Malware Analysis Report

2024-11-13 15:29

Sample ID 240606-zddvbacg73
Target 2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk
SHA256 c1a9adc2fa5605ea6455529090f6aac2df2fc951e9fb48aaa7a3c0bc99c32185
Tags
pyinstaller spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

c1a9adc2fa5605ea6455529090f6aac2df2fc951e9fb48aaa7a3c0bc99c32185

Threat Level: Shows suspicious behavior

The file 2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk was found to be: Shows suspicious behavior.

Malicious Activity Summary

pyinstaller spyware stealer

Reads user/profile data of web browsers

Loads dropped DLL

Looks up external IP address via web service

Detects Pyinstaller

Unsigned PE

Kills process with taskkill

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-06 20:36

Signatures

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-06 20:35

Reported

2024-06-06 20:39

Platform

win7-20240221-en

Max time kernel

119s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe"

Signatures

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe N/A

Reads user/profile data of web browsers

spyware stealer

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2752 wrote to memory of 1852 N/A C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe
PID 2752 wrote to memory of 1852 N/A C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe
PID 2752 wrote to memory of 1852 N/A C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe
PID 1852 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe C:\Windows\system32\cmd.exe
PID 1852 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe C:\Windows\system32\cmd.exe
PID 1852 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe C:\Windows\system32\cmd.exe
PID 2780 wrote to memory of 1792 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2780 wrote to memory of 1792 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2780 wrote to memory of 1792 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1852 wrote to memory of 2156 N/A C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe C:\Windows\system32\cmd.exe
PID 1852 wrote to memory of 2156 N/A C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe C:\Windows\system32\cmd.exe
PID 1852 wrote to memory of 2156 N/A C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe C:\Windows\system32\cmd.exe
PID 2156 wrote to memory of 3036 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2156 wrote to memory of 3036 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2156 wrote to memory of 3036 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1852 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe C:\Windows\system32\cmd.exe
PID 1852 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe C:\Windows\system32\cmd.exe
PID 1852 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe C:\Windows\system32\cmd.exe
PID 3032 wrote to memory of 2532 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3032 wrote to memory of 2532 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3032 wrote to memory of 2532 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe

"C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe"

C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe

"C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /im Discord.exe /f

C:\Windows\system32\taskkill.exe

taskkill /im Discord.exe /f

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /im DiscordPTB.exe /f

C:\Windows\system32\taskkill.exe

taskkill /im DiscordPTB.exe /f

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /im DiscordCanary.exe /f

C:\Windows\system32\taskkill.exe

taskkill /im DiscordCanary.exe /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.ipify.org udp
US 104.26.13.205:443 api.ipify.org tcp

Files

C:\Users\Admin\AppData\Local\Temp\_MEI27522\Nitro Gen + Checker.exe.manifest

MD5 7712161f3bc0c34e015b76519017c6ff
SHA1 fd28f0165a1016353f1a28a1032898275dd4e117
SHA256 e703a30389ed87cd2ec2ca5bbfca4ba74fe0b5c692b37437df4c698712c3e4e9
SHA512 16350a1974b9d01fadff8e90add7007ebcd93798b86a1c29a1fbf0c08e8c9628316167aaf204e3e0479ddab3ceba0ec9f30c6a1f7446b4659aa16d7411955e54

C:\Users\Admin\AppData\Local\Temp\_MEI27522\python38.dll

MD5 147281c6864c61225284fc29dd189f37
SHA1 f9affa883855c85f339ac697e4f2942dd06a3a2e
SHA256 c5d4495bb879cc52a5076e1f366f330aa006d1e7e34c6b640a98378746244099
SHA512 ec5d36cda7689f6f9889ff0fdf2d946704c930a030d7254b901db78c4591a3f4fde0fe75a841ae91c2f0881edaf75b36d04e81e3d8605b81df4bc9195a09d056

C:\Users\Admin\AppData\Local\Temp\_MEI27522\VCRUNTIME140.dll

MD5 0e675d4a7a5b7ccd69013386793f68eb
SHA1 6e5821ddd8fea6681bda4448816f39984a33596b
SHA256 bf5ff4603557c9959acec995653d052d9054ad4826df967974efd2f377c723d1
SHA512 cae69a90f92936febde67dacd6ce77647cb3b3ed82bb66463cd9047e90723f633aa2fc365489de09fecdc510be15808c183b12e6236b0893af19633f6a670e66

