Figure 8: Ransomware note with instructions and onion link.

Finally, the criminals are waiting for a contact from the victim’s side in a chat available over the TOR network. This is a normal behavior used for recent ransomware groups such as Ragnar Locker.

Figure 9: HelloKitty chat available over the Tor network.

Become a certified reverse engineer!

Get live, hands-on malware analysis training from anywhere, and become a Certified Reverse Engineering Analyst.

Start Learning

Dealing with HelloKitty

Criminals compromise victims’ networks and exfiltrate confidential documents while moving laterally in the infrastructure. Once the domain controller (DC) is compromised, crooks spread the ransomware throughout the infrastructure to end the infection chain and thus damage all devices upon the active directory and other valuable assets available on the network.

In this sense, monitoring the use of endpoint security solutions, updated antivirus and the increasing use of canary files are some mechanisms that could prevent the dissemination of these kinds of threats through a corporative network.

 

Sources:

HelloKitty ransomware, Computer Weekly

Ragar Locker, Segurança Informática

Ransomware deletion methods, Infosec Institute