Analysis
- max time kernel
148s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
07/06/2024, 02:10
General
- Target 2024-06-07_bb8f5375ab38d5e0137c45d48be7a958_ryuk.exe
- Size 6.9MB
- Sample240607-cl4dlsfh7x
- SHA256 c216e8d6f67ab151ee8e9f4e534587ed9e62312f1a0b31315b026c9c69cbf674
Malware Config
Signatures
- Loads dropped DLL 19 IoCs
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-07_bb8f5375ab38d5e0137c45d48be7a958_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-07_bb8f5375ab38d5e0137c45d48be7a958_ryuk.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-06-07_bb8f5375ab38d5e0137c45d48be7a958_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-07_bb8f5375ab38d5e0137c45d48be7a958_ryuk.exe"2⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "chcp 65001 && ipconfig | findstr /i "Default Gateway""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
C:\Windows\system32\ipconfig.exeipconfig4⤵
- Gathers network information
-
-
C:\Windows\system32\findstr.exefindstr /i "Default Gateway"4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
RAT.exe.manifest
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_hashlib.pyd
_lzma.pyd
_portaudio.cp37-win_amd64.pyd
_pytransform.dll
_queue.pyd
_socket.pyd
_ssl.pyd
base_library.zip
cacert.pem
libcrypto-1_1.dll
libssl-1_1.dll
python37.dll
pywintypes37.dll
select.pyd
unicodedata.pyd
win32api.pyd
win32gui.pyd
memory/4412-88-0x00000239CD160000-0x00000239CD161000-memory.dmp
memory/4412-64-0x00000239CD160000-0x00000239CD161000-memory.dmp
memory/4412-94-0x00000239CD160000-0x00000239CD161000-memory.dmp
memory/4412-92-0x00000239CD160000-0x00000239CD161000-memory.dmp
memory/4412-90-0x00000239CD160000-0x00000239CD161000-memory.dmp
memory/4412-98-0x00000239CD160000-0x00000239CD161000-memory.dmp
memory/4412-86-0x00000239CD160000-0x00000239CD161000-memory.dmp
memory/4412-84-0x00000239CD160000-0x00000239CD161000-memory.dmp
memory/4412-82-0x00000239CD160000-0x00000239CD161000-memory.dmp
memory/4412-80-0x00000239CD160000-0x00000239CD161000-memory.dmp
memory/4412-78-0x00000239CD160000-0x00000239CD161000-memory.dmp
memory/4412-76-0x00000239CD160000-0x00000239CD161000-memory.dmp
memory/4412-74-0x00000239CD160000-0x00000239CD161000-memory.dmp
memory/4412-72-0x00000239CD160000-0x00000239CD161000-memory.dmp
memory/4412-70-0x00000239CD160000-0x00000239CD161000-memory.dmp
memory/4412-68-0x00000239CD160000-0x00000239CD161000-memory.dmp
memory/4412-66-0x00000239CD160000-0x00000239CD161000-memory.dmp
memory/4412-96-0x00000239CD160000-0x00000239CD161000-memory.dmp
memory/4412-62-0x00000239CD160000-0x00000239CD161000-memory.dmp
memory/4412-60-0x00000239CD160000-0x00000239CD161000-memory.dmp
memory/4412-58-0x00000239CD160000-0x00000239CD161000-memory.dmp
memory/4412-56-0x00000239CD160000-0x00000239CD161000-memory.dmp
memory/4412-54-0x00000239CD160000-0x00000239CD161000-memory.dmp
memory/4412-52-0x00000239CD160000-0x00000239CD161000-memory.dmp
memory/4412-50-0x00000239CD160000-0x00000239CD161000-memory.dmp
memory/4412-48-0x00000239CD160000-0x00000239CD161000-memory.dmp
memory/4412-46-0x00000239CD160000-0x00000239CD161000-memory.dmp
memory/4412-44-0x00000239CD160000-0x00000239CD161000-memory.dmp
memory/4412-100-0x00000239CD160000-0x00000239CD161000-memory.dmp
memory/4412-102-0x00000239CD160000-0x00000239CD161000-memory.dmp
memory/4412-261-0x00000239CD150000-0x00000239CD151000-memory.dmp
memory/4412-262-0x00000239CD160000-0x00000239CD161000-memory.dmp
memory/4412-104-0x00000239CD160000-0x00000239CD161000-memory.dmp