Overview

overview

7

Static

static

1

2024-04-23...uk.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    147s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/04/2024, 20:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-04-23_acdd40786b08124e87b701a99590239c_ryuk.exe

  • Size

    6.8MB

  • MD5

    acdd40786b08124e87b701a99590239c

  • SHA1

    0db6a4bc0f77de3f5739b146b291281f84468f2b

  • SHA256

    f8f2e731aee87d83a4fde18c5ec19c558c2b3add86e0f40b8395037bb44288d5

  • SHA512

    84e355f726eb451d4d7cdd42f7bda7b4c065163e23b3805e749179cc7cd12e1e65610bf2ad8e2a9822447737706c6e734fd7d2a6ca4f5092422a3c4f085dd9ab

  • SSDEEP

    98304:9GEKDT3NBzuBgQxlUvho0roXWtSrn2vT6:8EKDLNJuNx2v20QWts2m

Score
7/10
spywarestealer

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Downloads MZ/PE file
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 3 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    evasionspywaretrojan
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-23_acdd40786b08124e87b701a99590239c_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-23_acdd40786b08124e87b701a99590239c_ryuk.exe"
    1⤵
    • Enumerates connected drives
    • Loads dropped DLL
    • Modifies system certificate store
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2216
    • C:\Users\Admin\AppData\Local\Temp\2024-04-23_acdd40786b08124e87b701a99590239c_ryuk.exe
      C:\Users\Admin\AppData\Local\Temp\2024-04-23_acdd40786b08124e87b701a99590239c_ryuk.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=109.0.5097.62 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff95e77dce0,0x7ff95e77dcec,0x7ff95e77dcf8
      2⤵
      • Loads dropped DLL
      PID:2484
    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\2024-04-23_acdd40786b08124e87b701a99590239c_ryuk.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\2024-04-23_acdd40786b08124e87b701a99590239c_ryuk.exe" --version
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1580
    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202404232018441\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202404232018441\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe"
      2⤵
      • Executes dropped EXE
      PID:2480
    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202404232018441\assistant\assistant_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202404232018441\assistant\assistant_installer.exe" --version
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2504
      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202404232018441\assistant\assistant_installer.exe
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202404232018441\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=73.0.3856.382 --initial-client-data=0x27c,0x280,0x284,0x278,0x288,0xe74f48,0xe74f58,0xe74f64
        3⤵
        • Executes dropped EXE
        PID:2436

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\2024-04-23_acdd40786b08124e87b701a99590239c_ryuk.exe
          Filesize

          6.8MB

          MD5

          acdd40786b08124e87b701a99590239c

          SHA1

          0db6a4bc0f77de3f5739b146b291281f84468f2b

          SHA256

          f8f2e731aee87d83a4fde18c5ec19c558c2b3add86e0f40b8395037bb44288d5

          SHA512

          84e355f726eb451d4d7cdd42f7bda7b4c065163e23b3805e749179cc7cd12e1e65610bf2ad8e2a9822447737706c6e734fd7d2a6ca4f5092422a3c4f085dd9ab

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202404232018441\additional_file0.tmp
          Filesize

          1.4MB

          MD5

          e9a2209b61f4be34f25069a6e54affea

          SHA1

          6368b0a81608c701b06b97aeff194ce88fd0e3c0

          SHA256

          e950f17f4181009eeafa9f5306e8a9dfd26d88ca63b1838f44ff0efc738e7d1f

          SHA512

          59e46277ca79a43ed8b0a25b24eff013e251a75f90587e013b9c12851e5dd7283b6172f7d48583982f6a32069457778ee440025c1c754bf7bb6ce8ae1d2c3fc5

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202404232018441\assistant\assistant_installer.exe
          Filesize

          1.8MB

          MD5

          4c8fbed0044da34ad25f781c3d117a66

          SHA1

          8dd93340e3d09de993c3bc12db82680a8e69d653

          SHA256

          afe569ce9e4f71c23ba5f6e8fd32be62ac9538e397cde8f2ecbe46faa721242a

          SHA512

          a04e6fd052d2d63a0737c83702c66a9af834f9df8423666508c42b3e1d8384300239c9ddacdc31c1e85140eb1193bcfac209f218750b40342492ffce6e9da481

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202404232018441\opera_package
          Filesize

          136.1MB

          MD5

          6657e5a4abb7716d45335190ad105697

          SHA1

          eb91bc6cac6baa5c9c0828a7240bde2e6cd39dc1

          SHA256

          ccdd3f26f1f3c6867a3025699536588959d3655a1a02bcf38c0513e54c2975d2

          SHA512

          710de1bef7dd97f7d8e08f189be4167ac703916eeac5600eb91f5b43ce2aebe451819a42b22e6cedd473b8eceb13518ed650f4a0319579eba4e4cf8c0e26dfad

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2404232018442982216.dll
          Filesize

          6.2MB

          MD5

          1b7f726dd5770c91459dc63748c4c7fe

          SHA1

          88156200945c5fd905068342722bf1808a2ce3fa

          SHA256

          d5791b4db7da0fe76609a2d5aafa732c1a3357e2c524ead8b6e95879bd66ea5c

          SHA512

          e5825d051725887ea011c705c9600af777620773ef483592f8bcf192faa58a697ecfbdf7b09d1514fa0cb2e0e16ed24eb7a706bf560c5696febd0d5096d968e4

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat
          Filesize

          40B

          MD5

          2718a034fd71c6d4b20d0ce52131d2da

          SHA1

          fc6a2350a03e90e8953efae2d8c35246b4e6b6f5

          SHA256

          fc7c9338b50e415165455583763d42df97aa2edf8ecff76565bd63ced9360713

          SHA512

          12e8062fc4bb623f5b68107b04408fc1a727290fe3d7ed7f17b2825437973f5968cab80ce801835f38c2f504d9bd1d7f77dce1ccab05d7f5caafd95c6faeb9f5

          Download Submit