Overview

overview

7

Static

static

3

2024-06-04...uk.exe

windows7-x64

7

2024-06-04...uk.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    131s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/06/2024, 00:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2024-06-04_610e47ace3a3902057b91c2884b1c5b1_ryuk.exe
  • Size 19.4MB
  • Sample240604-a4t7jsfc3t
  • SHA256 f6dfdce66fb0cf3e6690431067c2ce72213979d49730e236790170a2be1f82f5
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
spywarestealer

Malware Config

Signatures

  • Loads dropped DLL 37 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-04_610e47ace3a3902057b91c2884b1c5b1_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-04_610e47ace3a3902057b91c2884b1c5b1_ryuk.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2268
    • C:\Users\Admin\AppData\Local\Temp\2024-06-04_610e47ace3a3902057b91c2884b1c5b1_ryuk.exe
      "C:\Users\Admin\AppData\Local\Temp\2024-06-04_610e47ace3a3902057b91c2884b1c5b1_ryuk.exe"
      2⤵
      • Loads dropped DLL
      • Enumerates connected drives
      • Suspicious use of AdjustPrivilegeToken
      PID:3464

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        _Salsa20.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI22682\Crypto\Cipher\_Salsa20.pyd
        • Size 9KB
        • SHA256 f9a9d7e0439b432c9b1f361246293a9b0e4320408a6f86a6844f03d29946031b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _raw_cbc.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI22682\Crypto\Cipher\_raw_cbc.pyd
        • Size 7KB
        • SHA256 fe45e611be791baa09398e975a3d931a20e82e51337af09c4bc413f6a2225d17
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _raw_cfb.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI22682\Crypto\Cipher\_raw_cfb.pyd
        • Size 7KB
        • SHA256 9c49a3332754657e68a8d97caeb878ed70dbea3b77e501b54a3908d2b5388bfe
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _raw_ctr.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI22682\Crypto\Cipher\_raw_ctr.pyd
        • Size 8KB
        • SHA256 06a56d3739c4537147a2912c1aba644e237710f66e1695ec8bdd18f21d1de407
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _raw_ecb.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI22682\Crypto\Cipher\_raw_ecb.pyd
        • Size 6KB
        • SHA256 33a0e15981dd6675e404dc579f605aad696baa4281bc4836b5741ef8845fc9af
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _raw_ofb.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI22682\Crypto\Cipher\_raw_ofb.pyd
        • Size 7KB
        • SHA256 016dc9c121ceae460606813b5cbe7a215d113d9bdad22462d1e4877b5368ef33
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _BLAKE2s.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI22682\Crypto\Hash\_BLAKE2s.pyd
        • Size 9KB
        • SHA256 3a12da596bbdf0f80c95d5ac678d9711e09e88bb3cd115a498d444969c74e657
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _MD5.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI22682\Crypto\Hash\_MD5.pyd
        • Size 10KB
        • SHA256 0b0069c05b15e7d61ff02ab8f0994a6ed0d553ca6318141c444355d7063fbbfa
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _SHA1.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI22682\Crypto\Hash\_SHA1.pyd
        • Size 13KB
        • SHA256 e1652d80cfa75cf8c5d5fd2375cbdbdf1566507bce79be9822078138e2627094
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _SHA256.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI22682\Crypto\Hash\_SHA256.pyd
        • Size 15KB
        • SHA256 292c724377358ce19e225165e73b584393d0ca08de5bbe68c595c890d5fccdeb
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _ghash_clmul.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI22682\Crypto\Hash\_ghash_clmul.pyd
        • Size 8KB
        • SHA256 06e983c6923dbd125ab31854417b1937e9ef7e265d02cdc5c684a0a7ef037667
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _ghash_portable.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI22682\Crypto\Hash\_ghash_portable.pyd
        • Size 8KB
        • SHA256 fe3699a162c5768e2ae6d3cde43fb8670ce37ecb32f1ba98c9ffeddcac4d6c67
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _scrypt.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI22682\Crypto\Protocol\_scrypt.pyd
        • Size 7KB
        • SHA256 d08a5e45e4f6d97320e79319e7eadbea17564671cd0467946ee53849c7f674c2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _cpuid_c.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI22682\Crypto\Util\_cpuid_c.pyd
        • Size 6KB
