Analysis
-
max time kernel
93s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
10/04/2024, 12:32
General
-
Target
2024-04-10_cd24f9dfc7a51c50fcdfc545f364a029_cobalt-strike_ryuk.exe
-
Size
946KB
-
MD5
cd24f9dfc7a51c50fcdfc545f364a029
-
SHA1
854f8c661abf2134b4bc4d6ca827865d9f23f475
-
SHA256
1ddd8bca194b0f88239196c13cf54946c75103d31bdd3b7cd86130773b607072
-
SHA512
3a0d8c27001e2b5fe6da05d93d32be443b21fb96bb0a5dd18c8fba2aadd261dd8561be5819fb6785a066b6f2966a3f590d8382625c0360fcc5e6eff9ccc5b992
-
SSDEEP
24576:nTgnpwJ+RywNYMyoKcoMYwjglq46byuGv:T0dyqYxoJjQ962uG
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-10_cd24f9dfc7a51c50fcdfc545f364a029_cobalt-strike_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-10_cd24f9dfc7a51c50fcdfc545f364a029_cobalt-strike_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
661KB
MD5479eeb89e8ff1338f46479ed39bb94ff
SHA1bcd0fa1974f54dac4c2e26db2315594078f17301
SHA2561604b15e412d8cba674a7999b58d61066a2d83a3dda7708ed7b578c15cc41a27
SHA512714b5a06add92c233da860bf55055424d2eeae86c5f5c4a20752dea4e41a55505565e030a6fe914d1c9fd131e09af45d267a4c8dc52c2ed54efdf1404ec7aab5
-
Filesize
984KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
984KB
-
Filesize
384KB
-
Filesize
680KB