Overview

overview

7

Static

static

3

2024-06-07...uk.exe

windows7-x64

7

2024-06-07...uk.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    92s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-06-2024 00:50

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-06-07_0cfb70b3fc4c4952ce3b0937baa8242a_ryuk.exe

  • Size

    17.0MB

  • MD5

    0cfb70b3fc4c4952ce3b0937baa8242a

  • SHA1

    00d6cf381b85b63fe42534a0a4b8a3768cdb9a5e

  • SHA256

    bbd895f58d140f56d3117dc6ffad30ca35e3c2a3ca7cd3e4c9a0b62324bfff80

  • SHA512

    9869ad4f4f8b60126e4c4533f352ba8537c1353a0e14d83efb72df28341a85c4672a143424f3edc57ee5ba8ef8facbe9c0ac840b88ca4be23cd1ba39b42c5b58

  • SSDEEP

    393216:SMaHK8Pj9c5hlER35ShR4uw3AdZYyKLI0RtN3ZWarz4ENd8Oxr4Z+DS:EqgJEhkpQ27AdZKc+tN3DpNJ3

Score
7/10
spywarestealer

Malware Config

Signatures

  • Loads dropped DLL 41 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-07_0cfb70b3fc4c4952ce3b0937baa8242a_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-07_0cfb70b3fc4c4952ce3b0937baa8242a_ryuk.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5076
    • C:\Users\Admin\AppData\Local\Temp\2024-06-07_0cfb70b3fc4c4952ce3b0937baa8242a_ryuk.exe
      "C:\Users\Admin\AppData\Local\Temp\2024-06-07_0cfb70b3fc4c4952ce3b0937baa8242a_ryuk.exe"
      2⤵
      • Loads dropped DLL
      PID:4184

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI50762\Crypto\Cipher\_Salsa20.cp39-win_amd64.pyd
    Filesize

    13KB

    MD5

    30f2778159d5ffc5779621f84558a5ca

    SHA1

    ea7b6a9be93c143164278d6524fe3f5ca3a2dd73

    SHA256

    368ab0cabcf4567648473bf8368adf98f63249d783392392add6f2492c50ea84

    SHA512

    17960c93ec654834c1bb192185c6fc324155ce38c27ef787ad5d3e80e1300e35e762ace56c22a97c7b2674994abf30cc10d424554f4c561f8de5820239418ea1

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI50762\Crypto\Cipher\_raw_cbc.cp39-win_amd64.pyd
    Filesize

    12KB

    MD5

    9eae93238ec40f7af5221c3a5bf0a462

    SHA1

    8250d96ed83bc73c401113c4a0e98dff2a79fa30

    SHA256

    b66b2a1a69ec0baa123f4ec0cc5899ba202298ab1744106d1cef5c5eb3ae000c

    SHA512

    c6bf6294bdec2d7c08e596c8cdd10a5790cc4bfac08eaf711cd29d01042d95039999c46d7979e42a221af7ba8e21d5ed33d5a0f66da990d269b84b046673afbb

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI50762\Crypto\Cipher\_raw_cfb.cp39-win_amd64.pyd
    Filesize

    13KB

    MD5

    173a70d076e0fe6efb4a6bb311d58963

    SHA1

    e08b808a40c178442cdbaa3abf42cf7f582ce8c2

    SHA256

    b8c7423dd3e2574374980e8071fce389b35753261c7f8bc33be44b6113660321

    SHA512

    9ee0003db904ab0f051d17a74daa13ac5e1ce232fab0e98645113abe529071df796df22b5150227d7bf61f662b6af39a09156c81a5d08ddf07d7b2b70abfa78c

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI50762\Crypto\Cipher\_raw_ctr.cp39-win_amd64.pyd
    Filesize

    14KB

    MD5

    af6a00cb044a98ed7f06e86b6a826af7

    SHA1

    212f18d061eec3caa1b606fb0d94b31579e5d634

    SHA256

    d4dbeffc754c5c1a92bd50f3d7829523c9eca738f253962b8b7006b1db2a8a0a

    SHA512

    05e7c8ff3928b0aeba4b57f4ecd7ec6d14b658e4896628256fef9f1bd8a00f448c10d8452874c7b4aaa07883a8ba12b01452cc257467be8f3437c8496043fd87