C:\Users\Admin\AppData\Local\Temp\_MEI27522\base_library.zip

MD5 06c7e658838a626195b1994d203cc730
SHA1 8e26a111bfbc524181f891f1a797d72527f8b852
SHA256 a6d161f83e902efb48b15c3eb728dea3938c5867b740a64b72b9d80393808765
SHA512 6af95825922fd7bd91bccd95cf32956d5bc6f1d3f885728c113a9ecda99d0a063a3d78bb6cb28b91fc2762c4fcbfa1aa89219ba0aa65d2932fa58fb7c58c0edb

C:\Users\Admin\AppData\Local\Temp\_MEI27522\_ctypes.pyd

MD5 b8a2aa0b18b076f3138d4b6af625b1a8
SHA1 965f046846293af33401c7c0d56dd1423698f08a
SHA256 ddd2e07bd447e46bf8682953e08a52ef3dec2a16b73016a210ac88196964623c
SHA512 0b75f59db170ab74ccb5d82187171000b5a607524449576ecfc8c708e3dfc501ddec5bcb82153f20e928d6c46a7109ebf59fc32d904fe1307a280ce6f1c6bf7e

\Users\Admin\AppData\Local\Temp\_MEI27522\libffi-7.dll

MD5 eef7981412be8ea459064d3090f4b3aa
SHA1 c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512 dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

\Users\Admin\AppData\Local\Temp\_MEI27522\_socket.pyd

MD5 fca96fe528ff7c8a688da45a1667576f
SHA1 3346925f3c5ec51ef9ffbc57b9630663942bdbc4
SHA256 6fb731502320840ea36d2c8194c8de2371d275eb2c2fdffa1a5e62f5bcfc84ea
SHA512 cd3e1ea2590052bd8b0db8f230cddbcf248886acd18f17508fadd64701633646967395aa22c5891ace08b5149ac6dd0543f042ece3a5a6bb2315c4bcaca4d423

C:\Users\Admin\AppData\Local\Temp\_MEI27522\select.pyd

MD5 3bff7c4ca394c523c25de029461ce32a
SHA1 15e2e1bff65fdf400ef54358079bb25a29faedaa
SHA256 306b8d12b77a8d6b6d06c6120331584af14f8deb97d5aed799a4779413052bc1
SHA512 2ce6d85dd23882b8a0ed00e0d2f4cc70f1c2871172e5f4e39d3bcf68ad0f69a528b227f14e02fc28467bc232619cbbf4feead778818a926716604e86285e69a4

\Users\Admin\AppData\Local\Temp\_MEI27522\_ssl.pyd

MD5 481a55afd4a25307321cb46f1b508dce
SHA1 fc988dcf53f6a91062d92cb4b37aaf2d4e8e1a6d
SHA256 24a752482838f62e30c7ad0d40a8a151184901c387ee34ac807f5aec56d04938
SHA512 b47076eb30835fe26918dd3a055f3e0822982030a6cc92c5bf588c7bd27928122b612364f7b79440539a360ed08e3d9adcb97f79637b445fa7b73cfefb171f51

C:\Users\Admin\AppData\Local\Temp\_MEI27522\libcrypto-1_1.dll

MD5 bf83f8ad60cb9db462ce62c73208a30d
SHA1 f1bc7dbc1e5b00426a51878719196d78981674c4
SHA256 012866b68f458ec204b9bce067af8f4a488860774e7e17973c49e583b52b828d
SHA512 ae1bdda1c174ddf4205ab19a25737fe523dca6a9a339030cd8a95674c243d0011121067c007be56def4eaeffc40cbdadfdcbd1e61df3404d6a3921d196dcd81e

C:\Users\Admin\AppData\Local\Temp\_MEI27522\libssl-1_1.dll

MD5 fe1f3632af98e7b7a2799e3973ba03cf
SHA1 353c7382e2de3ccdd2a4911e9e158e7c78648496
SHA256 1ce7ba99e817c1c2d71bc88a1bdd6fcad82aa5c3e519b91ebd56c96f22e3543b
SHA512 a0123dfe324d3ebf68a44afafca7c6f33d918716f29b063c72c4a8bd2006b81faea6848f4f2423778d57296d7bf4f99a3638fc87b37520f0dcbeefa3a2343de0

