c11c18a22373cf00e8553e88c21b0b1a398d03752843472be6c088109e1a0fcf

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2024, 02:37

Target
2024-06-07_ee980667b09176dfeb1eab28e67b6e9a_ryuk.exe
Size 5.0MB
Sample240607-c366tsgc4t
SHA256 c11c18a22373cf00e8553e88c21b0b1a398d03752843472be6c088109e1a0fcf
MD5 ee980667b09176dfeb1eab28e67b6e9a
SHA1 3a35d352530345aeb9a8beacad5398257867032e
SHA512 52a3d32b3fc59f91936cb68d7d3d22ed73bd2ae44748f6ed05c0815f6c0e889368fb0f3a59328f85a7b9086e750ce3c63c6bf6f4964d9c182c819beef7764e22
SSDEEP 98304:U4bVJ9FevYYMeBFh5iFIRv2Vb8UcfR5N1dyBQPnRNJe1B+XKRbFAuacBSA:UCneMeR5U8UcfR5vSGRNJpLua
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Loads dropped DLL 6 IoCs

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2832	2024-06-07_ee980667b09176dfeb1eab28e67b6e9a_ryuk.exe
2832	2024-06-07_ee980667b09176dfeb1eab28e67b6e9a_ryuk.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3104 wrote to memory of 2832	3104	2024-06-07_ee980667b09176dfeb1eab28e67b6e9a_ryuk.exe	84
PID 3104 wrote to memory of 2832	3104	2024-06-07_ee980667b09176dfeb1eab28e67b6e9a_ryuk.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-06-07_ee980667b09176dfeb1eab28e67b6e9a_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-07_ee980667b09176dfeb1eab28e67b6e9a_ryuk.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3104
- C:\Users\Admin\AppData\Local\Temp\2024-06-07_ee980667b09176dfeb1eab28e67b6e9a_ryuk.exe
  "C:\Users\Admin\AppData\Local\Temp\2024-06-07_ee980667b09176dfeb1eab28e67b6e9a_ryuk.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:2832

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31042\_ctypes.pyd
Size 119KB
SHA256 a93e3bfe62afa5062c6257a7f347d715af346ac3aec7999b8d86a9f2580ec176
MD5 28e5d05ab42adb1e7ada35f1eef1b32b
SHA1 0792867716c8a933305455a2c7f39d30807dad65
SHA512 0cb08ec46068e20a2df3fc0e69bceba5b8a807aeb580002e846d9272fea7a6ee24b8f2c571571677b61dd8c58eb998c26a656193798de5075c6943f6d701c569
SSDEEP 3072:XqD02aM374N+3EbbLrLyOLsWyR4jfJyPZmMAh5J7SYi:tU74N+3EbbLrLNLhJjfJRMAbJpi
MD5 SHA1 SHA512 SSDEEP

Submit Download

build.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\_MEI31042\build.exe.manifest
Size 1KB
SHA256 a2fccd0b00edebad006c0f936d9c530a266c97dc732a681afeea31174d8c4355
MD5 2c7f95c03acd1ee8d82c0c8a435e889a
SHA1 7f59c23a18b68f92600394d1f2f13bb797c830c2
SHA512 fb35bd69b3ab7cad5146dc89061a24bd6f37017960730112168bdb87f15cef9c8ad93931f0bded091985aae064c170cda8509d53875c0ff71e42a4e57d0c1b62
MD5 SHA1 SHA512

Submit Download

python27.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI31042\python27.dll
Size 3.3MB
SHA256 2ae1f70a99a8f760d3883258f0f69ae759b48270b07036e41b1e887add0c3cfc
MD5 4fc438493188550ea7dfb0cc153b4983
SHA1 2e7e79cee5ca14a584c49d7222cecd4a53beac41
SHA512 5f91ddf65fa94129c2e483400327d564a8ce3e3b9dea3a5294fdb6bbd5ee599f89003da8922d1f3904dbab7bd0d4b23fc355f1854e6b34a7f012c1065e88053e
SSDEEP 49152:rFYYSank9NCKMFj7PqPibNkc3CfPfnRM0gHQN1IDTP4j+yH3T5:FkPuuBvRMNHiaEpj5
MD5 SHA1 SHA512 SSDEEP

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31~1\_hashlib.pyd
Size 1.6MB
SHA256 cda9a6478417629cb40809aad57bd5a884f183333506d00008d16e47368fd633
MD5 6f784c403e2097d11331f8778f6d9d2c
SHA1 64ecd6ee875f89a88204e673acae9547992fd085
SHA512 c1fbd548f03a46ee19cd003831bcb53df204cd1c71ab672955a2ff19267c523a17970f8fb9586e712665c09b54c19338037a38a425dacb857aae5b6162fa282c
SSDEEP 24576:/k4G5BcjSnTFZ+4zM7CuqXzdx6HyPfKGtlq/VwASOJHpyN0c:/3GBcjSnxzPpWyXKGtlq/VwASOJHpy
MD5 SHA1 SHA512 SSDEEP

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31~1\_socket.pyd
Size 50KB
SHA256 a75aa54781de3c97f5b4c2e0389d5ad39602cda6fcd5a3810667a4cf24f4286a
MD5 f28dc3a4451c29fea272d7ae063425c5
SHA1 ece376146a7115cd5b1ad141a59fff25b6da6a5d
SHA512 746b1b608c457cdf8aa784683533e1220c60dd689f7f5266013f1194e9fd091123eb11d697119b9de65686019176062eb9aba04d2845930369829182a399b5e5
SSDEEP 768:txzhmVR45ePaPwfrGe50ehXfnDMUWYVyzWGzH1P/FbsN7us1e9FTOyW:txzqR45ePIwqeDhXfn0HV/FbC7febr
MD5 SHA1 SHA512 SSDEEP

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31~1\_ssl.pyd
Size 2.0MB
SHA256 2c4cb4459c37a2152698e19f27350a7dbf56c51509689b1d7a65c60fb5a75751
MD5 9c6d526768f8395aecff0af0d27f0063
SHA1 a580e2782c31ffb9365ea31dce8b337aae9eee07
SHA512 52bc14aa9f6bb6822740b7be98187fba1adf86f484e130ac6df3fad6e456b41288cbb9c8abf9d7af8730e9c0f7438ed362582ee7f39a5cab9cf471bb5b84b9eb
SSDEEP 49152:rQ59wWjSi7o2NjGAGtlqQOgVwASO4oSp/W:rtAsYx
MD5 SHA1 SHA512 SSDEEP

Submit Download

bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31~1\bz2.pyd
Size 90KB
SHA256 985902e0813564981059c2f57282614f5a907dc3df0273ba7bef2ad64123c921
MD5 51fdb7790e680a394e9936498d3a73fa
SHA1 fab9f97feee68fbd9225de051349ac3258920fa2
SHA512 594153dd913a3369d310980b0e53bc6a10174e18b0b416dc1b86b2401b4bd94546bee9fbde7421e102490ccba4c8a8d7b91b3df5e3c0506cc98b51bc63e15c50
SSDEEP 1536:y2swYRURXPj3/W3yd/nVu26F3RjrEOxZhuhiDOou9vquMpY62e84+f/PPgTt/:iwYRUR7/W3yd/npS3BE8uhiDO3vquGYa
MD5 SHA1 SHA512 SSDEEP

Submit Download