Overview

overview

7

Static

static

3

2024-06-07...uk.exe

windows7-x64

7

2024-06-07...uk.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    1s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/06/2024, 01:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2024-06-07_57a958b6559331a9b8cf6a2d1588203f_ryuk.exe
  • Size 16.0MB
  • Sample240607-bnebtsfa6s
  • SHA256 bbb9cb6e8e5b9d7e91b4a2c00aafe8d4af371f4857186882c90a2e0fe3606faa
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
spywarestealer

Malware Config

Signatures

  • Loads dropped DLL 59 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of AdjustPrivilegeToken 42 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-07_57a958b6559331a9b8cf6a2d1588203f_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-07_57a958b6559331a9b8cf6a2d1588203f_ryuk.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4272
    • C:\Users\Admin\AppData\Local\Temp\2024-06-07_57a958b6559331a9b8cf6a2d1588203f_ryuk.exe
      "C:\Users\Admin\AppData\Local\Temp\2024-06-07_57a958b6559331a9b8cf6a2d1588203f_ryuk.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:3808
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
          PID:5036
        • C:\Windows\System32\Wbem\wmic.exe
          wmic path softwarelicensingservice get OA3xOriginalProductKey
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1588
        • C:\Windows\System32\Wbem\wmic.exe
          wmic os get Caption
          3⤵
            PID:3328
          • C:\Windows\System32\Wbem\wmic.exe
            wmic os get SerialNumber
            3⤵
              PID:1680
            • C:\Windows\System32\Wbem\wmic.exe
              wmic os get Manufacturer
              3⤵
                PID:4420
              • C:\Windows\System32\Wbem\wmic.exe
                wmic os get EncryptionLevel
                3⤵
                  PID:4376
                • C:\Windows\System32\Wbem\wmic.exe
                  wmic os get InstallDate
                  3⤵
                    PID:4960
                  • C:\Windows\System32\Wbem\wmic.exe
                    wmic os get LastBootUpTime
                    3⤵
                      PID:4724
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c del C:\ProgramData\chromepasswords.txt
                      3⤵
                        PID:4980
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c del C:\ProgramData\edgepasswords.txt
                        3⤵
                          PID:1028
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\ProgramData\operapasswords.txt
                          3⤵
                            PID:4116
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\ProgramData\bravepasswords.txt
                            3⤵
                              PID:2284
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c del C:\ProgramData\victimfiles.zip
                              3⤵
                                PID:1508