C:\Users\Admin\AppData\Local\Temp\_MEI27522\_bz2.pyd

MD5 ae8f1119691435dab497acf4f74e48a9
SHA1 3d66b25add927a8aab7acb5f10ce80f29db17428
SHA256 ac01e1aa3248a7e956b0999e62a426396bd703aaaae389166934928552c36ba8
SHA512 ece66874a204c1014b71482f0c34b64094f6a3a4385d9cc0e805d247b29d3d9dfe30f292879705e35a40214c9717b983cc8cb5b1af7d3000325042bb3cf17f2b

C:\Users\Admin\AppData\Local\Temp\_MEI27522\sqlite3.dll

MD5 7bf3b294fc51a8d1496f0dc23864d330
SHA1 f4a315ef83720ee0d6a76bc8dafd6b7c2c16ab43
SHA256 64d9c4dc4ea04343e00418cf9c57ca173336d02846b5d7bc92fda9fe0d672e67
SHA512 e514add297fe449c34eb8c1b292dc075330364925af230432eec04037a81b8c629dc75622d6d19ca34d243e912902933679e305f35e00c509e18d3dde420ffca

\Users\Admin\AppData\Local\Temp\_MEI27522\_sqlite3.pyd

MD5 1d8aa250048b7f223ac3ed4c0fbbe5f5
SHA1 866a044d80db93250c73bb53db332164ea4a9440
SHA256 3c4b3cb88c44722bd3b8ad1b4e73b5591e4947d8db0c4d86adb462327d7fef90
SHA512 1c03d6d4451a2f1cba7f58800793658879f79d1336790056c9edb52fcfb728faa99313bcc6c31353bd3b1ba9dc1bcb39df6ab924905922c3cf55c52ca8a709ec

\Users\Admin\AppData\Local\Temp\_MEI27522\_lzma.pyd

MD5 496778a3b05ad610daad34b752a5fcdf
SHA1 21ad508f2faab85f2304a8e0fdb687611459c653
SHA256 be5a20ea62c97abeaf1cb0c2522f4737d71701f7e1220d92470c0eeb8a99d427
SHA512 3bb10d09a61e84b4b2d19644899021cb8e91418693a11cdc0ca0aa1b861631e11101e9a9feb4ff6883f223294296f6c3634b12206b3ee6a37b37cb761078d122

C:\Users\Admin\AppData\Local\Temp\_MEI27522\_hashlib.pyd

MD5 87722ab32707069bea55e20319066020
SHA1 2e38b46e0c2c4f8b701728af82f658653f7ee62a
SHA256 e320235734d606b0a931ab5577ed3d73f276dbe4aeda1b643e11f2c68b1e25fc
SHA512 82261ef493e0eb45739ef2e99829373f960dce76ac35b1b9c92b65de943d4199200da86f9c12450122a12d8356479ab4c9765e33d70659585c1adb670c1272ee

\Users\Admin\AppData\Local\Temp\_MEI27522\_queue.pyd

MD5 03c59e006425bcf5821302efacf3e536
SHA1 841de7c790b1bb5feabbf713318fd5dd2556dab1
SHA256 eb353ed6b1ca807153ff2c72f38f2cce028eb5684de29f681039bd148e7da6c0
SHA512 577f9929e9c70098380bd1dd4f7e7826d3630d680a28b9d576585ff7cc4d84edf9c0438e070a401295d5748239052f7e77b12a9b07af8cb5c5657db9e390de38

C:\Users\Admin\AppData\Local\Temp\_MEI27522\unicodedata.pyd

MD5 670368fed0b550dcc0574801ebf4d2da
SHA1 fac31b9ba19b4bc0ad138935d6a268bc434dd47a
SHA256 6b3d8ea118eca733b95713616306b829a3eea80e1068c30f5408717bf81c715d
SHA512 f32d992bfd9f30df53b5be95b81d613a50517e3624906e9bb43b17ccccd5a5d88b435256310c2339dc1b811b19d61edcd4104f973e8d18c674510826b16bc334

