2024-04-10_bb76d23f6b07cf5a795700a6f819f88b_ryuk

Sharing

Copy URL Twitter E-mail

General

Target

2024-04-10_bb76d23f6b07cf5a795700a6f819f88b_ryuk
Size

10.8MB
MD5

bb76d23f6b07cf5a795700a6f819f88b
SHA1

4bfe255273e5dc7ad3e6cb10b88c13700162e08b
SHA256

c1bebc95ce9f24f306413d5580bad8be1df791dd97ffcc4e23beb7e86f8ad8ca
SHA512

fde43075f03e82a62cba65a9c257295dd3e8b081f5f474d5c2f65d38453c35fd36940799ef9473ee61c038c17daacc95e1ad52d7e0731f4549da1daa5316cb44
SSDEEP

49152:572e7eIxWfXpAasCpvCKr5hO7VVzpVCVg2tKr6DIuHgaSJxB0xV19cc+3Q2NyQRD:FfMxpvC8EjaoxOWgtWSSrfmi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-04-10_bb76d23f6b07cf5a795700a6f819f88b_ryuk

Files

2024-04-10_bb76d23f6b07cf5a795700a6f819f88b_ryuk
.exe windows:6 windows x64 arch:x64

10f116eea54ab5038e5592e4470ff844

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

E:\Adlice\DiffView\x64\Debug\driverloader.pdb

Imports

ws2_32

getaddrinfo
freeaddrinfo
getnameinfo
inet_pton
WSAIoctl
WSAAddressToStringW

crypt32

CryptDecodeObject
CryptMsgGetParam
CertCloseStore
CertFindCertificateInStore
CertFreeCertificateContext
CertNameToStrW
CertGetNameStringW
CryptQueryObject
CertOpenStore
CertEnumCertificatesInStore
CertDuplicateCertificateContext
CertGetCertificateContextProperty
CryptMsgClose

advapi32

CryptGenRandom
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
DuplicateToken
GetUserNameW
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
RegLoadKeyW
RegOpenKeyExW
RegQueryInfoKeyW
RegRestoreKeyW
RegSetValueExW
RegUnLoadKeyW
RegSaveKeyExW
CreateProcessAsUserW
OpenProcessToken
AdjustTokenPrivileges
DuplicateTokenEx
LookupPrivilegeValueW
AllocateAndInitializeSid
GetAce
GetAclInformation
GetSecurityDescriptorDacl
GetSecurityDescriptorOwner
InitializeAcl
InitializeSecurityDescriptor
IsValidSecurityDescriptor
IsValidSid
SetSecurityDescriptorDacl
SetSecurityDescriptorOwner
LookupAccountSidW
RegGetKeySecurity
RegSetKeySecurity
SetEntriesInAclW
GetExplicitEntriesFromAclW
GetNamedSecurityInfoW
SetNamedSecurityInfoW
GetInheritanceSourceW
FreeInheritedFromArray
ConvertSidToStringSidW
ConvertStringSidToSidW
GetUserNameA
CopySid
GetLengthSid
GetTokenInformation
LookupAccountNameW
CheckTokenMembership
FreeSid
SetKernelObjectSecurity
SetSecurityInfo
SetTokenInformation
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
ChangeServiceConfig2W
CloseServiceHandle
ControlService
CreateServiceW
DeleteService
OpenSCManagerW
OpenServiceW
QueryServiceStatus
RegisterServiceCtrlHandlerW
SetServiceStatus
StartServiceCtrlDispatcherW
StartServiceW
RegQueryValueExW
ChangeServiceConfigW
EnumDependentServicesW
EnumServicesStatusW
QueryServiceConfigW
QueryServiceConfig2W
QueryServiceStatusEx
SetServiceObjectSecurity
CryptAcquireContextA

