Overview

overview

7

Static

static

3

2024-06-07...uk.exe

windows7-x64

7

2024-06-07...uk.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    132s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/06/2024, 02:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2024-06-07_da4c702feb4173096677bd03ddc4d30e_ryuk.exe
  • Size 9.5MB
  • Sample240607-ctjzyahb77
  • SHA256 c5edf63845834710262412672f13acb297b5b9da97c7fa3daddf7505887ea9af
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 39 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-07_da4c702feb4173096677bd03ddc4d30e_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-07_da4c702feb4173096677bd03ddc4d30e_ryuk.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3828
    • C:\Users\Admin\AppData\Local\Temp\2024-06-07_da4c702feb4173096677bd03ddc4d30e_ryuk.exe
      "C:\Users\Admin\AppData\Local\Temp\2024-06-07_da4c702feb4173096677bd03ddc4d30e_ryuk.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:4144
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "chcp 65001 && ipconfig | findstr /i "Default Gateway""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4080
        • C:\Windows\system32\chcp.com
          chcp 65001
          4⤵
            PID:224
          • C:\Windows\system32\ipconfig.exe
            ipconfig
            4⤵
            • Gathers network information
            PID:1824
          • C:\Windows\system32\findstr.exe
            findstr /i "Default Gateway"
            4⤵
              PID:3664
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "@chcp 65001 1>nul"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2496
            • C:\Windows\system32\chcp.com
              chcp 65001
              4⤵
                PID:3824

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              _Salsa20.cp38-win_amd64.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI38282\Crypto\Cipher\_Salsa20.cp38-win_amd64.pyd
              • Size 15KB
              • SHA256 ae06473c3bae466d962d2c017da97fe5dbb9788469664c5b7c016804dabf4379
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              _raw_cbc.cp38-win_amd64.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI38282\Crypto\Cipher\_raw_cbc.cp38-win_amd64.pyd
              • Size 13KB
              • SHA256 259fd983c5316eae28a8675a13c7e872d13a6f9ce944af06c9142ca21880fd6a
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              _raw_cfb.cp38-win_amd64.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI38282\Crypto\Cipher\_raw_cfb.cp38-win_amd64.pyd
              • Size 13KB
              • SHA256 cdd52145642342a60bc7d21a8e13e290350a44bcc04b42abd547bee251b2c4e4
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              _raw_ctr.cp38-win_amd64.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI38282\Crypto\Cipher\_raw_ctr.cp38-win_amd64.pyd
              • Size 14KB
              • SHA256 17e862ef6c23394fd8b4d9193db15ba82adeb9e0c04fc23b571592db91900b62
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              _raw_ecb.cp38-win_amd64.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI38282\Crypto\Cipher\_raw_ecb.cp38-win_amd64.pyd
              • Size 11KB
              • SHA256 368983efc03e6db0d7d85dd7f5c78083a809104b63e052f4f7125f8e386d241a
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              _raw_ofb.cp38-win_amd64.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI38282\Crypto\Cipher\_raw_ofb.cp38-win_amd64.pyd
              • Size 12KB
              • SHA256 47814833d84f993cbabb6cfdf45c2fc4458f14822b408aa0a110a39ee2752dd5
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              _BLAKE2s.cp38-win_amd64.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI38282\Crypto\Hash\_BLAKE2s.cp38-win_amd64.pyd
              • Size 15KB
              • SHA256 072c47ee36c8e7df7bf8fa383525b0d64d1e5466ee400f25965e6d808e07b1f2
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              _MD5.cp38-win_amd64.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI38282\Crypto\Hash\_MD5.cp38-win_amd64.pyd
              • Size 16KB
              • SHA256 79d82d1eae2b0276def914be88134df45d2d2442d1743fa3626d4072c143ddfc
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              _SHA1.cp38-win_amd64.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI38282\Crypto\Hash\_SHA1.cp38-win_amd64.pyd
              • Size 19KB
              • SHA256 25bc689ebfbe6a76b7d93b48538afa3979b032eeeeacb74685c72e9c0d837cbf
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              _SHA256.cp38-win_amd64.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI38282\Crypto\Hash\_SHA256.cp38-win_amd64.pyd
              • Size 21KB
              • SHA256 78d9bf2b2e4740479568e740ae66113af6786f2ab53eea24287b21a648754ebc
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              _ghash_portable.cp38-win_amd64.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI38282\Crypto\Hash\_ghash_portable.cp38-win_amd64.pyd
              • Size 13KB
              • SHA256 56c7433de77a8b24cbe9534dd56bf882f5969cfa692f0e100b8e0466c78a55d4
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              _scrypt.cp38-win_amd64.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI38282\Crypto\Protocol\_scrypt.cp38-win_amd64.pyd
              • Size 13KB
              • SHA256 88e497ec9fe5763413bbbe9cc00834bd34e783d2870a5099eca1f96b2fee5c05
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              _cpuid_c.cp38-win_amd64.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI38282\Crypto\Util\_cpuid_c.cp38-win_amd64.pyd
              • Size 11KB
              • SHA256 ee3f0342547dabff1d26c517b76cdfd9c01d5bdda88781d25edc5ca9af76d38c
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              _strxor.cp38-win_amd64.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI38282\Crypto\Util\_strxor.cp38-win_amd64.pyd
              • Size 11KB
              • SHA256 74f72638b25b61b0d76d41c0f286fce7b2926843b26875c803cfaa3f195e25a3
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              RAT.exe.manifest
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI38282\RAT.exe.manifest
              • Size 1KB
              • SHA256 16eb5be26d647cc8c248ad035d137c7d21e326d1735e8bb9f76d70e0bb0fb7e8
              • MD5 SHA1 SHA512
              Submit Download

