Static task
static1
Behavioral task
behavioral1
Sample
2024-05-31_8da413f8259a8f0b8ed310a9478692d5_ryuk.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-31_8da413f8259a8f0b8ed310a9478692d5_ryuk.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-05-31_8da413f8259a8f0b8ed310a9478692d5_ryuk
-
Size
1.7MB
-
MD5
8da413f8259a8f0b8ed310a9478692d5
-
SHA1
4c866f825147242a944da6c4f16436e8171cbf0c
-
SHA256
7d2c242093e5a1d878cd193500a1f2f525a94cf23e72a376628f883dcde35c22
-
SHA512
f618713102a11ef85afc2c800463932b6b42c4630a0cfd6686e005638ce3b196f34e328087c451faace44469a8afd2b5708c409aa6d607129087af1dbf6c31e3
-
SSDEEP
24576:OynspMse4S1q9bV4p3AT361GxiG8uRj6o3TF/jlcdjn0Ra4QcrCmC:OybseXq9bV4p326108sbFlmjnEa7cr9
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-05-31_8da413f8259a8f0b8ed310a9478692d5_ryuk
Files
-
2024-05-31_8da413f8259a8f0b8ed310a9478692d5_ryuk.exe windows:6 windows x64 arch:x64
65b2205554b8358d4a158b3d935f4124
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetSystemInfo
VirtualQuery
LocalFree
LocalAlloc
LoadLibraryExA
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
DeleteCriticalSection
DecodePointer
RaiseException
GetLastError
InitializeCriticalSectionEx
GetUserDefaultLangID
SetFileAttributesA
GetFileAttributesA
DeleteFileA
CreateFileA
InitializeCriticalSection
CreateDirectoryW
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
GetStdHandle
GetVersionExW
MultiByteToWideChar
GetNativeSystemInfo
LoadLibraryW
GetProcAddress
VerSetConditionMask
GlobalMemoryStatusEx
FreeLibrary
WideCharToMultiByte
VerifyVersionInfoW
CreateDirectoryA
WaitForSingleObject
GetCurrentThreadId
GetExitCodeThread
GetConsoleMode
SetEvent
CloseHandle
OpenThread
SetThreadAffinityMask
GetCurrentProcess
SetThreadPriority
GetCurrentThread
SystemTimeToFileTime
GetModuleHandleW
GetSystemTime
GetProcessTimes
WaitForMultipleObjects
CreateEventW
SizeofResource
GetModuleFileNameW
GetProcessId
GetModuleHandleA
K32GetProcessMemoryInfo
LockResource
GetProcessIoCounters
LoadResource
FindResourceW
GetThreadTimes
ResetEvent
OpenFileMappingW
UnmapViewOfFile
MapViewOfFile
SetHandleInformation
CreatePipe
CreateProcessW
GetPrivateProfileStringA
FormatMessageW
GetStringTypeW
QueryPerformanceCounter
QueryPerformanceFrequency
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DuplicateHandle
WaitForSingleObjectEx
Sleep
EncodePointer
GetCPInfo
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
CompareStringW
LCMapStringW
GetLocaleInfoW
SwitchToThread
FindClose
FindNextFileW
FindFirstFileW
GetFileAttributesW
LoadLibraryExW
SetThreadErrorMode
GetModuleHandleExW
IsDebuggerPresent
OutputDebugStringW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
CreateTimerQueue
SignalObjectAndWait
CreateThread
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
RegisterWaitForSingleObject
UnregisterWait
FreeLibraryAndExitThread
VirtualAlloc
VirtualFree
VirtualProtect
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RtlPcToFileHeader
RtlUnwindEx
GetACP
SetConsoleCtrlHandler
GetFullPathNameW
GetFullPathNameA
ReadFile
SetStdHandle
GetFileType
HeapAlloc
HeapFree
ExitThread
HeapReAlloc
ExitProcess
WriteFile
GetCommandLineA
GetCommandLineW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
GetConsoleCP
GetTimeZoneInformation
IsValidCodePage
GetOEMCP
SetFilePointerEx
HeapSize
GetDriveTypeW
ReadConsoleW
GetProcessHeap
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetEnvironmentVariableW
OutputDebugStringA
FindFirstFileExW
WriteConsoleW
CreateFileW
GetCurrentDirectoryW
SetEndOfFile
SetErrorMode
FormatMessageA
K32GetModuleBaseNameA
user32
WaitForInputIdle
GetSystemMetrics
GetClientRect
WindowFromPoint
shell32
FindExecutableW
SHGetKnownFolderPath
ShellExecuteW
winmm
timeEndPeriod
timeBeginPeriod
shlwapi
PathFindFileNameW
PathFileExistsW
PathStripToRootW
PathIsRelativeA
PathIsUNCW
PathRemoveFileSpecW
PathIsDirectoryW
PathFindExtensionW
PathIsRelativeW
PathCombineW
d3d11
D3D11CreateDevice
dxgi
CreateDXGIFactory
avifil32
AVIFileGetStream
AVIFileInfoW
AVIFileExit
AVIStreamGetFrameOpen
AVIFileInit
AVIStreamGetFrameClose
AVIStreamRead
AVIStreamInfoW
AVIFileRelease
AVIFileOpenW
AVIStreamRelease
AVIStreamGetFrame
d3d9
Direct3DCreate9Ex
dxva2
DXVA2CreateDirect3DDeviceManager9
advapi32
SystemFunction036
RegEnumKeyExW
RegQueryInfoKeyW
AllocateAndInitializeSid
FreeSid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetEntriesInAclA
OpenProcessToken
GetTokenInformation
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
ole32
CoTaskMemFree
CoUninitialize
CoInitialize
CoCreateInstance
Sections
.text Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 548KB - Virtual size: 547KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 21KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 57KB - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