Behavioral task
behavioral1
Sample
4cf1ceb49fb9b5982c9a40a6fd6ce74c25caa94c6d7c7019fc88d1f2fa903c9c.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
4cf1ceb49fb9b5982c9a40a6fd6ce74c25caa94c6d7c7019fc88d1f2fa903c9c.exe
Resource
win10v2004-20220812-en
General
-
Target
8624497239.zip
-
Size
1.1MB
-
MD5
ed067c077863f3b717eb11fc9cf2a1e2
-
SHA1
51f625899277279a195d7ae3d9ad867073aeadd1
-
SHA256
9d279e5be9b5bf1654f9d611066bb5a8ea78caa1fd085d3036b59ada8456c26b
-
SHA512
3fe9cae0c3ee8db2f8ded8b9295ef3c9777eacba8bfde4c927003c4c19529e05c2398db47cf83929dc3b11eeddce33e19854ef9962e2bed72aba1ae8aeb99394
-
SSDEEP
24576:OSspRdCfPUemaW0+jHvoz77HMZ5MZgPOqd07uhie46BEWGpBHqbI:OpNCX/PwvozHHMZvhf46eWG6bI
Malware Config
Signatures
-
Royal Ransomware 1 IoCs
Processes:
resource yara_rule static1/unpack001/4cf1ceb49fb9b5982c9a40a6fd6ce74c25caa94c6d7c7019fc88d1f2fa903c9c family_royal -
Royal family
Files
-
8624497239.zip.zip
Password: infected
-
4cf1ceb49fb9b5982c9a40a6fd6ce74c25caa94c6d7c7019fc88d1f2fa903c9c.exe windows x86
Password: infected
07a5f14fabca497d51b3abff84669c94
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetQueuedCompletionStatus
CreateIoCompletionPort
SleepConditionVariableCS
ReadFile
GetFileSizeEx
GetCurrentProcess
WakeAllConditionVariable
GetProcessId
SetEndOfFile
CreateToolhelp32Snapshot
GetLastError
Process32NextW
Process32FirstW
GetNativeSystemInfo
SetFilePointerEx
MoveFileExW
FlushFileBuffers
SetLastError
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemDirectoryA
FreeLibrary
GetProcAddress
LoadLibraryA
FormatMessageA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
VirtualFree
GetEnvironmentVariableW
MultiByteToWideChar
GetACP
GetStdHandle
CancelIo
GetModuleHandleW
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
WriteConsoleW
HeapSize
GetTimeZoneInformation
GetProcessHeap
GetStringTypeW
SetEnvironmentVariableW
lstrcmpW
WideCharToMultiByte
CreateProcessW
ExitProcess
DeleteCriticalSection
WaitForSingleObject
lstrlenA
InitializeConditionVariable
InitializeCriticalSection
WaitForMultipleObjects
lstrlenW
GetCommandLineW
lstrcmpiW
CreateThread
CloseHandle
Sleep
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
DecodePointer
GetCPInfo
GetOEMCP
IsValidCodePage
FindFirstFileExW
GetFullPathNameW
GetCurrentDirectoryW
SetStdHandle
GetConsoleOutputCP
HeapReAlloc
LCMapStringW
CompareStringW
HeapAlloc
HeapFree
GetModuleFileNameW
SetConsoleCtrlHandler
GetModuleHandleExW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileInformationByHandle
GetDriveTypeW
EncodePointer
LoadLibraryExW
ExitThread
CreateFileW
FindClose
LeaveCriticalSection
WriteFile
FindNextFileW
EnterCriticalSection
FindFirstFileW
GetFileType
GetLogicalDrives
InitializeCriticalSectionAndSpinCount
RtlUnwind
RaiseException
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
user32
wsprintfW
GetUserObjectInformationW
MessageBoxW
GetProcessWindowStation
advapi32
DeregisterEventSource
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptCreateHash
CryptDestroyHash
ReportEventW
RegisterEventSourceW
CryptAcquireContextW
CryptEnumProvidersW
CryptSignHashW
shell32
CommandLineToArgvW
shlwapi
StrStrIW
ws2_32
WSASetLastError
getservbyname
getservbyport
gethostbyaddr
inet_ntoa
inet_addr
send
WSACleanup
gethostbyname
select
ntohs
getsockopt
ioctlsocket
bind
WSAIoctl
closesocket
ntohl
WSASocketW
socket
WSAAddressToStringW
htonl
htons
WSAStartup
connect
recv
setsockopt
shutdown
WSAGetLastError
crypt32
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty
iphlpapi
GetIpAddrTable
netapi32
NetShareEnum
NetApiBufferFree
rstrtmgr
RmStartSession
RmGetList
RmRegisterResources
RmShutdown
RmEndSession
bcrypt
BCryptGenRandom
Sections
.text Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 500KB - Virtual size: 499KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 78KB - Virtual size: 78KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