General

Malware Config

Signatures

Files

• 2024-05-24_5471339b1623b31d374dd72eca8b0f18_ryuk

  .exe windows:5 windows x64 arch:x64

  bf9edc6df6d89f4a7195685e9c7a9f75

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  PDB Paths

  setup.exe.pdb

  Imports

  advapi32

  AdjustTokenPrivileges

  BuildExplicitAccessWithNameW

  BuildSecurityDescriptorW

  BuildTrusteeWithSidW

  ChangeServiceConfigW

  CloseServiceHandle

  ConvertSidToStringSidW

  ConvertStringSecurityDescriptorToSecurityDescriptorW

  ConvertStringSidToSidW

  CreateProcessAsUserW

  CreateServiceW

  CreateWellKnownSid

  DeleteService

  EventRegister

  EventUnregister

  EventWrite

  GetLengthSid

  GetNamedSecurityInfoW

  GetSidSubAuthority

  GetSidSubAuthorityCount

  GetTokenInformation

  GetTraceEnableFlags

  GetTraceEnableLevel

  GetTraceLoggerHandle

  GetUserNameW

  ImpersonateNamedPipeClient

  InitializeSid

  IsValidSid

  LookupPrivilegeValueW

  OpenProcessToken

  OpenSCManagerW

  OpenServiceW

  QueryServiceConfigW

  RegCloseKey

  RegCreateKeyExW

  RegDeleteKeyExW

  RegDeleteValueW

  RegEnumKeyExW

  RegEnumValueA

  RegEnumValueW

  RegLoadKeyW

  RegOpenKeyExW

  RegQueryInfoKeyW

  RegQueryValueExW

  RegSetValueExW

  RegUnLoadKeyW

  RegisterTraceGuidsW

  RevertToSelf

  SetEntriesInAclW

  SetNamedSecurityInfoW

  SetSecurityInfo

  SystemFunction036

  TraceEvent

  UnregisterTraceGuids

  dbghelp

  SymCleanup

  SymFromAddr

  SymGetLineFromAddr64

  SymGetSearchPathW

  SymInitialize

  SymSetOptions

  SymSetSearchPathW

  shell32

  CommandLineToArgvW

  ord680

  SHChangeNotify

  SHGetFolderPathW

  SHGetKnownFolderPath

  SHOpenWithDialog

  SHQueryUserNotificationState

  ShellExecuteExW

  ShellExecuteW

  user32

  AllowSetForegroundWindow

  CallNextHookEx

  CharUpperW

  CreateWindowExW

  DefWindowProcW

  DestroyWindow

  DispatchMessageW

  EqualRect

  GetForegroundWindow

  GetMessageW

  GetMonitorInfoW

  GetQueueStatus

  GetSystemMetrics

  GetWindowLongPtrW

  GetWindowLongW

  GetWindowRect

  GetWindowThreadProcessId

  IntersectRect

  KillTimer

  LoadIconW

  MessageBoxW

  MonitorFromRect

  MonitorFromWindow

  MoveWindow

  MsgWaitForMultipleObjectsEx

  PeekMessageW

  PostMessageW

  PostQuitMessage

  RegisterClassExW

  RegisterClassW

  SendMessageW

  SetForegroundWindow

  SetTimer

  SetWindowLongPtrW

  SetWindowsHookExW

  TranslateMessage

  UnhookWindowsHookEx

  UnregisterClassW

  ws2_32

  ntohl

  kernel32

  AcquireSRWLockExclusive

  AcquireSRWLockShared

  AssignProcessToJobObject

  AttachConsole

  CloseHandle

  CompareStringW

  ConnectNamedPipe

  CopyFileW

  CreateDirectoryW

  CreateEventW

  CreateFileA

  CreateFileMappingW

  CreateFileW

  CreateIoCompletionPort

  CreateMutexW

  CreateNamedPipeW

  CreateProcessW

  CreateSemaphoreW

  CreateThread

  CreateToolhelp32Snapshot

  DecodePointer

  DeleteCriticalSection

  DeleteFileW

  DeleteProcThreadAttributeList

  DisconnectNamedPipe

  DuplicateHandle

  EncodePointer

  EnterCriticalSection

  EnumSystemLocalesW

  ExitProcess

  ExitThread

  ExpandEnvironmentStringsW

  FileTimeToSystemTime

  FindClose

  FindFirstFileExW

  FindNextFileW

  FindResourceW

