Overview

overview

7

Static

static

3

2024-06-06...uk.exe

windows7-x64

7

2024-06-06...uk.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    94s
  • max time network
    97s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/06/2024, 20:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe
  • Size 10.5MB
  • Sample240606-zddvbacg73
  • SHA256 c1a9adc2fa5605ea6455529090f6aac2df2fc951e9fb48aaa7a3c0bc99c32185
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
spywarestealer

Malware Config

Signatures

  • Loads dropped DLL 17 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Kills process with taskkill 3 IoCs
    evasion
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4808
    • C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe
      "C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:3252
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c taskkill /im Discord.exe /f
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4800
        • C:\Windows\system32\taskkill.exe
          taskkill /im Discord.exe /f
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4360
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c taskkill /im DiscordPTB.exe /f
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3028
        • C:\Windows\system32\taskkill.exe
          taskkill /im DiscordPTB.exe /f
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4688
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c taskkill /im DiscordCanary.exe /f
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4968
        • C:\Windows\system32\taskkill.exe
          taskkill /im DiscordCanary.exe /f
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4736

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Nitro Gen + Checker.exe.manifest
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48082\Nitro Gen + Checker.exe.manifest
        • Size 1KB
        • SHA256 e703a30389ed87cd2ec2ca5bbfca4ba74fe0b5c692b37437df4c698712c3e4e9
        • MD5 SHA1 SHA512
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48082\VCRUNTIME140.dll
        • Size 87KB
        • SHA256 bf5ff4603557c9959acec995653d052d9054ad4826df967974efd2f377c723d1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48082\_bz2.pyd
        • Size 82KB
        • SHA256 ac01e1aa3248a7e956b0999e62a426396bd703aaaae389166934928552c36ba8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48082\_ctypes.pyd
        • Size 121KB
        • SHA256 ddd2e07bd447e46bf8682953e08a52ef3dec2a16b73016a210ac88196964623c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48082\_hashlib.pyd
        • Size 44KB
        • SHA256 e320235734d606b0a931ab5577ed3d73f276dbe4aeda1b643e11f2c68b1e25fc
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48082\_lzma.pyd
        • Size 246KB
        • SHA256 be5a20ea62c97abeaf1cb0c2522f4737d71701f7e1220d92470c0eeb8a99d427
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48082\_queue.pyd
        • Size 27KB
        • SHA256 eb353ed6b1ca807153ff2c72f38f2cce028eb5684de29f681039bd148e7da6c0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48082\_socket.pyd
        • Size 77KB
        • SHA256 6fb731502320840ea36d2c8194c8de2371d275eb2c2fdffa1a5e62f5bcfc84ea
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _sqlite3.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48082\_sqlite3.pyd
        • Size 85KB
        • SHA256 3c4b3cb88c44722bd3b8ad1b4e73b5591e4947d8db0c4d86adb462327d7fef90
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48082\_ssl.pyd
        • Size 116KB
        • SHA256 24a752482838f62e30c7ad0d40a8a151184901c387ee34ac807f5aec56d04938
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48082\base_library.zip
        • Size 763KB
        • SHA256 a6d161f83e902efb48b15c3eb728dea3938c5867b740a64b72b9d80393808765
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        cacert.pem
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48082\certifi\cacert.pem
        • Size 274KB
        • SHA256 732befe49c758070023448f619a3abb088f44e4f05992bc7478dae873be56ad8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libcrypto-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48082\libcrypto-1_1.dll
        • Size 3.2MB
        • SHA256 012866b68f458ec204b9bce067af8f4a488860774e7e17973c49e583b52b828d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libffi-7.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48082\libffi-7.dll
        • Size 32KB
        • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libssl-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48082\libssl-1_1.dll
        • Size 670KB
        • SHA256 1ce7ba99e817c1c2d71bc88a1bdd6fcad82aa5c3e519b91ebd56c96f22e3543b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        python38.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48082\python38.dll
        • Size 4.0MB
        • SHA256 c5d4495bb879cc52a5076e1f366f330aa006d1e7e34c6b640a98378746244099
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48082\select.pyd
        • Size 26KB
        • SHA256 306b8d12b77a8d6b6d06c6120331584af14f8deb97d5aed799a4779413052bc1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        sqlite3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48082\sqlite3.dll
        • Size 1.2MB
        • SHA256 64d9c4dc4ea04343e00418cf9c57ca173336d02846b5d7bc92fda9fe0d672e67
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48082\unicodedata.pyd
        • Size 1.0MB
        • SHA256 6b3d8ea118eca733b95713616306b829a3eea80e1068c30f5408717bf81c715d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download