Analysis
-
max time kernel
145s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
-
submitted
23/02/2024, 06:00
General
-
Target
2024-02-23_dca467cd1d74883c57b19cb088e3a9de_cobalt-strike_ryuk.exe
-
Size
796KB
-
MD5
dca467cd1d74883c57b19cb088e3a9de
-
SHA1
17ba4931a201913912e789d774d8d9368abdddb9
-
SHA256
ed67715c7472a3ee806cc2c48f3e466632e33d5724a78d8b56d6277175bd2234
-
SHA512
5ae267c8ec99ad58915942fc4331edc772260ed13f03cd142fe82a0959d840a5ea07c4e2afdc791bcc9853bb4fa238fffa3863489b183536991dbf017007d39e
-
SSDEEP
24576:IANw243E8S+LbzQkWWbCzLLB+lMP1NFzSRY:Iew258FD5nb2LLPrFmRY
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_dca467cd1d74883c57b19cb088e3a9de_cobalt-strike_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-23_dca467cd1d74883c57b19cb088e3a9de_cobalt-strike_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
828KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
828KB