Overview

overview

7

Static

static

3

2024-06-07...uk.exe

windows7-x64

7

2024-06-07...uk.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    93s
  • max time network
    101s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/06/2024, 08:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2024-06-07_768adec9f7ecc0b933f2e52cb00e6195_ryuk.exe
  • Size 17.3MB
  • Sample240607-jw15kaeb42
  • SHA256 b1a3c9b622d845625d1263f78c057e7c38512f44caeb13c0df265f2e63014ef9
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 25 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-07_768adec9f7ecc0b933f2e52cb00e6195_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-07_768adec9f7ecc0b933f2e52cb00e6195_ryuk.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1868
    • C:\Users\Admin\AppData\Local\Temp\2024-06-07_768adec9f7ecc0b933f2e52cb00e6195_ryuk.exe
      "C:\Users\Admin\AppData\Local\Temp\2024-06-07_768adec9f7ecc0b933f2e52cb00e6195_ryuk.exe"
      2⤵
      • Loads dropped DLL
      PID:4044

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        _imaging.cp38-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\PIL\_imaging.cp38-win_amd64.pyd
        • Size 448KB
        • SHA256 7901bff424256ac0b4976b67d39cd458e3df2afe4f1c17afa426cddf5870b409
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\VCRUNTIME140.dll
        • Size 99KB
        • SHA256 0b040a314c19ff88f38fd9c89dca2d493113a6109adb8525733c3f6627da888f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\_bz2.pyd
        • Size 84KB
        • SHA256 e5de23dbac7ece02566e79b3d1923a8eeae628925c7fb4b98a443cad94a06863
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\_ctypes.pyd
        • Size 123KB
        • SHA256 65edc348db42347570578b979151b787ceebfc98e0372c28116cc229494a78a8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _decimal.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\_decimal.pyd
        • Size 260KB
        • SHA256 0af14298b022d615fc12de4034068985928fe6b7ab6bae3f5be3a8adad379074
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _decimal.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\_decimal.pyd
        • Size 128KB
        • SHA256 dd369fd578da3e50e2d74107580553d08f2e5417d2a22d5f00448af319455c77
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _elementtree.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\_elementtree.pyd
        • Size 173KB
        • SHA256 bcd6f366a7125de7e33ade6f20032cb134e530883c5af9fca74fcdfa2151648a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\_hashlib.pyd
        • Size 45KB
        • SHA256 2e98f91087f56dfdffbbdd951cd55cd7ea771cec93d59cadb86b964ed8708155
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\_lzma.pyd
        • Size 158KB
        • SHA256 c4d00582dee45841747b07b91a3e46e55af79e6518ec9f0ce59b989c0acd2806
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\_queue.pyd
        • Size 27KB
        • SHA256 9c47a3b84012837c60b7feced86ed0a4f12910a85fd259a4483a48cd940e3514
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\_socket.pyd
        • Size 77KB
        • SHA256 ab13258c6da2c26c4dca7239ff4360ca9166ea8f53bb8cc08d2c7476cab7d61b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\_ssl.pyd
        • Size 150KB
        • SHA256 dcf6b3ff84b55c3859d0f176c4ce6904c0d7d4643a657b817c6322933dbf82f6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _tkinter.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\_tkinter.pyd
        • Size 62KB
        • SHA256 7fdbb5a713a3de7413564a2ec15c8715f3ba203bfe2b944c9cda610155c511d1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\base_library.zip
        • Size 448KB
        • SHA256 9b184f12b40fa7405528e37ca6e06d044238f4e5d049899349eeb36952774f56
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        cacert.pem
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\certifi\cacert.pem
        • Size 275KB
        • SHA256 0dd74ebfba50c8c07cccd36089749216b3d59fb10df2a6deecfea1fc8632b9e9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libcrypto-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\libcrypto-1_1.dll
        • Size 192KB
        • SHA256 463ae74f6eaf192a5f71a862c7b80053e9daa13552b4a7ce94597a6563b1e526
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libffi-7.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\libffi-7.dll
        • Size 32KB
        • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libssl-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\libssl-1_1.dll
        • Size 192KB
        • SHA256 2887e6c5f56bba5c46fbf5c9e50cc62d8de92d764e07e63183154a1bcd343cab
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        pyexpat.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\pyexpat.pyd
        • Size 184KB
        • SHA256 dc38bdbe10cfaa99799e0c87aa8444fc062d445b87686d6593ffca46cc938031
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        python3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\python3.dll
        • Size 57KB
        • SHA256 59e6421802d30326c1704f15acc2b2888097241e291aba4860d1e1fc3d26d4bf
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        python38.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\python38.dll
        • Size 3.1MB
        • SHA256 e8475aa09ea46ce6e691803e028b1ffe91256d5381733de70c5b8e5e9869a128
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        python38.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\python38.dll
        • Size 448KB
        • SHA256 f60cf8c4f320754b8654e3ce2b07fae572df78fba8be145683d0153009f815e7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        pythoncom38.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\pythoncom38.dll
        • Size 448KB
        • SHA256 b87b3ec1559405ee151945e7b19a31edd5f2746c7392c234a7961038ad0df91f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        pythoncom38.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\pythoncom38.dll
        • Size 192KB
        • SHA256 82d210f95cd6de03b01f239b444ff3fa376b984baf211ec07817128fbac9dcc9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        pywintypes38.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\pywintypes38.dll
        • Size 128KB
        • SHA256 66ec7c3c8dfb381971b12e33d333a353517def25e9dde14642e5a46b9def1751
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        pywintypes38.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\pywintypes38.dll
        • Size 138KB
        • SHA256 74565d7b4e01807eb146bf26cfeb7aa27029caca58fee7c394111cbd5fa95e2e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\select.pyd
        • Size 26KB
        • SHA256 7ba95624370216795ea4a087c326422cfcbccc42b5ada21f4d85c532c71afad7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        tcl86t.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\tcl86t.dll
        • Size 448KB
        • SHA256 1825c26d55b84b37aa58ef467d3f11339b9dfa7a2ee9df02a9017bc0682fbf9f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        cp1252.enc
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\tcl\encoding\cp1252.enc
        • Size 1KB
        • SHA256 14df3ae30e81e7620be6bbb7a9e42083af1ae04d94cf1203565f8a3c0542ace0
        • MD5 SHA1 SHA512
        Submit Download

        tk86t.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\tk86t.dll
        • Size 448KB
        • SHA256 cabff86708900eb13fd164617a73d6e69e04a231f7c72b64220783ea987f3994
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\unicodedata.pyd
        • Size 128KB
        • SHA256 bcc5978a40198ff9f3fdb5b709e3f591ee344b038acb0d8cccee789257e41b18
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\unicodedata.pyd
        • Size 448KB
        • SHA256 bf54fa3290de4ca9a641a3d6aef2f8d1bde9086439a5f29ac34f1549ddfa4524
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        win32api.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI18682\win32api.pyd
        • Size 129KB
        • SHA256 202dd28e5d0451f2c672a4537116c70929ca6bbc5edd9115ed8a99f734f430ff
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download