  FlsAlloc

  FlsSetValue

  FlushFileBuffers

  FlushViewOfFile

  FormatMessageA

  FreeConsole

  FreeEnvironmentStringsW

  FreeLibrary

  FreeLibraryAndExitThread

  GetACP

  GetCPInfo

  GetCommandLineA

  GetCommandLineW

  GetConsoleDisplayMode

  GetConsoleMode

  GetConsoleOutputCP

  GetCurrentDirectoryW

  GetCurrentProcess

  GetCurrentProcessId

  GetCurrentThread

  GetCurrentThreadId

  GetDateFormatW

  GetDriveTypeW

  GetEnvironmentStringsW

  GetEnvironmentVariableW

  GetExitCodeProcess

  GetFileAttributesExW

  GetFileAttributesW

  GetFileInformationByHandle

  GetFileInformationByHandleEx

  GetFileSizeEx

  GetFileTime

  GetFileType

  GetFullPathNameW

  GetLastError

  GetLocalTime

  GetLocaleInfoW

  GetLogicalProcessorInformation

  GetLongPathNameW

  GetModuleFileNameW

  GetModuleHandleA

  GetModuleHandleExW

  GetModuleHandleW

  GetNativeSystemInfo

  GetOEMCP

  GetPriorityClass

  GetProcAddress

  GetProcessHandleCount

  GetProcessHeap

  GetProcessId

  GetProcessIoCounters

  GetProcessTimes

  GetProductInfo

  GetQueuedCompletionStatus

  GetShortPathNameW

  GetStartupInfoW

  GetStdHandle

  GetStringTypeW

  GetSystemDefaultLCID

  GetSystemDirectoryW

  GetSystemInfo

  GetSystemTimeAsFileTime

  GetTempPathW

  GetThreadContext

  GetThreadId

  GetThreadLocale

  GetThreadPreferredUILanguages

  GetThreadPriority

  GetTickCount

  GetTimeFormatW

  GetTimeZoneInformation

  GetUserDefaultLCID

  GetUserDefaultLangID

  GetVersionExW

  GetWindowsDirectoryW

  GlobalAlloc

  GlobalFree

  HeapAlloc

  HeapDestroy

  HeapFree

  HeapReAlloc

  HeapSetInformation

  HeapSize

  InitOnceExecuteOnce

  InitializeConditionVariable

  InitializeCriticalSection

  InitializeCriticalSectionAndSpinCount

  InitializeCriticalSectionEx

  InitializeProcThreadAttributeList

  InitializeSListHead

  InitializeSRWLock

  IsDebuggerPresent

  IsProcessorFeaturePresent

  IsValidCodePage

  IsValidLocale

  IsWow64Process

  K32GetPerformanceInfo

  K32GetProcessMemoryInfo

  K32QueryWorkingSetEx

  LCMapStringW

  LeaveCriticalSection

  LoadLibraryExA

  LoadLibraryExW

  LoadLibraryW

  LoadResource

  LocalFree

  LockFileEx

  LockResource

  MapViewOfFile

  MoveFileExW

  MoveFileW

  MultiByteToWideChar

  OpenMutexW

  OpenProcess

  OutputDebugStringA

  OutputDebugStringW

  PeekNamedPipe

  PostQueuedCompletionStatus

  Process32FirstW

  Process32NextW

  QueryFullProcessImageNameW

  QueryPerformanceCounter

  QueryPerformanceFrequency

  QueryThreadCycleTime

  QueueUserAPC

  RaiseException

  ReadConsoleW

  ReadFile

  ReadProcessMemory

  RegisterWaitForSingleObject

  ReleaseMutex

  ReleaseSRWLockExclusive

  ReleaseSRWLockShared

  ReleaseSemaphore

  RemoveDirectoryW

  ReplaceFileW

  ResetEvent

  ResumeThread

  RtlCaptureContext

  RtlCaptureStackBackTrace

  RtlLookupFunctionEntry

  RtlPcToFileHeader

  RtlUnwind

  RtlUnwindEx

  RtlVirtualUnwind

  SetConsoleCtrlHandler

  SetCurrentDirectoryW

  SetEndOfFile

  SetEnvironmentVariableW

  SetEvent

  SetFileAttributesW

  SetFileInformationByHandle

  SetFilePointer

  SetFilePointerEx

  SetFileTime

  SetHandleInformation

  SetLastError

  SetNamedPipeHandleState