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI50762\Crypto\Cipher\_raw_ecb.cp39-win_amd64.pyd
    Filesize

    10KB

    MD5

    05473054e9fc8a11c01aa3289fac7b3d

    SHA1

    27e708f6875e94ac4e7e7f6da318399bb669143c

    SHA256

    76ca7546b055bf254610beb77227fe4944183819707e17ab3f278c096542cf95

    SHA512

    ec0b707ddaf9aba5d28bfceaa972c30373e0b6329f0cc3c35c1ea7d62a9c186e483c2930d49814cafe3bece1e13f2f6b787d41d0be09e1ade17df8eb5cfa139a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI50762\Crypto\Cipher\_raw_ofb.cp39-win_amd64.pyd
    Filesize

    12KB

    MD5

    684520efc8130aa82e24fc0b1517e337

    SHA1

    3df16db8935da298ba547cca3be2fa5f55e5cb24

    SHA256

    a95f527ce445ccbd947d26cd3bc06a1aa61379aa87db36d9e22cc12123787e31

    SHA512

    c290fa9f89d3fb0d961e6f6082ffb102339ef0ad5332dee074ebfd92407e2c447505e6af6ad25de1510cc1797a8461186289acb72670b95b55a37f2111b27497

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI50762\Crypto\Hash\_BLAKE2s.cp39-win_amd64.pyd
    Filesize

    13KB

    MD5

    30f6cfca9d0ee78d3d972ccc05fd06d0

    SHA1

    3741b12f143b4cdcbb807290506053f53a466ad4

    SHA256

    b2bff9283b581e18d88e7e13d23f3120e7bc1c8af9603229f449379e9a9b8483

    SHA512

    2a33d43222ddf9b3a1b46e77aa7d5f0647c2f6800af6c6a4f4733fff09aeb15b9e19361e754ee81192bd4a1a1a50ad08284cd9ca93974f32bc016e44a70a5aec

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI50762\Crypto\Hash\_MD5.cp39-win_amd64.pyd
    Filesize

    15KB

    MD5

    e850113a4250bd5ab32d5d0afa20b2c4

    SHA1

    d28803f9296430e6d029ce4232eec4fd41e456c1

    SHA256

    b618ca7bc33d629ca843dcca9d837792912be9a3aeb6fceca8e06b7d20e2ba4a

    SHA512

    37d41f088718767095822e54d7143c74683574b31e6308881c4f1244fcc732bbe1158e1efb14170952e1fbcb8812921436cb011a14d1d5bd414a26076174e781

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI50762\Crypto\Hash\_SHA1.cp39-win_amd64.pyd
    Filesize

    17KB

    MD5

    a2ad6d5abf82d15cede596b80adf4bd8

    SHA1

    c7034e5b286a20ecb212c70c225d328a54c18d64

    SHA256

    5749be82321987e1185dbdd090340f21c0f41c84cddaf622cafb2863b243b85f

    SHA512

    9e08ad71a4bac5856c0a312d7826f36e330bf0aca1fa6358631577925eae4626e52031bfea3f8285b8dc5df75199ff8700ebd532c8e6ef0815854cd34a100813

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI50762\Crypto\Hash\_SHA256.cp39-win_amd64.pyd
    Filesize

    21KB

    MD5

    215e18d7b314f1d07ce6abcf7215b885

    SHA1

    bf2a79d82a621c7e12e3b3d232e14c22cea7fd7d

    SHA256

    0f0b40c791011fa30cb30631491a6e3fec14bd54fbe3159e36809a82bc100e73

    SHA512

    da5b0b2932d6833836c6d68421f754bdb916a44bd81e5be07b8d391f6aba31e69de7497f0967992afba6e50356e0af3cf124ef6182db94ef619858d234dad59d

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI50762\Crypto\Protocol\_scrypt.cp39-win_amd64.pyd
    Filesize