        • SHA256 2d16da08324c2b7040223eca1ad49c21d98fef0ddb8010d050c154596e69bae2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _strxor.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI22682\Crypto\Util\_strxor.pyd
        • Size 6KB
        • SHA256 826f602d8585ece718550637d231ec5feb003c6517dfc9aacb705c278edc6467
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MSVCR100.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI22682\MSVCR100.dll
        • Size 808KB
        • SHA256 b4bfa27f677295b00a1df9a7e14db4b75cac2dd41b898d4e9a378eccce3699f0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI22682\_bz2.pyd
        • Size 61KB
        • SHA256 a86a89cf3e7e4dbcd1ec879231f043a4f62d00196aa5c8314c484b8bfe53c472
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI22682\_ctypes.pyd
        • Size 106KB
        • SHA256 07cd3a390ba1cf1a5d32b72f7d9058dd39e37043652083755f1debcf84089010
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI22682\_hashlib.pyd
        • Size 1.5MB
        • SHA256 643389dcafc777031a87974424568e58bc56a030b6a267ab375eb4a9b5f4bee8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI22682\_lzma.pyd
        • Size 133KB
        • SHA256 e47e5747122542d873a022b69501f011bc8e80af330f54a9e31e04d502606783
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI22682\_socket.pyd
        • Size 51KB
        • SHA256 aa86416277fd46cbfe91a281be11198dde53d6be93728e1d2c3d4a1905c70416
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI22682\base_library.zip
        • Size 745KB
        • SHA256 e75fb2430e2fc454116a40fad9eefae813878d6b6fac215f8891a0849126426e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _psutil_windows.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI22682\psutil\_psutil_windows.pyd
        • Size 59KB
        • SHA256 f51c549dbe5c5d361c7f025d1781c7b70752e162c31192b8993552b8d87abfee
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        python34.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI22682\python34.dll
        • Size 3.9MB
        • SHA256 a3b3ea1e583c3565cb422af954acc7efa3c3d8031afd1e55921962e6736650d4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        pythoncom34.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI22682\pythoncom34.dll
        • Size 531KB
        • SHA256 dc82a8f37e7f08fd343bc375091b390840acb503f0a44dcc56143998de0d06ad
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        pywintypes34.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI22682\pywintypes34.dll
        • Size 126KB
        • SHA256 17b70ae51aa5f4f1c81ae344e26c8f622a1e9d7abffd333a6b2f591a3d19488c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        win32api.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI22682\win32api.pyd
        • Size 121KB
        • SHA256 cecdc8136e891839df9a1868cc755cadcf3489413d4024b357f75d3075b44b37
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        win32file.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI22682\win32file.pyd
        • Size 142KB
        • SHA256 c3f5f585f0b96abd5ed093064b26b8698d0c8601453294c1f771df2620720c00
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        win32mutex.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI22682\win32mutex.pyd
        • Size 3.9MB
        • SHA256 842afe5401ad1a3055bfe6d8ce8d8ce5f6fe715155fa49cb9a0da9e42195a577
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        win32security.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI22682\win32security.pyd
        • Size 130KB
        • SHA256 55d949d89550d51da5231dea0996d3049f0125be8669b06ecd2428cad2940f73
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        win32service.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI22682\win32service.pyd
        • Size 50KB
        • SHA256 9b350abab2139d36d39db0b2b32d37a53e840eb3f4004ea98dec983c5b2886ec
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        win32utils.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI22682\win32utils.pyd
        • Size 146KB
        • SHA256 2ef7ea38eea0fa11c7fed53c78a0f43620458499c4c3d7424bb546224cfd8a4f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        win32wnet.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI22682\win32wnet.pyd
        • Size 29KB
        • SHA256 c3a1a7823443b0eb3e18aeeae6ade16c2fbd80d3b2f935796c2a2fd7c4e46301
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        yara.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI22682\yara.pyd
        • Size 1.4MB
        • SHA256 2343e50994a4b6e1d59215a7d65c49c4fa3ca1b302388c41c32b821d61f9776c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download