C:\progects\mining-service\xmr\build\bin\Debug\xmr-stak-cpu.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-05_74eacaca208614f93255cead470ec7b3_ryuk.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-06-05_74eacaca208614f93255cead470ec7b3_ryuk.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-06-05_74eacaca208614f93255cead470ec7b3_ryuk
-
Size
2.4MB
-
MD5
74eacaca208614f93255cead470ec7b3
-
SHA1
f3450e5c96e50b0f87ec6360b02bd2a916b38310
-
SHA256
a5592efd8f7f8c0ce0ac043610287c349c751b079254acba559a0293155b4c81
-
SHA512
9b8a83625a3c0254945f7113a4c62a053439507014ab7385a835cc961dda647895a03a0e03656e8c2afc46fffbd0e1bcf779d43133886c10bb8e67058a36871b
-
SSDEEP
49152:jDw91wGqROpCPp3YQjY2Uwc5wll3qoVL1A:jDgwHkCB35VG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-06-05_74eacaca208614f93255cead470ec7b3_ryuk
Files
-
2024-06-05_74eacaca208614f93255cead470ec7b3_ryuk.exe windows:6 windows x64 arch:x64
36dc155b3fed155d19e2350312c54975
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
GetDriveTypeA
WaitForMultipleObjects
FindNextFileA
InitializeCriticalSectionEx
FindClose
WaitForSingleObject
MultiByteToWideChar
CopyFileA
GetLastError
CloseHandle
RaiseException
CreateThread
DecodePointer
DeleteCriticalSection
CreateSemaphoreA
GetVolumePathNameA
SizeofResource
BeginUpdateResourceA
LoadLibraryExA
FindResourceA
LockResource
DeleteFileA
LoadResource
FreeLibrary
UpdateResourceA
EndUpdateResourceA
CreateDirectoryA
Sleep
GetTempPathA
CreateProcessA
GetTempFileNameA
ReadFile
WriteFile
SetFileTime
SetFilePointer
GetCurrentDirectoryA
ReleaseSemaphore
GetFileAttributesA
CreateFileA
SystemTimeToFileTime
UnmapViewOfFile
GetFileInformationByHandle
FileTimeToSystemTime
GetLocalTime
CreateFileMappingA
GetFileSize
MapViewOfFile
GetTickCount
CreateMutexA
OpenMutexA
RtlCaptureStackBackTrace
SetEndOfFile
ReadConsoleW
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindFirstFileExA
GetTimeZoneInformation
SetStdHandle
GetFullPathNameA
GetFullPathNameW
GetCurrentDirectoryW
SetCurrentDirectoryW
SetFilePointerEx
GetProcessHeap
SetLastError
FindFirstFileA
LocalFileTimeToFileTime
GetModuleFileNameA
HeapQueryInformation
HeapReAlloc
HeapFree
MoveFileExW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
GetCurrentThreadId
DuplicateHandle
WaitForSingleObjectEx
GetCurrentProcess
GetCurrentThread
GetExitCodeThread
GetNativeSystemInfo
FormatMessageW
WideCharToMultiByte
QueryPerformanceCounter
QueryPerformanceFrequency
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
EncodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
IsDebuggerPresent
OutputDebugStringW
LocalFree
SetEvent
ResetEvent
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
CreateTimerQueue
SignalObjectAndWait
SwitchToThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
GetModuleFileNameW
GetModuleHandleA
LoadLibraryExW
GetVersionExW
VirtualAlloc
VirtualFree
VirtualProtect
SetProcessAffinityMask
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
WaitForMultipleObjectsEx
LoadLibraryW
RtlPcToFileHeader
RtlUnwindEx
GetModuleHandleExW
HeapAlloc
HeapSize
HeapValidate
GetSystemInfo
CreateFileW
GetDriveTypeW
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
ExitThread
ResumeThread
ExitProcess
GetStdHandle
GetACP
OutputDebugStringA
WriteConsoleW
SetConsoleCtrlHandler
FlushFileBuffers
GetConsoleCP
GetConsoleMode
VirtualQuery
user32
wsprintfA
GetDesktopWindow
UnregisterClassA
shell32
ShellExecuteExA
ShellExecuteA
SHGetSpecialFolderPathA
ole32
CoCreateInstance
CoInitialize
CoInitializeSecurity
CoUninitialize
CoInitializeEx
CoCreateGuid
oleaut32
SetErrorInfo
VariantChangeType
GetErrorInfo
CreateErrorInfo
VariantClear
SysAllocString
SysAllocStringByteLen
SysStringByteLen
VariantInit
SysFreeString
advapi32
RegSetValueExA
RegOpenKeyExA
RegCloseKey
shlwapi
PathFileExistsA
rpcrt4
UuidToStringA
RpcStringFreeA
wininet
DeleteUrlCacheEntry
urlmon
URLDownloadToFileA
Exports
Exports
go
start
Sections
.text Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 490KB - Virtual size: 489KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 15KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 101KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 42KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