489eff4c57afd81d49f50b84134c405d8723e92d0b5c1ed776fa246a735d6786

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07-05-2024 11:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-07_9518fac20bfdbbc4931e459b19b3368b_ryuk.exe
Size

18.0MB
MD5

9518fac20bfdbbc4931e459b19b3368b
SHA1

c4583f6df58e591c0b2d64ca41d1ac5d553e0090
SHA256

489eff4c57afd81d49f50b84134c405d8723e92d0b5c1ed776fa246a735d6786
SHA512

5ee30d4ed1cdb2f9c971d82bb135454336e2421cc1fda70481bce2d3920b73f9da0a13debbb2e1836af08e16d5e0d90b426124067c8069e669be73ec9d6b7817
SSDEEP

393216:xrn/z3FHAL4CmYYIK3S8aHPCM2k5PnfNkz9:Bn/7G8bIKi8aaYne

Score

9^/10

Malware Config

Signatures

Detects executables Discord URL observed in first stage droppers 3 IoCs

resource	yara_rule
behavioral1/files/0x0037000000013a3d-26.dat	INDICATOR_SUSPICIOUS_EXE_DiscordURL
behavioral1/memory/2796-43-0x0000000140000000-0x0000000142718000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DiscordURL
behavioral1/memory/2796-44-0x0000000140000000-0x0000000142718000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables containing URLs to raw contents of a Github gist 3 IoCs

resource	yara_rule
behavioral1/files/0x0037000000013a3d-26.dat	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral1/memory/2796-43-0x0000000140000000-0x0000000142718000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral1/memory/2796-44-0x0000000140000000-0x0000000142718000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Detects executables packed with Enigma 3 IoCs

resource	yara_rule
behavioral1/files/0x0037000000013a3d-26.dat	INDICATOR_EXE_Packed_Enigma
behavioral1/memory/2796-43-0x0000000140000000-0x0000000142718000-memory.dmp	INDICATOR_EXE_Packed_Enigma
behavioral1/memory/2796-44-0x0000000140000000-0x0000000142718000-memory.dmp	INDICATOR_EXE_Packed_Enigma

Executes dropped EXE 2 IoCs

pid	Process
2796	Koala-Multitool.exe
1160	Process not Found

Loads dropped DLL 1 IoCs

pid	Process
2036	2024-05-07_9518fac20bfdbbc4931e459b19b3368b_ryuk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 2796	2036	2024-05-07_9518fac20bfdbbc4931e459b19b3368b_ryuk.exe	29
PID 2036 wrote to memory of 2796	2036	2024-05-07_9518fac20bfdbbc4931e459b19b3368b_ryuk.exe	29
PID 2036 wrote to memory of 2796	2036	2024-05-07_9518fac20bfdbbc4931e459b19b3368b_ryuk.exe	29

C:\Users\Admin\AppData\Local\Temp\2024-05-07_9518fac20bfdbbc4931e459b19b3368b_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-07_9518fac20bfdbbc4931e459b19b3368b_ryuk.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Users\Admin\AppData\Local\Temp\dankware_2036\Koala-Multitool.exe
  "C:\Users\Admin\AppData\Local\Temp\2024-05-07_9518fac20bfdbbc4931e459b19b3368b_ryuk.exe"
  2⤵
  - Executes dropped EXE
  PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\dankware_2036\Koala-Multitool.exe

Filesize
45.7MB

MD5
a0a0c1085b8ab703b6de4b8ae36576b5

SHA1
ae45fe22b76e003687e043f9a7fa048444dc538c

SHA256
e1a290dafadc574a6b8cd534cd109a43eb6bf264114ea0633cc93238387a3c85

SHA512
dc32230a0d059328b8c469e97007be54908127932b399555e3da6517cd1f95b42731618d5244ce7ae05628d2925bb58f449d166df7eabb7969b2c742e31a74db

Download Submit
memory/2036-36-0x0000000001C80000-0x0000000004398000-memory.dmp

Filesize
39.1MB

Download
memory/2036-46-0x0000000001C80000-0x0000000004398000-memory.dmp

Filesize
39.1MB

Download
memory/2796-31-0x0000000180000000-0x00000001805D6000-memory.dmp

Filesize
5.8MB

Download
memory/2796-38-0x0000000077750000-0x00000000778F9000-memory.dmp

Filesize
1.7MB

Download
memory/2796-40-0x0000000077750000-0x00000000778F9000-memory.dmp

Filesize
1.7MB

Download
memory/2796-39-0x0000000077750000-0x00000000778F9000-memory.dmp

Filesize
1.7MB

Download
memory/2796-37-0x00000000777A1000-0x00000000777A2000-memory.dmp

Filesize
4KB

Download
memory/2796-42-0x0000000180000000-0x00000001805D6000-memory.dmp

Filesize
5.8MB

Download
memory/2796-43-0x0000000140000000-0x0000000142718000-memory.dmp

Filesize
39.1MB

Download
memory/2796-44-0x0000000140000000-0x0000000142718000-memory.dmp

Filesize
39.1MB

Download
memory/2796-45-0x0000000077750000-0x00000000778F9000-memory.dmp

Filesize
1.7MB

Download