    12KB

    MD5

    ab6ae6a3e3661d674f9245365fa36870

    SHA1

    d945cdd888145e8902281d40ec0f7639875effdc

    SHA256

    65a5276cee8ae66d05e5bc2a1cb7069b955edd932ffb26b4f0a09aa41863c069

    SHA512

    f87eff5e67f7fba9b04f5d7841ceff74a441aa6e810c19b89043131a9579db9b4cc7c6808d952f24924cd3aab19dd47f2475a4f4614b25c5ecd7484ab7379935

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI50762\Crypto\Util\_strxor.cp39-win_amd64.pyd
    Filesize

    10KB

    MD5

    59ee42e6470c670a738ac9af809049cd

    SHA1

    68e2b6711534e028314d4fc095f7a9ed05781a98

    SHA256

    3610605653159d0258a992aa4d614b82c97a05f3418c3edb5b1c94f2f78d7faa

    SHA512

    cd70aadaf83f3ab640d933560b175d5ce3aebd1a36270a784101f4844c02c9b43d79d40b7dc03e6045b1d2d849bd427051d94eea676218995ff4a993b9d85bbe

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI50762\VCRUNTIME140.dll
    Filesize

    99KB

    MD5

    8697c106593e93c11adc34faa483c4a0

    SHA1

    cd080c51a97aa288ce6394d6c029c06ccb783790

    SHA256

    ff43e813785ee948a937b642b03050bb4b1c6a5e23049646b891a66f65d4c833

    SHA512

    724bbed7ce6f7506e5d0b43399fb3861dda6457a2ad2fafe734f8921c9a4393b480cdd8a435dbdbd188b90236cb98583d5d005e24fa80b5a0622a6322e6f3987

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI50762\_bz2.pyd
    Filesize

    83KB

    MD5

    6c7565c1efffe44cb0616f5b34faa628

    SHA1

    88dd24807da6b6918945201c74467ca75e155b99

    SHA256

    fe63361f6c439c6aa26fd795af3fd805ff5b60b3b14f9b8c60c50a8f3449060a

    SHA512

    822445c52bb71c884461230bb163ec5dee0ad2c46d42d01cf012447f2c158865653f86a933b52afdf583043b3bf8ba7011cc782f14197220d0325e409aa16e22

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI50762\_cffi_backend.cp39-win_amd64.pyd
    Filesize

    178KB

    MD5

    2a4f6205cfbcf323630b177caf8d07cb

    SHA1

    e1c1f1090b9e5013f2e8649f9b20425cdc89fe81

    SHA256

    1fda9af8b540bdb455a157d91bab3209decd6c9fe5c5914094f790fa2ea188af

    SHA512

    f284885d9422e5f2f3c6435c575d6b780d5728a25c02f56b8cda800519ade7162504ca71019ec41c1b512d82bac05b86ea2404e1c77df8eb9e8ecce8b0eab3a3

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI50762\_ctypes.pyd
    Filesize

    122KB

    MD5

    29da9b022c16da461392795951ce32d9

    SHA1

    0e514a8f88395b50e797d481cbbed2b4ae490c19

    SHA256

    3b4012343ef7a266db0b077bbb239833779192840d1e2c43dfcbc48ffd4c5372

    SHA512

    5c7d83823f1922734625cf69a481928a5c47b6a3bceb7f24c9197175665b2e06bd1cfd745c55d1c5fe1572f2d8da2a1dcc1c1f5de0903477bb927aca22ecb26a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI50762\_lzma.pyd
    Filesize

    157KB

    MD5

    b5355dd319fb3c122bb7bf4598ad7570

    SHA1

    d7688576eceadc584388a179eed3155716c26ef5

    SHA256

    b9bc7f1d8aa8498cb8b5dc75bb0dbb6e721b48953a3f295870938b27267fb5f5

    SHA512

    0e228aa84b37b4ba587f6d498cef85aa1ffec470a5c683101a23d13955a8110e1c0c614d3e74fb0aa2a181b852bceeec0461546d0de8bcbd3c58cf9dc0fb26f5

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI50762\_socket.pyd
    Filesize