kernel32

CreateProcessW
SetPriorityClass
GetPriorityClass
GetProcessId
SetThreadContext
OpenProcess
ReadProcessMemory
GetModuleHandleA
GetProcAddress
CreateJobObjectW
AssignProcessToJobObject
TerminateJobObject
K32GetModuleBaseNameW
K32GetModuleFileNameExW
K32GetProcessImageFileNameW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
Thread32First
Thread32Next
DeviceIoControl
GetModuleHandleW
BackupRead
BackupSeek
CompareFileTime
GetSystemTime
SystemTimeToTzSpecificLocalTime
TzSpecificLocalTimeToSystemTime
FileTimeToSystemTime
SystemTimeToFileTime
GetDateFormatW
GetTimeFormatW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
LocalAlloc
FlushFileBuffers
GetDiskFreeSpaceW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
GetVolumeInformationW
GetVolumePathNameW
QueryDosDeviceW
ReadFile
SetFilePointerEx
WriteFile
GetVolumeNameForVolumeMountPointW
GetCompressedFileSizeW
HeapAlloc
HeapFree
GetProcessHeap
GetCurrentProcessId
VirtualAlloc
VirtualFree
lstrcmpiW
lstrlenW
IsBadReadPtr
IsBadWritePtr
lstrcmpA
lstrcpyW
RtlCaptureContext
GetEnvironmentVariableA
GetEnvironmentVariableW
GetCurrentDirectoryA
OutputDebugStringA
GetCurrentThread
SuspendThread
ResumeThread
GetThreadContext
GetVersionExA
FreeLibrary
GetModuleFileNameA
GetModuleFileNameW
LoadLibraryW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
TryEnterCriticalSection
DeleteCriticalSection
OutputDebugStringW
SetErrorMode
Sleep
GetSystemTimes
GlobalMemoryStatusEx
GetSystemInfo
FormatMessageW
DefineDosDeviceW
GetVolumePathNamesForVolumeNameW
GetTickCount
RaiseException
CreateThread
TerminateThread
VirtualAllocEx
VirtualFreeEx
WriteProcessMemory
TerminateProcess
CreateRemoteThread
Module32FirstW
Module32NextW
K32GetModuleInformation
SetHandleInformation
CreatePipe
ConnectNamedPipe
DisconnectNamedPipe
SetNamedPipeHandleState
PeekNamedPipe
CreateNamedPipeW
WaitNamedPipeW
GetOverlappedResult
CancelIo
CreateEventW
IsDebuggerPresent
DebugBreak
SetEvent
ResetEvent
WaitForMultipleObjects
SetFilePointer
QueueUserWorkItem
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStdHandle
GetModuleHandleExW
SwitchToFiber
DeleteFiber
CreateFiber
QueryPerformanceCounter
GetSystemTimeAsFileTime
ConvertFiberToThread
CompareStringW
LoadLibraryA
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
FormatMessageA
InitializeCriticalSectionEx
SleepEx
QueryPerformanceFrequency
GetSystemDirectoryA
VerifyVersionInfoA
WaitForSingleObjectEx
ExpandEnvironmentStringsA
CreateFileMappingA
SwitchToThread
GetThreadTimes
DecodePointer
EncodePointer
GetStringTypeW
GetCurrentProcess
MoveFileExW
MoveFileW
CopyFileW
GetLastError
CloseHandle
SetFileAttributesW
RemoveDirectoryW
GetFileTime
GetFileAttributesExW
GetFileAttributesW
FindNextFileW
FindFirstFileW
FindClose
DeleteFileW
CreateFileW
CreateDirectoryW
GetShortPathNameW
GetLongPathNameW
GetFullPathNameW
GetProcessTimes
WaitForSingleObject
SetLastError
DuplicateHandle
LCMapStringW
GetLocaleInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
FindResourceW
SizeofResource
InitializeSListHead
OpenThread
GetExitCodeProcess
GetStartupInfoW
VirtualQuery
RtlUnwindEx
RtlPcToFileHeader
InterlockedPushEntrySList
InterlockedFlushSList
LoadLibraryExW
HeapSize
GetCurrentDirectoryW
ExpandEnvironmentStringsW
LocalFree
GetCommandLineW
VerifyVersionInfoW
GetVersionExW
VerSetConditionMask
WideCharToMultiByte
MultiByteToWideChar
GetComputerNameW
GetSystemDirectoryW
GetTempPathW
K32GetMappedFileNameW
GetTempFileNameW
GetCPInfo
WaitForMultipleObjectsEx
ConvertThreadToFiber
HeapValidate
WriteConsoleW
ExitProcess
SetConsoleCtrlHandler
ExitThread
FreeLibraryAndExitThread
GetCommandLineA
GetACP
GetConsoleCP
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapReAlloc
HeapQueryInformation
SetStdHandle
SetCurrentDirectoryW
GetFullPathNameA
SetEndOfFile
GetTimeZoneInformation
FindFirstFileExA
FindFirstFileExW
FindNextFileA
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetEnvironmentVariableW
LoadResource
LockResource

user32

FindWindowExW
LoadStringW
FindWindowA
PostMessageW
PostThreadMessageW
FindWindowW
GetShellWindow
EnumWindows
GetWindowThreadProcessId
ExitWindowsEx
ShowWindow
GetSystemMetrics
SystemParametersInfoW
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW
SendMessageA

shell32

ShellExecuteExW
SHGetMalloc
SHGetSpecialFolderLocation
SHGetFolderPathW
ord51
CommandLineToArgvW
SHChangeNotify
ShellExecuteW
ord68

