Analysis
- max time kernel
119s - max time network
123s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
04/04/2024, 11:03
General
- Target 2024-04-04_34af67be694ec42b894b352bebe60301_cobalt-strike_ryuk.exe
- Size 655KB
- Sample240404-m552nadb3x
- SHA256 962a8376f1e8428aa5ec33675ae08c680a64ca715256617274abaa8a0e68276b
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-04_34af67be694ec42b894b352bebe60301_cobalt-strike_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-04_34af67be694ec42b894b352bebe60301_cobalt-strike_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2760-0-0x00000000001D0000-0x0000000000230000-memory.dmp
memory/2760-2-0x0000000140000000-0x00000001400AA000-memory.dmp
memory/2760-8-0x00000000001D0000-0x0000000000230000-memory.dmp
memory/2760-10-0x00000000001D0000-0x0000000000230000-memory.dmp
memory/2760-7-0x00000000001D0000-0x0000000000230000-memory.dmp
memory/2760-12-0x0000000140000000-0x00000001400AA000-memory.dmp