Static task
static1
Behavioral task
behavioral1
Sample
NEAS.2023-09-29_7fc43448994e2bf971425ea27b6f2365_ryuk.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
NEAS.2023-09-29_7fc43448994e2bf971425ea27b6f2365_ryuk.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.2023-09-29_7fc43448994e2bf971425ea27b6f2365_ryuk.exe
-
Size
831KB
-
MD5
7fc43448994e2bf971425ea27b6f2365
-
SHA1
4cd7c38c3286d6c63f1c8ac3e6c34dcb90b9ebf9
-
SHA256
bc3c00ae5f1773f1ab0ecb3641c3bc644ff6aa81f7be47368a308810134259b1
-
SHA512
39165fcb50655fe93d0a3e4fec0f50730e9fec64a8c0bfa43af6fdb3195be62c80c8f199b3a004981f1c6025cef6fa75f5ff5fb465b202a767d92d751d96d4f9
-
SSDEEP
12288:4vtsxqjbDSfqoTFKomZxy32Pi9tblVLsP4GYslekgNkgr:41sxYfIqoTMYmqXPE4GokgNkgr
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.2023-09-29_7fc43448994e2bf971425ea27b6f2365_ryuk.exe
Files
-
NEAS.2023-09-29_7fc43448994e2bf971425ea27b6f2365_ryuk.exe.exe windows:6 windows x64
b689d42877bf746592c5ad873abef46c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
TlsGetValue
TlsFree
SetLastError
TlsAlloc
CloseHandle
WaitForSingleObject
WriteFile
GetLastError
GetFileType
SetFilePointer
GetEnvironmentVariableA
FormatMessageA
LoadLibraryA
GetThreadLocale
GetStdHandle
IsDebuggerPresent
GetProcAddress
GetModuleHandleA
FreeLibrary
CreateFileA
VirtualAlloc
GetSystemInfo
VirtualFree
GetCurrentThreadId
SetErrorMode
GetCommandLineA
GetACP
SetConsoleCtrlHandler
SetEndOfFile
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
ExitThread
InitializeCriticalSection
CreateEventA
SetEvent
TerminateThread
TlsSetValue
DeleteFileA
GetVersionExA
SetThreadPriority
CreateProcessA
GetTempPathA
GetTempFileNameA
GetFullPathNameA
GetFullPathNameW
GetSystemDefaultLangID
GetUserDefaultLangID
GetFileInformationByHandle
MapViewOfFile
CreateFileMappingA
OpenFileMappingA
UnmapViewOfFile
GetHandleInformation
IsBadReadPtr
GetSystemTimeAsFileTime
GetCurrentProcess
FlushFileBuffers
QueryPerformanceCounter
GetCurrentProcessId
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
TerminateProcess
LoadLibraryExA
GetModuleHandleExA
GetModuleFileNameA
VirtualQuery
GetCurrentThread
ReadFile
RaiseException
GetFileSizeEx
WriteConsoleW
GetModuleFileNameW
RtlUnwindEx
InitializeCriticalSectionAndSpinCount
LoadLibraryExW
GetModuleHandleExW
ExitProcess
GetConsoleOutputCP
GetConsoleMode
SetStdHandle
QueryPerformanceFrequency
GetCommandLineW
HeapFree
HeapAlloc
CompareStringW
LCMapStringW
HeapReAlloc
HeapSize
WideCharToMultiByte
SetFilePointerEx
MultiByteToWideChar
GetFileAttributesExW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetStringTypeW
GetProcessHeap
CreateFileW
Sleep
imagehlp
SymCleanup
StackWalk64
SymInitialize
advapi32
SystemFunction036
Sections
.text Size: 662KB - Virtual size: 662KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 122KB - Virtual size: 122KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 12.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.trace Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gehcont Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