Overview

overview

7

Static

static

3

2024-06-07...uk.exe

windows7-x64

7

2024-06-07...uk.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/06/2024, 01:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2024-06-07_34f23256ee91bb78db503bf91c69f116_ponmocup_ryuk.exe
  • Size 14.8MB
  • Sample240607-bfb7haeh3x
  • SHA256 bd493b8b42c81ace6870df5806956a792c5ea2536128e173c6cdd1cd587495da
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 44 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-07_34f23256ee91bb78db503bf91c69f116_ponmocup_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-07_34f23256ee91bb78db503bf91c69f116_ponmocup_ryuk.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3608
    • C:\Users\Admin\AppData\Local\Temp\2024-06-07_34f23256ee91bb78db503bf91c69f116_ponmocup_ryuk.exe
      "C:\Users\Admin\AppData\Local\Temp\2024-06-07_34f23256ee91bb78db503bf91c69f116_ponmocup_ryuk.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:4580
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c cls
        3⤵
          PID:1920

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          _raw_cbc.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI36082\Cryptodome\Cipher\_raw_cbc.pyd
          • Size 12KB
          • SHA256 34842e83ed73671dd45e75fc22a60b594957bfa1e5ed13b1b40f19f8a9e86c00
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _raw_cfb.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI36082\Cryptodome\Cipher\_raw_cfb.pyd
          • Size 12KB
          • SHA256 bbe259f69208547b965507c0f38a3a1351f633a11dc3892db5399eac100d0a3a
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _raw_ctr.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI36082\Cryptodome\Cipher\_raw_ctr.pyd
          • Size 13KB
          • SHA256 025a0858fa95090644dfe24f7e5966a00ace248295ba6b2ba561b69d354642f9
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _raw_ecb.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI36082\Cryptodome\Cipher\_raw_ecb.pyd
          • Size 10KB
          • SHA256 eeb8f90272ccbfb41d15c304edb1d3fa65babbd25807143a02d1faa301e130c6
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _raw_ofb.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI36082\Cryptodome\Cipher\_raw_ofb.pyd
          • Size 11KB
          • SHA256 52c67f05d8914e6fe69903e3933b010523363bcf4dba854275b3ed7ed92b5a51
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _BLAKE2s.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI36082\Cryptodome\Hash\_BLAKE2s.pyd
          • Size 13KB
          • SHA256 903db6a4377843eec733fc86de40876b6a5c6e0bb2e810922ce8d147ba916fdc
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _strxor.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI36082\Cryptodome\Util\_strxor.pyd
          • Size 10KB
          • SHA256 ec3f34a1d3aff71ec9981e06cdd9a5b4a1ee0b57edf09e851bc010cb5d03eef1
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          VCRUNTIME140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI36082\VCRUNTIME140.dll
          • Size 99KB
          • SHA256 ff43e813785ee948a937b642b03050bb4b1c6a5e23049646b891a66f65d4c833
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _bz2.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI36082\_bz2.pyd
          • Size 75KB
          • SHA256 dd844936964c319f13b75d8a63df727b607722ce148f869c660d69ac438e7018
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _cffi_backend.cp39-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI36082\_cffi_backend.cp39-win_amd64.pyd
          • Size 178KB
          • SHA256 277be58254ebad12d501ef5ee57953edd3a5d50ec90433e982338565418fdbcb
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _ctypes.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI36082\_ctypes.pyd
          • Size 114KB
          • SHA256 c5461e536df1fc7bb1863fb367ae7008a6144c1eba59caba7835a3e07577d781
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _hashlib.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI36082\_hashlib.pyd
          • Size 54KB
          • SHA256 2e1af327d552daa71dd0ce7ea9e182fb1bbffe2cacfa7366c1f164c218a51993
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _lzma.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI36082\_lzma.pyd
          • Size 151KB
          • SHA256 ca3b7b7379d0e6f61520ef9fcb58db28bb61956282bcd58fe4e323e8c8473718
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _queue.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI36082\_queue.pyd
          • Size 21KB
          • SHA256 4f6b9cb28766fb8c3ff7e7d2d774fbd174dfca032596e7c6eaba8f0ac6c8adb8
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _socket.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI36082\_socket.pyd
          • Size 70KB
          • SHA256 4e0c655dece6b288f33d247811666bbbaa58d8a83d0075292039c1890c6dd0a2
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _sqlite3.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI36082\_sqlite3.pyd
          • Size 80KB
          • SHA256 bff3c8ead4ae7be937dd5afbac46fa40e7d8b4bf759208d71e831ee25a2dc837
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _ssl.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI36082\_ssl.pyd
          • Size 141KB
          • SHA256 bd4b1c32c0a26ad376bbeebe0bf2958832fd5f54f5f1028929a72ca992293972
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          base_library.zip
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI36082\base_library.zip
          • Size 763KB
          • SHA256 909423db60ea9007c1b1793aba37c46a0d7cc33187bf4574263ec3360dbcaed2
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _brotli.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI36082\brotli\_brotli.pyd
          • Size 811KB
          • SHA256 d3181bf2c08e470fda6ceeb9a91727957e31c65678284aff9d4b139a71ccf5ed
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          libcrypto-1_1-x64.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI36082\libcrypto-1_1-x64.dll
          • Size 3.3MB
          • SHA256 2b2f590b7f26056a8732e78e3cd5d25a31348007d734e8cc830412edb60f2ac7
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          libffi-7.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI36082\libffi-7.dll
          • Size 32KB
          • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          libssl-1_1-x64.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI36082\libssl-1_1-x64.dll
          • Size 667KB
          • SHA256 0ed203cd20b101dba0d4e525f2661e6767d18bec4cdb32da253bb8c1fa8712a2
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          pyexpat.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI36082\pyexpat.pyd
          • Size 178KB
          • SHA256 a07306d3a10ec5dc588bbec6949e500ffb1770b0aa3fc057b7f2fdf8883f1bf1
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          python3.DLL
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI36082\python3.DLL
          • Size 50KB
          • SHA256 93b1280829ed13258ef51ab45f49177d5ffbf1fa58a191d2635a2b1772e777ee
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          python39.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI36082\python39.dll
          • Size 4.2MB
          • SHA256 e7d84c98adba37273b694bc1d12639ef0326c9f79265d5ba326a8c279015d0bc
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          pythoncom39.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI36082\pythoncom39.dll
          • Size 546KB
          • SHA256 cf01f08c2f36731aba2fe4daf95568c59db25fcfac4d4eef3f74cd2385acf78c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          pywintypes39.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI36082\pywintypes39.dll
          • Size 136KB
          • SHA256 2203ed58f42839d62fd236eadb469f2885572d04c4ec79cbf7f68d0a246862c9
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          select.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI36082\select.pyd
          • Size 20KB
          • SHA256 779b62bd3faaf7f9503c429f38b78da1e7ef8e997a066ead774ca96c915c45d4
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          sqlite3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI36082\sqlite3.dll
          • Size 1.5MB
          • SHA256 720b8374953d41aeb9613ba1876258c1ee00779c4f3b92ce58e6b7bd578e0ea2
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          ucrtbase.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI36082\ucrtbase.dll
          • Size 992KB
          • SHA256 8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          unicodedata.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI36082\unicodedata.pyd
          • Size 1.1MB
          • SHA256 ee7bae1d71355fe294637f4bb3824d946c2af63193ea7476d52d08bfee4494fa
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          win32api.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI36082\win32api.pyd
          • Size 130KB
          • SHA256 28e34943a737bd8b063636eef99e80cb9c9c1721b6da59188c9bd6bc2b448115
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download