  SetPriorityClass

  SetProcessShutdownParameters

  SetStdHandle

  SetThreadPriority

  SetUnhandledExceptionFilter

  SizeofResource

  Sleep

  SleepConditionVariableSRW

  SleepEx

  SuspendThread

  SwitchToThread

  SystemTimeToTzSpecificLocalTime

  TerminateProcess

  TlsAlloc

  TlsFree

  TlsGetValue

  TlsSetValue

  TransactNamedPipe

  TryAcquireSRWLockExclusive

  UnhandledExceptionFilter

  UnlockFileEx

  UnmapViewOfFile

  UnregisterWaitEx

  UpdateProcThreadAttribute

  VerSetConditionMask

  VerifyVersionInfoW

  VirtualAlloc

  VirtualAllocEx

  VirtualFree

  VirtualProtect

  VirtualQuery

  VirtualQueryEx

  WTSGetActiveConsoleSessionId

  WaitForMultipleObjects

  WaitForSingleObject

  WaitForSingleObjectEx

  WaitNamedPipeW

  WakeAllConditionVariable

  WakeConditionVariable

  WideCharToMultiByte

  Wow64GetThreadContext

  WriteConsoleW

  WriteFile

  WriteProcessMemory

  lstrcmpiW

  winhttp

  WinHttpAddRequestHeaders

  WinHttpCloseHandle

  WinHttpConnect

  WinHttpCrackUrl

  WinHttpGetProxyForUrl

  WinHttpOpen

  WinHttpOpenRequest

  WinHttpQueryHeaders

  WinHttpReadData

  WinHttpReceiveResponse

  WinHttpSendRequest

  WinHttpSetOption

  WinHttpSetStatusCallback

  WinHttpSetTimeouts

  WinHttpWriteData

  ole32

  CoAllowSetForegroundWindow

  CoCreateInstance

  CoInitializeEx

  CoRegisterInitializeSpy

  CoRevokeInitializeSpy

  CoSetProxyBlanket

  CoTaskMemAlloc

  CoTaskMemFree

  CoUninitialize

  PropVariantClear

  wtsapi32

  WTSFreeMemory

  WTSQuerySessionInformationW

  WTSQueryUserToken

  netapi32

  NetApiBufferFree

  NetGetJoinInformation

  version

  GetFileVersionInfoSizeW

  GetFileVersionInfoW

  VerQueryValueW

  userenv

  CreateEnvironmentBlock

  DestroyEnvironmentBlock

  propsys

  InitPropVariantFromCLSID

  shlwapi

  ord437

  PathMatchSpecW

  UrlCanonicalizeW

  winmm

  timeBeginPeriod

  timeEndPeriod

  timeGetTime

  urlmon

  CreateURLMonikerEx

  oleaut32

  SysAllocString

  SysAllocStringLen

  SysFreeString

  SysStringLen

  VariantClear

  VariantInit

  ncrypt

  NCryptCreatePersistedKey

  NCryptExportKey

  NCryptFinalizeKey

  NCryptFreeObject

  NCryptGetProperty

  NCryptImportKey

  NCryptIsAlgSupported

  NCryptOpenStorageProvider

  NCryptSignHash

  Exports

  Exports

  GetHandleVerifier

  Sections

  .text

  Size: 3.0MB - Virtual size: 3.0MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 636KB - Virtual size: 636KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 47KB - Virtual size: 113KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 99KB - Virtual size: 98KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .00cfg

  Size: 512B - Virtual size: 40B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .retplne

  Size: 512B - Virtual size: 48B

  .tls

  Size: 512B - Virtual size: 345B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  CPADinfo

  Size: 512B - Virtual size: 56B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  _RDATA

  Size: 512B - Virtual size: 148B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 427KB - Virtual size: 427KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 584KB - Virtual size: 588KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE