Analysis

  • max time kernel
    142s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-05-2024 05:04

General

  • Target

    2024-05-21_b5bdb0a2c051419d31a29eac7452cec3_ryuk.exe

  • Size

    11.0MB

  • MD5

    b5bdb0a2c051419d31a29eac7452cec3

  • SHA1

    a200127d0a8a8c3b3674ef0b88ebc49ad353d31e

  • SHA256

    76505470086d997b23450c815d6e5bd865cd23dde42e8aec9adb35cf783912cd

  • SHA512

    48d3ce692c9b19a972bcb70f0a66597b5ab09c721377512e64e8164efc1918ca591b8dc6f2f9ea6fd5a412793d4d120cfbe1265b0dde0d22bd18c0ff115eb827

  • SSDEEP

    196608:KtUkI7c8ngwmDcc8YdaK5fBrsFwTb1wdTm0v+8kZsfl3M8a/CLKBazGHqE:l7SWYUuGaTbfU+xGq80CLKDB

Malware Config

Signatures

  • Detects executables packed with VMProtect. 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • VMProtect packed file 2 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-21_b5bdb0a2c051419d31a29eac7452cec3_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-21_b5bdb0a2c051419d31a29eac7452cec3_ryuk.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3400
    • C:\Users\Admin\AppData\Local\Temp\Intel.Graphics.Driver.exe
      "C:\Users\Admin\AppData\Local\Temp\Intel.Graphics.Driver.exe" -a progpow_sero -o stratum+ssl://eth.sspool.com.cn:8008 -o1 stratum+ssl://x.sspool.com.cn:8008 -u 9mVeng7mj4yVoFY2kxyNWdnzAUg6pejzAccZiqbZ76S8zwN9QCpoTDnFE45XSepoJrBEWQZWKNAzHKh1KtZUjBrrokwRMt28PkH9B2N82dAscEbpG3H4J7Vtx6f3V1dAarc.km5920 -u1 9mVeng7mj4yVoFY2kxyNWdnzAUg6pejzAccZiqbZ76S8zwN9QCpoTDnFE45XSepoJrBEWQZWKNAzHKh1KtZUjBrrokwRMt28PkH9B2N82dAscEbpG3H4J7Vtx6f3V1dAarc.km5920 -i 100 -api 127.0.0.1:24586 -no-watchdog
      2⤵
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:4952
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4032 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:4544

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\Intel.Graphics.Driver.exe

      Filesize

      10.5MB

      MD5

      e727e92ee4530a5815a0a1a41cd88dc3

      SHA1

      afbc093120deb7fd927954fddb2032980bd03bec

      SHA256

      12e7ed405c8030e40e470754e54c50a9849f94e4e7247eacda97c34c2a1a8728

      SHA512

      911e0cb1369a3b276f537995273167576c9d7fcf0fb5591fb98bd9c109a174e6046eb27b86f8f65e92228f45b5dfd1c9c82b0c081d3fd5b97f42a04de71b94ac

    • memory/4952-32-0x00007FFEAA810000-0x00007FFEAA812000-memory.dmp

      Filesize

      8KB

    • memory/4952-33-0x00007FFEAA820000-0x00007FFEAA822000-memory.dmp

      Filesize

      8KB

    • memory/4952-34-0x0000000140000000-0x00000001419D6000-memory.dmp

      Filesize

      25.8MB