    77KB

    MD5

    f5dd9c5922a362321978c197d3713046

    SHA1

    4fbc2d3e15f8bb21ecc1bf492f451475204426cd

    SHA256

    4494992665305fc9401ed327398ee40064fe26342fe44df11d89d2ac1cc6f626

    SHA512

    ce818113bb87c6e38fa85156548c6f207aaab01db311a6d8c63c6d900d607d7beff73e64d717f08388ece4b88bf8b95b71911109082cf4b0c0a9b0663b9a8e99

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI50762\_sqlite3.pyd
    Filesize

    86KB

    MD5

    11897592cf9c078a0a1633c57a7694e2

    SHA1

    9a6da7aaec8e808e2faee476d59bc685b2da7fbc

    SHA256

    f8d0afd1fe15f19d3a3ade2a673eb2b9ecdc7952e67c6e50d228fe9666af2f79

    SHA512

    72b9a264a2d6ea5e1a3fed8bd44501fbd035708b28e40b6993cb41ed041a439edc63cd4c23a9833cf08cf89c82b86fa9f3f5484262d6131d3e2142222eb4e88d

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI50762\_ssl.pyd
    Filesize

    149KB

    MD5

    ef4755195cc9b2ff134ea61acde20637

    SHA1

    d5ba42c97488da1910cf3f83a52f7971385642c2

    SHA256

    8a86957b3496c8b679fcf22c287006108bfe0bb0aaffea17121c761a0744b470

    SHA512

    63ad2601fb629e74cf60d980cec292b6e8349615996651b7c7f68991cdae5f89b28c11adb77720d7dbbd7700e55fdd5330a84b4a146386cf0c0418a8d61a8a71

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI50762\base_library.zip
    Filesize

    767KB

    MD5

    ea9bc0b8579e2cbae493c38dfda093dd

    SHA1

    d9b2aad9af0a7448d70217610a6a4f9e52c22abd

    SHA256

    22c3abf4895cc587970617290a4b8fe1cbf7892b4a11072f4822733b513df789

    SHA512

    a1e5b908754ba129354d1af5c9986b71ecdf9535c33f758137303288e99d0396f36ae7771b52189a9e311f619d0c653f4d16c31fa31f33cb69a97c47b766a2e4

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI50762\libcrypto-1_1.dll
    Filesize

    3.2MB

    MD5

    cc4cbf715966cdcad95a1e6c95592b3d

    SHA1

    d5873fea9c084bcc753d1c93b2d0716257bea7c3

    SHA256

    594303e2ce6a4a02439054c84592791bf4ab0b7c12e9bbdb4b040e27251521f1

    SHA512

    3b5af9fbbc915d172648c2b0b513b5d2151f940ccf54c23148cd303e6660395f180981b148202bef76f5209acc53b8953b1cb067546f90389a6aa300c1fbe477

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI50762\libffi-7.dll
    Filesize

    32KB

    MD5

    eef7981412be8ea459064d3090f4b3aa

    SHA1

    c60da4830ce27afc234b3c3014c583f7f0a5a925

    SHA256

    f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

    SHA512

    dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI50762\libssl-1_1.dll
    Filesize

    673KB

    MD5

    bc778f33480148efa5d62b2ec85aaa7d

    SHA1

    b1ec87cbd8bc4398c6ebb26549961c8aab53d855

    SHA256

    9d4cf1c03629f92662fc8d7e3f1094a7fc93cb41634994464b853df8036af843

    SHA512

    80c1dd9d0179e6cc5f33eb62d05576a350af78b5170bfdf2ecda16f1d8c3c2d0e991a5534a113361ae62079fb165fff2344efd1b43031f1a7bfda696552ee173

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI50762\pyexpat.pyd
    Filesize

    184KB

    MD5

    0dc9848a5fce6ec03799ac65602dc053

    SHA1

    ddfd97a45c0db5117e047bf45d66873b53160978

    SHA256

    adc9c63f92629ed4b860fc1855400b59a1ae73dd489fd49db326dcfcad48550e

    SHA512

    d1b2f71000cab1115971d44c690fdb8966b9b402216b87ec1f1e8e8a1cca3ce1e1145b8d650c8ad737e6e24c59503aaf9310de3e96a0ac6596187c800013ac71