                          Network

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                _Salsa20.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI42722\Crypto\Cipher\_Salsa20.pyd
                                • Size 13KB
                                • SHA256 28efd36be6bbbc56a7219bed7cc132ce67baf629100cc03a08a804360f483db9
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                _raw_cbc.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI42722\Crypto\Cipher\_raw_cbc.pyd
                                • Size 12KB
                                • SHA256 2a5ab7f23554f497693ca81a5e5f21647b10fd8b9e00b8377d8385dc15a9c4df
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                _raw_cfb.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI42722\Crypto\Cipher\_raw_cfb.pyd
                                • Size 13KB
                                • SHA256 b5438682a4c6bf57dcaad2835a9a293f712284fbe1af4ba6059011396cdbd180
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                _raw_ctr.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI42722\Crypto\Cipher\_raw_ctr.pyd
                                • Size 14KB
                                • SHA256 2f9dfa9de351bfe553dde60ae891e9b54a2e08546d723c7165234fd41c3ceed4
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                _raw_ecb.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI42722\Crypto\Cipher\_raw_ecb.pyd
                                • Size 10KB
                                • SHA256 821a86630238beaf4e303196ce26a250ef873f7a98b92644566b3c7d683d400e
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                _raw_ofb.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI42722\Crypto\Cipher\_raw_ofb.pyd
                                • Size 12KB
                                • SHA256 236650fc42b347b9caa5e3a84a13da9e40586d97762f87730c9016dcb81abf06
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                _BLAKE2s.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI42722\Crypto\Hash\_BLAKE2s.pyd
                                • Size 13KB
                                • SHA256 825039711c334e169432a482f8b71ae735d7a1bd56552e501f6f3eca87cf272e
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                _MD5.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI42722\Crypto\Hash\_MD5.pyd
                                • Size 15KB
                                • SHA256 efb961372f6ce102a9836b63038ae1385b408ef8dcf2de7238b2403a6e987b27
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                _SHA1.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI42722\Crypto\Hash\_SHA1.pyd
                                • Size 17KB
                                • SHA256 6cc9cfa3c9739b545808e814a661b5b54e9127b057ce503024e515648b7a4a33
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                _SHA256.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI42722\Crypto\Hash\_SHA256.pyd
                                • Size 21KB
                                • SHA256 1b36afc5b2f6f46d1a2457d56f276f5b5ffed066955acec911b9b7973d1e92b3
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                _strxor.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI42722\Crypto\Util\_strxor.pyd
                                • Size 10KB
                                • SHA256 6429928799a5eea9e090224a2d7083b469892d725a28ea9dcc2a95f94286b0da
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                VCRUNTIME140.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI42722\VCRUNTIME140.dll
                                • Size 93KB
                                • SHA256 6a0850419432735a98e56857d5cfce97e9d58a947a9863ca6afadd1c7bcab27c
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                _bz2.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI42722\_bz2.pyd
                                • Size 84KB
                                • SHA256 20895fa331712701ebfdbb9ab87e394309e910f1d782929fd65b59ed76d9c90f
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                _cffi_backend.cp39-win_amd64.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI42722\_cffi_backend.cp39-win_amd64.pyd
                                • Size 178KB
                                • SHA256 3d3aeb22fd97a8bd2fee53412ce43466c76f22a1fd918b769ab6a58bf859d5a2
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                _ctypes.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI42722\_ctypes.pyd
                                • Size 124KB
                                • SHA256 73acf2e0e28040cd696255abd53caaa811470b17a07c7b4d5a94f346b7474391
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                _hashlib.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI42722\_hashlib.pyd
                                • Size 64KB
                                • SHA256 12a84bacb071b1948a9f751ac8d0653ba71a8f6b217a69fe062608e532065c20
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                _lzma.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI42722\_lzma.pyd
                                • Size 159KB
                                • SHA256 6384ded31408788d35a89dc3f7705ea2928f6bbdeb8b627f0d1b2d7b1ea13e16
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                _socket.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI42722\_socket.pyd
                                • Size 78KB
                                • SHA256 258a5f0b4d362b2fed80b24eeabcb3cdd1602e32ff79d87225da6d15106b17a6
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                _ssl.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI42722\_ssl.pyd
                                • Size 151KB
                                • SHA256 e4aa33b312cec5aa5a0b064557576844879e0dccc40047c9d0a769a1d03f03f6
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                base_library.zip
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI42722\base_library.zip
                                • Size 771KB
                                • SHA256 349824fc87c5e773af5d50a2d39c54968b3f74c2a22a92ef12d2b09984212694
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                libcrypto-1_1.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI42722\libcrypto-1_1.dll
                                • Size 3.2MB
                                • SHA256 296426e7ce11bc3d1cfa9f2aeb42f60c974da4af3b3efbeb0ba40e92e5299fdf
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                libffi-7.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI42722\libffi-7.dll
                                • Size 32KB
                                • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                libssl-1_1.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI42722\libssl-1_1.dll
                                • Size 674KB
                                • SHA256 fddd0da02dcd41786e9aa04ba17ba391ce39dae6b1f54cfa1e2bb55bc753fce9
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                _version.cp39-win_amd64.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI42722\lz4\_version.cp39-win_amd64.pyd
                                • Size 10KB
                                • SHA256 a575c09fee7858867754b1cfb1ee00f197b5062415e72f337f8471ee949692d6
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                _block.cp39-win_amd64.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI42722\lz4\block\_block.cp39-win_amd64.pyd
                                • Size 119KB
                                • SHA256 6091ed63720122690d97b0ff077e342284a65773d2427265676f14c58f6246d4
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                pyexpat.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI42722\pyexpat.pyd
                                • Size 187KB
                                • SHA256 f5d8188c6674cbd814abd1e0dd4e5a8bfadb28e31b5088ae6c4346473b03d17e
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                python3.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI42722\python3.dll
                                • Size 58KB
                                • SHA256 1dc81d8066d44480163233f249468039d3de97e91937965e7a369ae1499013da
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                python39.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI42722\python39.dll
                                • Size 4.3MB
                                • SHA256 a56afcf5f3a72769c77c3bc43c9b84197180a8b3380b6258073223bfd72ed47a
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                python39.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI42722\python39.dll
                                • Size 2.1MB
                                • SHA256 cf5ae0fe16544dd2780ad7f2bc70c5a9b761655f7c9f5bdc6f85fd418f5d1b4f
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                pythoncom39.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI42722\pythoncom39.dll
                                • Size 543KB
                                • SHA256 9b3d25eb5b8cd86dac4b6301df30c2a9b9815732e52b6d8e96bf58a6ad988a84
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                pywintypes39.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI42722\pywintypes39.dll
                                • Size 139KB
                                • SHA256 4dcdc4f5e684d0c031122515b4f089e33dc0cc9869ef1ab65832ac90cf428906
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                select.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI42722\select.pyd
                                • Size 28KB
                                • SHA256 c7ffae6dc927cf10ac5da08614912bb3ad8fc52aa0ef9bc376d831e72dd74460
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                win32api.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI42722\win32api.pyd
                                • Size 131KB
                                • SHA256 2ab33cca6227c6a2d5d9cc5e694a678a292b3b26e299cb94343a466900d7014c
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download