C:\Users\Admin\AppData\Local\Temp\_MEI27522\certifi\cacert.pem

MD5 77eef70800962694031e78c7352738d7
SHA1 b767d89e989477beb79ba2d5b340b0b4f7ae2192
SHA256 732befe49c758070023448f619a3abb088f44e4f05992bc7478dae873be56ad8
SHA512 0b3984f7bf9d37648a26ef5d3a93e15d5c2e8a443df123121ba43ca858939346cca0d613f04f2d9aba5420b1291ef429fea84e60920220086b153aac61a20f2f

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-06 20:35

Reported

2024-06-06 20:39

Platform

win10v2004-20240426-en

Max time kernel

94s

Max time network

97s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe"

Signatures

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe N/A

Reads user/profile data of web browsers

spyware stealer

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4808 wrote to memory of 3252 N/A C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe
PID 4808 wrote to memory of 3252 N/A C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe
PID 3252 wrote to memory of 4800 N/A C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe C:\Windows\system32\cmd.exe
PID 3252 wrote to memory of 4800 N/A C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe C:\Windows\system32\cmd.exe
PID 4800 wrote to memory of 4360 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4800 wrote to memory of 4360 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3252 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe C:\Windows\system32\cmd.exe
PID 3252 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe C:\Windows\system32\cmd.exe
PID 3028 wrote to memory of 4688 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3028 wrote to memory of 4688 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3252 wrote to memory of 4968 N/A C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe C:\Windows\system32\cmd.exe
PID 3252 wrote to memory of 4968 N/A C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe C:\Windows\system32\cmd.exe
PID 4968 wrote to memory of 4736 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4968 wrote to memory of 4736 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe

"C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe"

C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe

"C:\Users\Admin\AppData\Local\Temp\2024-06-06_daddfbae1ad15f0ebe8c05cf864ff31a_ryuk.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /im Discord.exe /f

C:\Windows\system32\taskkill.exe

taskkill /im Discord.exe /f

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /im DiscordPTB.exe /f

C:\Windows\system32\taskkill.exe

taskkill /im DiscordPTB.exe /f

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /im DiscordCanary.exe /f

C:\Windows\system32\taskkill.exe

taskkill /im DiscordCanary.exe /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 api.ipify.org udp
US 104.26.12.205:443 api.ipify.org tcp
US 8.8.8.8:53 205.12.26.104.in-addr.arpa udp
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 130.211.222.173.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\_MEI48082\Nitro Gen + Checker.exe.manifest

MD5 7712161f3bc0c34e015b76519017c6ff
SHA1 fd28f0165a1016353f1a28a1032898275dd4e117
SHA256 e703a30389ed87cd2ec2ca5bbfca4ba74fe0b5c692b37437df4c698712c3e4e9
SHA512 16350a1974b9d01fadff8e90add7007ebcd93798b86a1c29a1fbf0c08e8c9628316167aaf204e3e0479ddab3ceba0ec9f30c6a1f7446b4659aa16d7411955e54

C:\Users\Admin\AppData\Local\Temp\_MEI48082\python38.dll

MD5 147281c6864c61225284fc29dd189f37
SHA1 f9affa883855c85f339ac697e4f2942dd06a3a2e
SHA256 c5d4495bb879cc52a5076e1f366f330aa006d1e7e34c6b640a98378746244099
SHA512 ec5d36cda7689f6f9889ff0fdf2d946704c930a030d7254b901db78c4591a3f4fde0fe75a841ae91c2f0881edaf75b36d04e81e3d8605b81df4bc9195a09d056

C:\Users\Admin\AppData\Local\Temp\_MEI48082\_ctypes.pyd

MD5 b8a2aa0b18b076f3138d4b6af625b1a8
SHA1 965f046846293af33401c7c0d56dd1423698f08a
SHA256 ddd2e07bd447e46bf8682953e08a52ef3dec2a16b73016a210ac88196964623c
SHA512 0b75f59db170ab74ccb5d82187171000b5a607524449576ecfc8c708e3dfc501ddec5bcb82153f20e928d6c46a7109ebf59fc32d904fe1307a280ce6f1c6bf7e

C:\Users\Admin\AppData\Local\Temp\_MEI48082\libffi-7.dll

MD5 eef7981412be8ea459064d3090f4b3aa
SHA1 c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512 dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