ole32

CoInitializeEx
CoUninitialize
CoCreateInstance
CoTaskMemFree
CoSetProxyBlanket
CoInitializeSecurity

oleaut32

SafeArrayGetUBound
SafeArrayDestroy
VariantClear
VariantInit
SafeArrayUnaccessData
SysFreeString
SysAllocString
GetErrorInfo
VariantChangeType
SetErrorInfo
CreateErrorInfo
SafeArrayGetLBound
SafeArrayAccessData
SysStringLen

version

VerQueryValueW
GetFileVersionInfoA
GetFileVersionInfoSizeA

wininet

InternetGetConnectedState
InternetCrackUrlW

shlwapi

PathIsSameRootW
PathIsRootW
PathIsRelativeW
PathIsPrefixW
PathIsDirectoryEmptyW
PathIsUNCW
PathIsNetworkPathW
PathIsURLW
AssocQueryStringW
UrlEscapeW
PathMakePrettyW
StrCmpIW
PathIsDirectoryW
PathGetDriveNumberW
PathQuoteSpacesW
PathGetArgsW
PathFindNextComponentW
PathFindFileNameW
PathFindExtensionW
PathFileExistsW
PathCommonPrefixW
PathCompactPathW
PathCanonicalizeW
PathBuildRootW
PathAppendW
PathAddBackslashW
StrDupW
StrCmpNIW
StrFormatByteSizeW
PathUnExpandEnvStringsW
PathUnquoteSpacesW
PathSearchAndQualifyW
PathRenameExtensionW
PathRemoveArgsW
PathRemoveFileSpecW
PathRemoveExtensionW
PathRemoveBlanksW
PathRemoveBackslashW
PathIsLFNFileSpecW

userenv

UnloadUserProfile
DestroyEnvironmentBlock
CreateEnvironmentBlock
LoadUserProfileW
GetProfilesDirectoryW

netapi32

NetApiBufferFree
NetUserGetInfo

ntdll

RtlVirtualUnwind
RtlLookupFunctionEntry
NtQueryKey
NtCreateKey
NtSetValueKey
NtDeleteValueKey
NtOpenKey
NtUnloadDriver
NtDeleteKey
NtLoadDriver
RtlInitUnicodeString

wintrust

CryptCATAdminReleaseCatalogContext
CryptCATCatalogInfoFromContext
CryptCATAdminCalcHashFromFileHandle
CryptCATAdminEnumCatalogFromHash
WinVerifyTrust
CryptCATAdminAcquireContext
CryptCATAdminReleaseContext

wsock32

WSAGetLastError
inet_ntoa
getsockname
getsockopt
ntohs
gethostbyname
gethostname
sendto
recvfrom
htonl
select
__WSAFDIsSet
getpeername
socket
setsockopt
listen
connect
closesocket
bind
accept
WSASetLastError
send
recv
getservbyname
inet_addr
htons
shutdown
WSACleanup
WSAStartup

mpr

WNetGetConnectionW

winhttp

WinHttpOpen
WinHttpSetOption
WinHttpOpenRequest
WinHttpSendRequest
WinHttpCloseHandle
WinHttpConnect
WinHttpReadData
WinHttpWriteData
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpQueryDataAvailable

iphlpapi

GetAdaptersAddresses

wtsapi32

WTSFreeMemory
WTSQueryUserToken
WTSEnumerateSessionsW

bcrypt

BCryptGenRandom

Sections

.text
Size: 7.8MB - Virtual size: 7.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 181KB - Virtual size: 217KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 464KB - Virtual size: 464KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 98KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

10f116eea54ab5038e5592e4470ff844

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

crypt32

advapi32

kernel32

user32

shell32

ole32

oleaut32

version

wininet

shlwapi

userenv

netapi32

ntdll

wintrust

wsock32

mpr

winhttp

iphlpapi

wtsapi32

bcrypt

Sections

.text Size: 7.8MB - Virtual size: 7.8MB

.rdata Size: 2.2MB - Virtual size: 2.2MB

.data Size: 181KB - Virtual size: 217KB

.pdata Size: 464KB - Virtual size: 464KB

.gfids Size: 2KB - Virtual size: 1KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 98KB - Virtual size: 98KB

.reloc Size: 59KB - Virtual size: 58KB

.text
Size: 7.8MB - Virtual size: 7.8MB

.rdata
Size: 2.2MB - Virtual size: 2.2MB

.data
Size: 181KB - Virtual size: 217KB

.pdata
Size: 464KB - Virtual size: 464KB

.gfids
Size: 2KB - Virtual size: 1KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 98KB - Virtual size: 98KB

.reloc
Size: 59KB - Virtual size: 58KB