Overview

overview

7

Static

static

3

2024-05-29...uk.exe

windows7-x64

7

2024-05-29...uk.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    29-05-2024 00:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-05-29_26e398aa13ba10b87831e40643dde9c4_ryuk.exe

  • Size

    6.1MB

  • MD5

    26e398aa13ba10b87831e40643dde9c4

  • SHA1

    c2a311d4c81be8e2c49dfad858b30fcc2129e3c5

  • SHA256

    14a2b3d5b4caabddae226aef59d07e47a323a05fbd0f95ede60b59c43d4a23d2

  • SHA512

    21c2a6ba91f7a874aa5e4a2b78c1fdc6d978c0280b92833a8f593b5ac67f64fe45c9b0cda54369b1540b03d661a1b3caee7b6a4b4435569dcb13894dc5a2fc7a

  • SSDEEP

    196608:atZKD5d9e+q2WWmQNLBBGZlrljNctfg+ieq:0ZCd9vqZQxBBG5jkrL

Score
7/10
spywarestealer

Malware Config

Signatures

  • Loads dropped DLL 14 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-29_26e398aa13ba10b87831e40643dde9c4_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-29_26e398aa13ba10b87831e40643dde9c4_ryuk.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2240
    • C:\Users\Admin\AppData\Local\Temp\2024-05-29_26e398aa13ba10b87831e40643dde9c4_ryuk.exe
      "C:\Users\Admin\AppData\Local\Temp\2024-05-29_26e398aa13ba10b87831e40643dde9c4_ryuk.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      PID:1904

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI22402\VCRUNTIME140.dll
    Filesize

    87KB

    MD5

    0e675d4a7a5b7ccd69013386793f68eb

    SHA1

    6e5821ddd8fea6681bda4448816f39984a33596b

    SHA256

    bf5ff4603557c9959acec995653d052d9054ad4826df967974efd2f377c723d1

    SHA512

    cae69a90f92936febde67dacd6ce77647cb3b3ed82bb66463cd9047e90723f633aa2fc365489de09fecdc510be15808c183b12e6236b0893af19633f6a670e66

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\_MEI22402\_bz2.pyd
    Filesize

    87KB

    MD5

    429ad9f0d7240a1eb9c108b2d7c1382f

    SHA1

    f54e1c1d31f5dd6698e47750daf48b9291b9ea69

    SHA256

    d2571d3a553ea586fb1e5695dd9745caef9f0e30ac5b876d1307678360674f38

    SHA512

    bae51da3560e0a720d45f0741f9992fe0729ead0112a614dba961c50cd6f82ddbdcf7b47aeda4f1093f6654f6db77d767ccddd59d34d2143df54121e9d486760

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\_MEI22402\base_library.zip
    Filesize

    767KB

    MD5

    06e88314be577903b9bbdfa1c678734e

    SHA1

    a6b171379ae5b05806fbe5097655efc1e7200651

    SHA256

    ff8a35b4c19e7400d759e012b1d6b2bb114def87e39a9f1535a6212f90e3596e

    SHA512

    a3e8bcf561184439d65c9c9f33707d2ff4a8b22ebb67aa99d5cd7b2cc5cc3a4fd8f8c2389bccf40916a6c7b693738e58d70995e0d46ee4817d43441ae3e7d3cc

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\_MEI22402\certifi\cacert.pem
    Filesize

    257KB

    MD5

    1ba3b44f73a6b25711063ea5232f4883

    SHA1

    1b1a84804f896b7085924f8bf0431721f3b5bdbe

    SHA256

    bb77f13d3fbec9e98bbf28ac95046b44196c7d8f55ab7720061e99991a829197

    SHA512

    0dd2a14331308b1de757d56fab43678431e0ad6f5f5b12c32fa515d142bd955f8be690b724e07f41951dd03c9fee00e604f4e0b9309da3ea438c8e9b56ca581b

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\_MEI22402\libcrypto-1_1-x64.dll
    Filesize

    2.4MB

    MD5

    8c75bca5ea3bea4d63f52369e3694d01

    SHA1

    a0c0fd3d9e5688d75386094979171dbde2ce583a

    SHA256

    8513e629cd85a984e4a30dfe4b3b7502ab87c8bc920825c11035718cb0211ea0

    SHA512

    6d80d26d91b704d50ff3ad74f76d6b1afe98af3d7a18e43011dbe3809adc305b0e382c10868328eb82c9f8b4c77bca1522bdc023c7c8712057b65f6579c9dff5

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\_MEI22402\libssl-1_1-x64.dll
    Filesize

    511KB

    MD5

    0205c08024bf4bb892b9f31d751531a0

    SHA1

    60875676bc6f2494f052769aa7d644ef4a28c5e5

    SHA256

    ebe7ffc7eb0b79e29bfc4e408ea27e9b633584dd7bc8e0b5ffc46af19263844b

    SHA512

    45da0c128bfb706cb0340ad40fbc691696f3483a0235faaac864dea4580b57e36aa5b4b55a60322081d2d2e2df788c550fd43c317582a9b6a2d66712df215bd0

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\_MEI22402\python37.dll
    Filesize

    3.6MB

    MD5

    28f9065753cc9436305485567ce894b0

    SHA1

    36ebb3188a787b63fb17bd01a847511c7b15e88e

    SHA256

    6f2f87b74aea483a0636fc5c480b294a8103b427a3daf450c1e237c2a2271b1a

    SHA512

    c3bbc50afb4a0b625aff28650befd126481018bd0b1b9a56c107e3792641679c7d1bfc8be6c9d0760fff6853f8f114b62490cd3567b06abc76ab7db3f244ab54

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\_MEI22402\sqlite3.dll
    Filesize

