Overview

overview

7

Static

static

3

2024-06-08...uk.exe

windows7-x64

7

2024-06-08...uk.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    92s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/06/2024, 19:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2024-06-08_70569bdbc14009875c76f492600d06df_ryuk.exe
  • Size 27.9MB
  • Sample240608-xvtkzsff88
  • SHA256 592507d0aac4506eb11aa353b0258e094ad885856c048d942d979cb8a41686c0
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
spywarestealer

Malware Config

Signatures

  • Loads dropped DLL 25 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-08_70569bdbc14009875c76f492600d06df_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-08_70569bdbc14009875c76f492600d06df_ryuk.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3876
    • C:\Users\Admin\AppData\Local\Temp\2024-06-08_70569bdbc14009875c76f492600d06df_ryuk.exe
      "C:\Users\Admin\AppData\Local\Temp\2024-06-08_70569bdbc14009875c76f492600d06df_ryuk.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:832
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c color
        3⤵
          PID:2924

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          _imaging.cp39-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38762\PIL\_imaging.cp39-win_amd64.pyd
          • Size 2.5MB
          • SHA256 c565c21a3a42752ca70a21747a9f96b46ee778ad5531c77535ea1d1be8998ac9
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          VCRUNTIME140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38762\VCRUNTIME140.dll
          • Size 99KB
          • SHA256 ff43e813785ee948a937b642b03050bb4b1c6a5e23049646b891a66f65d4c833
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _bz2.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38762\_bz2.pyd
          • Size 83KB
          • SHA256 fe63361f6c439c6aa26fd795af3fd805ff5b60b3b14f9b8c60c50a8f3449060a
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _ctypes.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38762\_ctypes.pyd
          • Size 122KB
          • SHA256 3b4012343ef7a266db0b077bbb239833779192840d1e2c43dfcbc48ffd4c5372
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _decimal.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38762\_decimal.pyd
          • Size 264KB
          • SHA256 ffbe84f0a1eab363ca9cf73efb7518f2abd52c0893c7cc63266613c930855e96
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _elementtree.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38762\_elementtree.pyd
          • Size 172KB
          • SHA256 9b9abf5672bec167b854a106eb25701433b34a0c877ed5e363202247e5bada58
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _hashlib.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38762\_hashlib.pyd
          • Size 63KB
          • SHA256 9551431425e9680660c6baf7b67a262040fd2efceb241e4c9430560c3c1fafac
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _lzma.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38762\_lzma.pyd
          • Size 157KB
          • SHA256 b9bc7f1d8aa8498cb8b5dc75bb0dbb6e721b48953a3f295870938b27267fb5f5
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _queue.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38762\_queue.pyd
          • Size 27KB
          • SHA256 d82ab111224c54bab3eefdcfeb3ba406d74d2884518c5a2e9174e5c6101bd839
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _socket.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38762\_socket.pyd
          • Size 77KB
          • SHA256 4494992665305fc9401ed327398ee40064fe26342fe44df11d89d2ac1cc6f626
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _ssl.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38762\_ssl.pyd
          • Size 149KB
          • SHA256 8a86957b3496c8b679fcf22c287006108bfe0bb0aaffea17121c761a0744b470
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _tkinter.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38762\_tkinter.pyd
          • Size 62KB
          • SHA256 879839e906969afbfaaed0ef4b58d0d4276d9b4c483decc883fe6b63bd9b67ad
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          base_library.zip
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38762\base_library.zip
          • Size 767KB
          • SHA256 040196bab9aa45cc26737e06aab7d54243245af75e0f17750cbe33e77f3a5f93
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cacert.pem
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38762\certifi\cacert.pem
          • Size 275KB
          • SHA256 53b8854f8fe7fbb5c27c7a5cf08e3a69de641ee1af0d279d95ad9f75b428414a
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          libcrypto-1_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38762\libcrypto-1_1.dll
          • Size 3.2MB
          • SHA256 594303e2ce6a4a02439054c84592791bf4ab0b7c12e9bbdb4b040e27251521f1
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          libffi-7.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38762\libffi-7.dll
          • Size 32KB
          • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          libssl-1_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38762\libssl-1_1.dll
          • Size 673KB
          • SHA256 9d4cf1c03629f92662fc8d7e3f1094a7fc93cb41634994464b853df8036af843
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          pyexpat.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38762\pyexpat.pyd
          • Size 184KB
          • SHA256 adc9c63f92629ed4b860fc1855400b59a1ae73dd489fd49db326dcfcad48550e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          python39.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38762\python39.dll
          • Size 4.3MB
          • SHA256 0eabf135bb9492e561bbbc5602a933623c9e461aceaf6eb1ceced635e363cd5c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          pythoncom39.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38762\pythoncom39.dll
          • Size 543KB
          • SHA256 5dfd4ad6ed4cee8f9eda2e39fe4da2843630089549c47c7adda8a3c74662698a
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          pywintypes39.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38762\pywintypes39.dll
          • Size 137KB
          • SHA256 c06a570b160d5fd8030b8c7ccba64ce8a18413cb4f11be11982756aa4a2b6a80
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          select.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38762\select.pyd
          • Size 26KB
          • SHA256 1dd7bba480e65802657c31e6d20b1346d11bca2192575b45eb9760a4feb468ad
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          tcl86t.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38762\tcl86t.dll
          • Size 1.6MB
          • SHA256 f650d6bc321bcda3fc3ac3dec3ac4e473fb0b7b68b6c948581bcfc54653e6768
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cp1252.enc
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38762\tcl\encoding\cp1252.enc
          • Size 1KB
          • SHA256 14df3ae30e81e7620be6bbb7a9e42083af1ae04d94cf1203565f8a3c0542ace0
          • MD5 SHA1 SHA512
          Submit Download

          tk86t.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38762\tk86t.dll
          • Size 1.4MB
          • SHA256 1a6d0871be2fa7153de22be008a20a5257b721657e6d4b24da8b1f940345d0d5
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          unicodedata.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38762\unicodedata.pyd
          • Size 1.1MB
          • SHA256 7e719ba47919b668acc62008079c586133966ed8b39fec18e312a773cb89edae
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          win32api.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38762\win32api.pyd
          • Size 131KB
          • SHA256 1665ad12ad7cbf44ae63a622e8b97b5fd2ed0a092dfc5db8f09a9b6fdc2d57e7
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download