C:\Users\Admin\AppData\Local\Temp\_MEI48082\select.pyd

MD5 3bff7c4ca394c523c25de029461ce32a
SHA1 15e2e1bff65fdf400ef54358079bb25a29faedaa
SHA256 306b8d12b77a8d6b6d06c6120331584af14f8deb97d5aed799a4779413052bc1
SHA512 2ce6d85dd23882b8a0ed00e0d2f4cc70f1c2871172e5f4e39d3bcf68ad0f69a528b227f14e02fc28467bc232619cbbf4feead778818a926716604e86285e69a4

C:\Users\Admin\AppData\Local\Temp\_MEI48082\_socket.pyd

MD5 fca96fe528ff7c8a688da45a1667576f
SHA1 3346925f3c5ec51ef9ffbc57b9630663942bdbc4
SHA256 6fb731502320840ea36d2c8194c8de2371d275eb2c2fdffa1a5e62f5bcfc84ea
SHA512 cd3e1ea2590052bd8b0db8f230cddbcf248886acd18f17508fadd64701633646967395aa22c5891ace08b5149ac6dd0543f042ece3a5a6bb2315c4bcaca4d423

C:\Users\Admin\AppData\Local\Temp\_MEI48082\base_library.zip

MD5 06c7e658838a626195b1994d203cc730
SHA1 8e26a111bfbc524181f891f1a797d72527f8b852
SHA256 a6d161f83e902efb48b15c3eb728dea3938c5867b740a64b72b9d80393808765
SHA512 6af95825922fd7bd91bccd95cf32956d5bc6f1d3f885728c113a9ecda99d0a063a3d78bb6cb28b91fc2762c4fcbfa1aa89219ba0aa65d2932fa58fb7c58c0edb

C:\Users\Admin\AppData\Local\Temp\_MEI48082\_ssl.pyd

MD5 481a55afd4a25307321cb46f1b508dce
SHA1 fc988dcf53f6a91062d92cb4b37aaf2d4e8e1a6d
SHA256 24a752482838f62e30c7ad0d40a8a151184901c387ee34ac807f5aec56d04938
SHA512 b47076eb30835fe26918dd3a055f3e0822982030a6cc92c5bf588c7bd27928122b612364f7b79440539a360ed08e3d9adcb97f79637b445fa7b73cfefb171f51

C:\Users\Admin\AppData\Local\Temp\_MEI48082\libcrypto-1_1.dll

MD5 bf83f8ad60cb9db462ce62c73208a30d
SHA1 f1bc7dbc1e5b00426a51878719196d78981674c4
SHA256 012866b68f458ec204b9bce067af8f4a488860774e7e17973c49e583b52b828d
SHA512 ae1bdda1c174ddf4205ab19a25737fe523dca6a9a339030cd8a95674c243d0011121067c007be56def4eaeffc40cbdadfdcbd1e61df3404d6a3921d196dcd81e

C:\Users\Admin\AppData\Local\Temp\_MEI48082\libssl-1_1.dll

MD5 fe1f3632af98e7b7a2799e3973ba03cf
SHA1 353c7382e2de3ccdd2a4911e9e158e7c78648496
SHA256 1ce7ba99e817c1c2d71bc88a1bdd6fcad82aa5c3e519b91ebd56c96f22e3543b
SHA512 a0123dfe324d3ebf68a44afafca7c6f33d918716f29b063c72c4a8bd2006b81faea6848f4f2423778d57296d7bf4f99a3638fc87b37520f0dcbeefa3a2343de0

C:\Users\Admin\AppData\Local\Temp\_MEI48082\_bz2.pyd

MD5 ae8f1119691435dab497acf4f74e48a9
SHA1 3d66b25add927a8aab7acb5f10ce80f29db17428
SHA256 ac01e1aa3248a7e956b0999e62a426396bd703aaaae389166934928552c36ba8
SHA512 ece66874a204c1014b71482f0c34b64094f6a3a4385d9cc0e805d247b29d3d9dfe30f292879705e35a40214c9717b983cc8cb5b1af7d3000325042bb3cf17f2b

C:\Users\Admin\AppData\Local\Temp\_MEI48082\sqlite3.dll

MD5 7bf3b294fc51a8d1496f0dc23864d330
SHA1 f4a315ef83720ee0d6a76bc8dafd6b7c2c16ab43
SHA256 64d9c4dc4ea04343e00418cf9c57ca173336d02846b5d7bc92fda9fe0d672e67
SHA512 e514add297fe449c34eb8c1b292dc075330364925af230432eec04037a81b8c629dc75622d6d19ca34d243e912902933679e305f35e00c509e18d3dde420ffca

