Static task
static1
Behavioral task
behavioral1
Sample
2024-04-05_df4f3647f3adcda0a3cc91233517f26d_ryuk.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-04-05_df4f3647f3adcda0a3cc91233517f26d_ryuk.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-04-05_df4f3647f3adcda0a3cc91233517f26d_ryuk
-
Size
4.9MB
-
MD5
df4f3647f3adcda0a3cc91233517f26d
-
SHA1
0bbda6dfd252e5b1c1cdf4deffd8ea506bc20ec3
-
SHA256
2b82fcea3f82f62597abc74ad7598fbef101ea4de2aef63252f9776f46ae3bb9
-
SHA512
737cdf608873539d43fffa6b79289312cc92128ca9f6d5074d387c32d17d3e6aa217cb649b450288e74b7d763cf4e836025d7b400b15549c2bd2fe9aaa2d77fd
-
SSDEEP
49152:hzBIbUz/QY+ijzk4TE6bOc9uCXRy791a54byoKCvA0AFTqVg2L:Z/QYXRYFVPL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-04-05_df4f3647f3adcda0a3cc91233517f26d_ryuk
Files
-
2024-04-05_df4f3647f3adcda0a3cc91233517f26d_ryuk.exe windows:6 windows x64 arch:x64
7dd0735635bea297db39f140ba972d51
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetLogicalDriveStringsW
CreateEventW
Sleep
FormatMessageW
GetLastError
GetFileAttributesExW
OutputDebugStringW
SetEvent
GetCurrentThread
TerminateThread
QueryPerformanceFrequency
DeleteFileW
CloseHandle
GetNativeSystemInfo
ResetEvent
GetCurrentDirectoryW
GetOverlappedResult
ReplaceFileW
DeleteCriticalSection
ExitProcess
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
MoveFileW
GetDriveTypeW
IsDebuggerPresent
ConnectNamedPipe
SetUnhandledExceptionFilter
FlushFileBuffers
GetCommandLineW
LocalFree
LoadLibraryA
GetThreadPriority
GetPriorityClass
WriteConsoleW
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
FindNextFileA
FindFirstFileExA
GetCurrentThreadId
GetProcessHeap
SetFilePointerEx
ReadConsoleW
GetConsoleMode
GetConsoleCP
GetOEMCP
IsValidCodePage
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetModuleFileNameA
GetStdHandle
HeapFree
HeapReAlloc
HeapAlloc
GetACP
FreeLibraryAndExitThread
ExitThread
CreateThread
GetTimeZoneInformation
LoadLibraryExW
RtlUnwindEx
RaiseException
RtlPcToFileHeader
GetStartupInfoW
InitializeSListHead
IsProcessorFeaturePresent
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WaitForSingleObjectEx
GetCPInfo
GetStringTypeW
LCMapStringW
CompareStringW
GetModuleHandleW
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetLastError
MultiByteToWideChar
DecodePointer
EncodePointer
WideCharToMultiByte
DisconnectNamedPipe
UnmapViewOfFile
GetSystemDirectoryW
ReleaseMutex
GetFileAttributesW
CreateFileW
WaitForSingleObject
GetLocaleInfoW
FindClose
CreateMutexW
GetTempPathW
GetModuleFileNameW
SetFilePointer
InitializeCriticalSection
LeaveCriticalSection
SetThreadPriority
WaitForMultipleObjects
RemoveDirectoryW
TerminateProcess
GetModuleHandleExW
WriteFile
GetCurrentProcess
FindNextFileW
EnterCriticalSection
SetPriorityClass
FindFirstFileW
CancelIo
GetVolumeInformationW
TryEnterCriticalSection
ReadFile
SetThreadAffinityMask
CreateDirectoryW
GlobalUnlock
FreeLibrary
GetCurrentProcessId
GlobalLock
GetProcAddress
LoadLibraryW
GlobalAlloc
GlobalSize
GetModuleHandleA
HeapSize
user32
UpdateLayeredWindow
GetClientRect
SetWindowLongW
SetCursor
ToUnicode
SetClipboardData
SetCapture
DestroyCaret
LoadCursorW
FindWindowW
GetClipboardData
SetFocus
SetLayeredWindowAttributes
GetMessageTime
EnumWindows
GetForegroundWindow
TrackMouseEvent
CreateCaret
IsChild
PeekMessageW
EndPaint
CloseClipboard
CreateIconIndirect
ShowCaret
GetWindowInfo
DestroyIcon
GetCursorPos
GetCapture
OpenClipboard
GetAsyncKeyState