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI50762\python39.dll
    Filesize

    4.3MB

    MD5

    11c051f93c922d6b6b4829772f27a5be

    SHA1

    42fbdf3403a4bc3d46d348ca37a9f835e073d440

    SHA256

    0eabf135bb9492e561bbbc5602a933623c9e461aceaf6eb1ceced635e363cd5c

    SHA512

    1cdec23486cffcb91098a8b2c3f1262d6703946acf52aa2fe701964fb228d1411d9b6683bd54527860e10affc0e3d3de92a6ecf2c6c8465e9c8b9a7304e2a4a6

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI50762\pythoncom39.dll
    Filesize

    558KB

    MD5

    94629505e0e53d8a09de987f13306a1f

    SHA1

    202abca389bb4bfbff8736da6c4651aee2dc807a

    SHA256

    36f7c3bbeae95bb6d553164c8eada5151798d1a791fbc7ed4cbecccdb0fc7799

    SHA512

    411c1a4c69858b2b59ce0fea0176166aa26b036d2c3017c8a06cbdc4d6ce8b33c0f9ac2f864e4d9f2cbdb63c140d21ebea959456e107d2e2797e8b096f4923f5

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI50762\pywintypes39.dll
    Filesize

    138KB

    MD5

    c011bc0709eb6604358e0d7aeea1d740

    SHA1

    afd73b1c6dfe5c9e4b68f7f6dbeae69ff67f5d6b

    SHA256

    afd5ca84b945c3e6513b9dfd383cab07f53701af93e04aa7e1862b4e6d351e5e

    SHA512

    10b9e99335d8c3fba824f543a3f7ecb67b3516b834aeeabdb10817ea684715ca58a39dfed209e484b0366bc45da5deb06b11e7480a03921564ca0e587c013124

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI50762\select.pyd
    Filesize

    26KB

    MD5

    7a442bbcc4b7aa02c762321f39487ba9

    SHA1

    0fcb5bbdd0c3d3c5943e557cc2a5b43e20655b83

    SHA256

    1dd7bba480e65802657c31e6d20b1346d11bca2192575b45eb9760a4feb468ad

    SHA512

    3433c46c7603ae0a73aa9a863b2aecd810f8c0cc6c2cd96c71ef6bde64c275e0fceb4ea138e46a5c9bf72f66dcdea3e9551cf2103188a1e98a92d8140879b34c

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI50762\sqlite3.dll
    Filesize

    1.4MB

    MD5

    ae6c9d9f085262b4623791babb088e3f

    SHA1

    d908cbfd291a72f355a2080f6670eb7c661fde08

    SHA256

    2934dba913caf3cea148207d8c4506350a02f0d4e150bba229113ebe8fe3bc6b

    SHA512

    1438adbb5925f5da07eef6e50f40ac8c56e46b8c69e926c3cba183fc2316344ae6afa0897d1000492804b5809808eb17a74ccb0bf5acef0fe0575f861a594b89

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI50762\win32api.pyd
    Filesize

    129KB

    MD5

    89eee66d83078fa98f311a6b66d2a09b

    SHA1

    64b134f1c3d7e14bb2692c5ba76a05e9f220c865

    SHA256

    dcfad31a1de654ff087f4061cab8475ab887a55f0dd2a08a4ec7d19882e70c81

    SHA512

    dbc54438723860a626a6e2902c756f6b439f7b82302a1017efb4bd750bcd815e72670aed238e4e81abedb2b361b7a70d07926f50d5482b099ea50efa2e4d276a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI50762\win32crypt.pyd
    Filesize

    122KB

    MD5

    13efc000474e2b066a0e403ab727e1ed

    SHA1

    e3c62a0916d98b923f42ef22c4c54dca190c3c52

    SHA256

    14fe77645a2b87effcae6821606be29b4bac828e826ee071d7be658fd7776d01

    SHA512

    8896dce86edf4e17989386ba09e41bea9770addf3d0f6d31f4386da98ecc8f7987563d9d1a3c8712d91726672807627dce1b82149880f42238821628b5238ac5

    Download Submit