              VCRUNTIME140.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI38282\VCRUNTIME140.dll
              • Size 91KB
              • SHA256 8ee6b49830436ff3bec9ba89213395427b5535813930489f118721fd3d2d942c
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              _bz2.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI38282\_bz2.pyd
              • Size 85KB
              • SHA256 d6e5763cecd267be0ff5355ff53e93428f3dd7ab20458fb1e7432dffa060cf82
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              _ctypes.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI38282\_ctypes.pyd
              • Size 123KB
              • SHA256 64f5072cd9536418ec0fd4b5c30c13b03cdddced1f9332d4d721c4b37ae3883e
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              _hashlib.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI38282\_hashlib.pyd
              • Size 46KB
              • SHA256 46d3016b73ecf3713228df563971feefcbebcea9925349a0807b48f0e09877ce
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              _lzma.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI38282\_lzma.pyd
              • Size 159KB
              • SHA256 d7acc95049c07298af56a316419e6548f3e6b56fb22dfb3382607a803dddb5e0
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              _portaudio.cp38-win_amd64.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI38282\_portaudio.cp38-win_amd64.pyd
              • Size 201KB
              • SHA256 a35531c046271b4e0355e0d6d2844d886480b01220b71e4795263312f50beea6
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              _socket.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI38282\_socket.pyd
              • Size 77KB
              • SHA256 85f200cb9adf0ef97d40b897868f6ad564211d3529f0b6dfe8e04c56a7b832bc
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              _sqlite3.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI38282\_sqlite3.pyd
              • Size 87KB
              • SHA256 c9253f9c5409fca37b5ce0276d2fde0f64f76271473538d3fa08293b7d98befc
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              _ssl.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI38282\_ssl.pyd
              • Size 151KB
              • SHA256 174ec95c793fc33a97c57709b5117ca17700b90e7c71d72c9ec4bc7757b747a9
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              base_library.zip
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI38282\base_library.zip
              • Size 769KB
              • SHA256 f3e58ff7934121e40cbc45d80c9db4d65a826349805c3194e8b8f28aa74e94cb
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              libcrypto-1_1.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI38282\libcrypto-1_1.dll
              • Size 3.2MB
              • SHA256 00a1eeb37372d11559bf44c9e68af9c841c41c95a173f3dfec4e0b5923d0cae0
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              libffi-7.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI38282\libffi-7.dll
              • Size 32KB
              • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              libssl-1_1.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI38282\libssl-1_1.dll
              • Size 673KB
              • SHA256 1b57a201184559164dedbddcb43bb110a18cafa19ea3d00fc23274ccfc420e94
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              python38.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI38282\python38.dll
              • Size 4.0MB
              • SHA256 560a6a5f8b7afa99600cc47da26a802c342d7f50ffe23850372f2fcf536cd26f
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              pywintypes38.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI38282\pywintypes38.dll
              • Size 139KB
              • SHA256 bff7b09303260eaf01ba73687d979ce6d1d50458426686bea7b01dea5db446d4
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              select.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI38282\select.pyd
              • Size 27KB
              • SHA256 bb81d220db83d5276fccda137d430160b8eafd40f4d92d86ebc718b4dfd555ac
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              sqlite3.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI38282\sqlite3.dll
              • Size 1.4MB
              • SHA256 31763682584428a1a3fffd1fa8318eeb011992c9902b85a173005c79d2d6322c
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              win32gui.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI38282\win32gui.pyd
              • Size 224KB
              • SHA256 7be1d0d32c4635c655561904c2110dfc0e8420c583d5fc7a16fbc3f68f8b6753
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download