    1.1MB

    MD5

    05b940cff93d1f624507a1b0f436dc2f

    SHA1

    ec56591a1d698d592433fe00e3091101c0b3b55b

    SHA256

    496861a700f2879cf8ae710a6e3eedfcefc3ef6f05936ad1ea928aa1c3919abb

    SHA512

    4959a68881882c356c2997458a235da80e0f3f0b9bc9fc739967f5c79d78af41d8c5e9af4f8d6fa772f0bd1d5df0a3057ebf492dcc1fa5fa9488019e60b1babf

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\_MEI22402\unicodedata.pyd
    Filesize

    1.0MB

    MD5

    2b2156a32b7ef46906517ae49a599c16

    SHA1

    892134a20f118d9326da6c1b98c01f31d771a5d1

    SHA256

    2c5f5abf982e8b4bb5e28d217a5e437907acfb7a7e9ee96cd9fa64c4ba304418

    SHA512

    d6aa25cdfca13db260110b3f34a3d731b325efcaccde5ec36b4f88406841b4ec9c9ab88ad54944eba476772bfd69c3975d9cb1a92994b0ae8e56278353214100

    Download Submit
  • \Users\Admin\AppData\Local\Temp\_MEI22402\_hashlib.pyd
    Filesize

    38KB

    MD5

    d61618c28373d7bbdf1dec7ec2b2b1c1

    SHA1

    51f4bab84620752aedf7d71dcccb577ed518e9fd

    SHA256

    33c4d06c91166db9ece6e6ad6b9fa1344316f995f7db268bf1b7f9c08ed3e6fb

    SHA512

    ca7ca581c8d8d67f43e7858d7b4859fec1228fd1ba6e63711d508c1ab3477a071d40090fdae6ec0c8d1445e15fbb2fc60154e32e03f8398056388f1148f920de

    Download Submit
  • \Users\Admin\AppData\Local\Temp\_MEI22402\_lzma.pyd
    Filesize

    251KB

    MD5

    5e7a6b749a05dd934ee4471411420053

    SHA1

    fcd1e54011b98928edbb3820a5838568b9573453

    SHA256

    4dcd803319e24ba8c8e3d5ce2e02c209bd14a9ab07a540d6e3ae52f69d01e742

    SHA512

    ce4c5456308adbef0a9d44064aae67b2bb2a913881405ae2e69127eb7ab00a09882fa5304d80d5b3728942b0ab56d1c99132666b6c0ea8809a21396aeaadd8a2

    Download Submit
  • \Users\Admin\AppData\Local\Temp\_MEI22402\_queue.pyd
    Filesize

    27KB

    MD5

    3f536949d0fcae286b08f6a90d4c5198

    SHA1

    04877dff7e8c994e4875a1b85b7388684b97da25

    SHA256

    613c0fc66b1f2f8dccb47f24f1578137a99c5a62550719f0402f13337ad5c60a

    SHA512

    cd59a4a2d839dec513b912e33bd92281a0fdfe0a210ae972cce8b77347e000bb87c8074d8b8cbfeba75158f2b8f3d0669f778fccec0dec936f055616cedbbb4c

    Download Submit
  • \Users\Admin\AppData\Local\Temp\_MEI22402\_socket.pyd
    Filesize

    74KB

    MD5

    7c5c5e6e4ed888dd26c7aa063bb9f88e

    SHA1

    a7a3694739b27c3d34beb1a9730fc3dcbae6744a

    SHA256

    2bb4e5d711fe521e2c9a80f04d2f745f58561dc35f169e06ea17aabf27d334fe

    SHA512

    9c49c3fe740464f649a0379bdc6bc474cce6a1331f87d2ba2ab489c4545ad7cb311c757af59e8174bb3c87af438a5d47621bd9b2b4750abe128d189d14d80065

    Download Submit
  • \Users\Admin\AppData\Local\Temp\_MEI22402\_sqlite3.pyd
    Filesize

    84KB

    MD5

    553f11c6b37e39b09cfd700815df38c2

    SHA1

    b14916bb054e6503efee63d7b0cfc6e43f5cccfc

    SHA256

    34d101de287a6d1986c9c768ab7839b5cdda0dacd3848481c2aab83e4142b876

    SHA512

    445d0311a70cc1e9387219468359834e9274db978a227a910539316fab505783de246b26b0517baeb14b9656bedc5434f0be3ea881b9c2a8382a4dea4ecb64aa

    Download Submit
  • \Users\Admin\AppData\Local\Temp\_MEI22402\_ssl.pyd
    Filesize

    120KB

    MD5

    a3c9649e68206c25eff2d09a0bd323f0

    SHA1

    0f485f37ac3960da624b80667410061efe1f888d

    SHA256

    b9100db5d225c4103f781a6ea4074ce76387467c3a4bba2ac5bfc65870ab6123

    SHA512

    aeef27bf73cb7dd96b06c3403fc74c108a8a7d80aa25db35a4b1a96b8931aef63b3037a9a51075ead1e5ad1c001d6afe6f3c3e19af30344177fd562751b00d63

    Download Submit
  • \Users\Admin\AppData\Local\Temp\_MEI22402\select.pyd
    Filesize

    26KB

    MD5

    1650617f3378c5bd469906ae1256a54c

    SHA1

    dd89ffd426b6820fd79631e4c99760cb485d3a67

    SHA256

    5724cea789a2ebc148ce277ce042e27432603db2ec64e80b13d37bcb775aee98

    SHA512

    89ecbbf156e2be066c7d4e3e0ecd08c2704b6a796079517c91cf4aa6682040ba07460596aaddc5550c6ec588979dfec010fed4b87e049000caceed26e8f86ffe

    Download Submit