ShowWindow
GetActiveWindow
SetCaretPos
GetKeyboardState
DestroyCursor
GetWindowPlacement
WindowFromPoint
RegisterClassExW
GetWindowLongPtrW
MessageBeep
SetWindowTextW
UnregisterClassW
GetSystemMetrics
SendMessageW
ScreenToClient
GetIconInfo
CreateWindowExW
EnumDisplayMonitors
GetMonitorInfoW
BeginPaint
SetWindowLongPtrW
EnumChildWindows
MessageBoxW
SetWindowPos
IsWindowVisible
ReleaseDC
SetCursorPos
InvalidateRect
SetForegroundWindow
ReleaseCapture
GetParent
SystemParametersInfoW
GetDesktopWindow
RedrawWindow
EnableMenuItem
GetMessagePos
GetUpdateRgn
GetMessageExtraInfo
GetSystemMenu
DefWindowProcW
GetWindowThreadProcessId
GetWindowLongW
PostMessageW
MapVirtualKeyW
GetWindowRect
GetFocus
DestroyWindow
GetDC
AttachThreadInput
GetWindowTextW
TranslateMessage
DispatchMessageW
SendMessageTimeoutW
GetMessageW
MoveWindow
CallWindowProcW
EmptyClipboard
gdi32
CreateDIBSection
CreateCompatibleDC
StretchDIBits
CreateRectRgnIndirect
GetDeviceCaps
GetPixel
CreateRectRgn
DeleteDC
GetRegionData
SelectObject
ExcludeClipRect
RestoreDC
DeleteObject
SetMapMode
CreateBitmap
CombineRgn
SetPixelFormat
SwapBuffers
ChoosePixelFormat
SaveDC
GetOutlineTextMetricsW
CreateFontIndirectW
RemoveFontMemResourceEx
GetGlyphOutlineW
GetGlyphIndicesW
SetMapperFlags
GetTextMetricsW
EnumFontFamiliesExW
GetKerningPairsW
GetObjectW
comdlg32
GetSaveFileNameW
GetOpenFileNameW
shell32
SHGetMalloc
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteW
SHGetSpecialFolderPathW
Shell_NotifyIconW
ExtractAssociatedIconW
ole32
OleCreate
OleSetContainedObject
CoTaskMemFree
PropVariantClear
OleUninitialize
CoInitialize
RevokeDragDrop
RegisterDragDrop
DoDragDrop
CoCreateInstance
CoTaskMemAlloc
OleInitialize
oleaut32
SafeArrayAccessData
SafeArrayCreateVector
SafeArrayUnaccessData
SysAllocString
SysFreeString
VariantInit
SafeArrayDestroy
VariantClear
wininet
InternetReadFile
InternetSetOptionW
FtpOpenFileW
InternetCloseHandle
HttpSendRequestExW
HttpEndRequestW
InternetCrackUrlW
InternetSetFilePointer
HttpQueryInfoW
InternetWriteFile
HttpOpenRequestW
InternetConnectW
InternetOpenW
ws2_32
inet_ntoa
recv
getsockopt
setsockopt
send
WSAStartup
closesocket
accept
__WSAFDIsSet
select
version
VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW
shlwapi
PathStripToRootW
winmm
timeBeginPeriod
midiInUnprepareHeader
timeGetTime
timeKillEvent
midiInOpen
midiOutGetDevCapsW
midiOutPrepareHeader
midiOutOpen
midiInReset
midiInPrepareHeader
midiOutUnprepareHeader
midiInGetDevCapsW
midiInStart
midiInClose
midiInAddBuffer
midiInGetNumDevs
midiOutShortMsg
midiOutGetNumDevs
midiOutLongMsg
midiOutClose
midiInStop
imm32
ImmNotifyIME
ImmGetCompositionStringW
ImmReleaseContext
ImmGetContext
ImmSetCandidateWindow
opengl32
glReadPixels
wglCreateContext
wglGetProcAddress
glTexParameteri
glDeleteTextures
glClearColor
glGetBooleanv
glDrawArrays
wglDeleteContext
glScissor
glDisable
wglMakeCurrent
glPixelStorei
glTexSubImage2D
glGetString
glGetError
glGetIntegerv
wglShareLists
glGenTextures
glBindTexture
wglGetCurrentContext
glViewport
glEnable
glBlendFunc
glDrawElements
glClear
glTexImage2D
Sections
.text Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 79KB - Virtual size: 87KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 137KB - Virtual size: 137KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 1024B - Virtual size: 524B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 38KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