C:\Users\Admin\AppData\Local\Temp\_MEI48082\_sqlite3.pyd

MD5 1d8aa250048b7f223ac3ed4c0fbbe5f5
SHA1 866a044d80db93250c73bb53db332164ea4a9440
SHA256 3c4b3cb88c44722bd3b8ad1b4e73b5591e4947d8db0c4d86adb462327d7fef90
SHA512 1c03d6d4451a2f1cba7f58800793658879f79d1336790056c9edb52fcfb728faa99313bcc6c31353bd3b1ba9dc1bcb39df6ab924905922c3cf55c52ca8a709ec

C:\Users\Admin\AppData\Local\Temp\_MEI48082\_lzma.pyd

MD5 496778a3b05ad610daad34b752a5fcdf
SHA1 21ad508f2faab85f2304a8e0fdb687611459c653
SHA256 be5a20ea62c97abeaf1cb0c2522f4737d71701f7e1220d92470c0eeb8a99d427
SHA512 3bb10d09a61e84b4b2d19644899021cb8e91418693a11cdc0ca0aa1b861631e11101e9a9feb4ff6883f223294296f6c3634b12206b3ee6a37b37cb761078d122

C:\Users\Admin\AppData\Local\Temp\_MEI48082\_queue.pyd

MD5 03c59e006425bcf5821302efacf3e536
SHA1 841de7c790b1bb5feabbf713318fd5dd2556dab1
SHA256 eb353ed6b1ca807153ff2c72f38f2cce028eb5684de29f681039bd148e7da6c0
SHA512 577f9929e9c70098380bd1dd4f7e7826d3630d680a28b9d576585ff7cc4d84edf9c0438e070a401295d5748239052f7e77b12a9b07af8cb5c5657db9e390de38

C:\Users\Admin\AppData\Local\Temp\_MEI48082\_hashlib.pyd

MD5 87722ab32707069bea55e20319066020
SHA1 2e38b46e0c2c4f8b701728af82f658653f7ee62a
SHA256 e320235734d606b0a931ab5577ed3d73f276dbe4aeda1b643e11f2c68b1e25fc
SHA512 82261ef493e0eb45739ef2e99829373f960dce76ac35b1b9c92b65de943d4199200da86f9c12450122a12d8356479ab4c9765e33d70659585c1adb670c1272ee

C:\Users\Admin\AppData\Local\Temp\_MEI48082\unicodedata.pyd

MD5 670368fed0b550dcc0574801ebf4d2da
SHA1 fac31b9ba19b4bc0ad138935d6a268bc434dd47a
SHA256 6b3d8ea118eca733b95713616306b829a3eea80e1068c30f5408717bf81c715d
SHA512 f32d992bfd9f30df53b5be95b81d613a50517e3624906e9bb43b17ccccd5a5d88b435256310c2339dc1b811b19d61edcd4104f973e8d18c674510826b16bc334

C:\Users\Admin\AppData\Local\Temp\_MEI48082\VCRUNTIME140.dll

MD5 0e675d4a7a5b7ccd69013386793f68eb
SHA1 6e5821ddd8fea6681bda4448816f39984a33596b
SHA256 bf5ff4603557c9959acec995653d052d9054ad4826df967974efd2f377c723d1
SHA512 cae69a90f92936febde67dacd6ce77647cb3b3ed82bb66463cd9047e90723f633aa2fc365489de09fecdc510be15808c183b12e6236b0893af19633f6a670e66

C:\Users\Admin\AppData\Local\Temp\_MEI48082\certifi\cacert.pem

MD5 77eef70800962694031e78c7352738d7
SHA1 b767d89e989477beb79ba2d5b340b0b4f7ae2192
SHA256 732befe49c758070023448f619a3abb088f44e4f05992bc7478dae873be56ad8
SHA512 0b3984f7bf9d37648a26ef5d3a93e15d5c2e8a443df123121ba43ca858939346cca0d613f04f2d9aba5420b1291ef429fea84e60920220086b153aac61a20f2f