2024-06-13_b2149d05e880de13114f79a56a00b4a4_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2024-06-13_b2149d05e880de13114f79a56a00b4a4_ryuk
Size 819KB
Sample240613-janbkstbll
SHA256 e12455fedbec3580a806a919efd9bc597379ddc556420d8f8a46e57a6efa64b7
MD5 b2149d05e880de13114f79a56a00b4a4
SHA1 043418b25fa8605fed27fbd84bc89abde282ebd1
SHA512 46d4a3a0adff41b7bdca7e37da948bcbfd0691fbc6bdec3526924b2ac306b405f71301498ec1cb16e7731235ed32e095212eacfe45a12ee7482cac798756caeb
SSDEEP 12288:I+xAOZcyeTG90R435+sYPVWH7+e1W0kYcX8+V6TPvqxamfLvmoJ9/+sQu:HAOq1690m343PsH791Wg+VxaQLvmoJj
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-13_b2149d05e880de13114f79a56a00b4a4_ryuk

File Explorer

2024-06-13_b2149d05e880de13114f79a56a00b4a4_ryuk

.exe 819KB

2024-06-13_b2149d05e880de13114f79a56a00b4a4_ryuk

IMPHASH e87a863e008828af688feb7537282fe7
SHA256 e12455fedbec3580a806a919efd9bc597379ddc556420d8f8a46e57a6efa64b7
MD5 b2149d05e880de13114f79a56a00b4a4
SHA1 043418b25fa8605fed27fbd84bc89abde282ebd1
SHA512 46d4a3a0adff41b7bdca7e37da948bcbfd0691fbc6bdec3526924b2ac306b405f71301498ec1cb16e7731235ed32e095212eacfe45a12ee7482cac798756caeb
SSDEEP 12288:I+xAOZcyeTG90R435+sYPVWH7+e1W0kYcX8+V6TPvqxamfLvmoJ9/+sQu:HAOq1690m343PsH791Wg+VxaQLvmoJj
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

38916

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d:\BuildAutomation\USHUpgradeService_int_cs_4.6\sw\int_cs_4.6\host\windows\UshUpgradeService\x64\Release\UshUpgradeService.pdb

wtsapi32

WTSQueryUserToken

userenv

CreateEnvironmentBlock

setupapi

SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInterfaces SetupDiGetClassDevsW SetupDiGetDeviceInterfaceDetailW CM_Reenumerate_DevNode CM_Locate_DevNodeW

kernel32

WTSGetActiveConsoleSessionId VerSetConditionMask VerifyVersionInfoW FreeLibrary SetStdHandle SetEnvironmentVariableW ResetEvent LocalFree CreateThread CloseHandle TerminateThread CreateFileW LocalAlloc WaitForSingleObject GetModuleFileNameW CreateEventA GetProcessHeap HeapAlloc HeapFree GetProcAddress LoadLibraryW GetLastError GetPrivateProfileStringW FindClose ExpandEnvironmentStringsW FindNextFileW FindFirstFileW SetEvent Sleep GetCurrentProcessId GetLocalTime GetCurrentThreadId FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP IsValidCodePage FindFirstFileExW HeapSize HeapReAlloc SetEndOfFile RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlPcToFileHeader EncodePointer RaiseException RtlUnwindEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection ReadFile GetConsoleMode ReadConsoleInputA SetConsoleMode MultiByteToWideChar WideCharToMultiByte GetStdHandle WriteFile ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW GetACP GetFileType GetConsoleCP SetFilePointerEx ReadConsoleW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetTimeZoneInformation FlushFileBuffers WriteConsoleW GetStringTypeW SetEnvironmentVariableA

user32

RegisterDeviceNotificationW

advapi32

SystemFunction036 DeregisterEventSource CreateProcessAsUserA SetTokenInformation RegCreateKeyExA RegCreateKeyExW RegSetValueExW ReportEventA RegSetValueExA RegDeleteValueW DuplicateTokenEx RegisterEventSourceA RegisterServiceCtrlHandlerExW CreateServiceW SetServiceStatus ChangeServiceConfig2W DeleteService StartServiceCtrlDispatcherW QueryServiceStatusEx SetSecurityDescriptorDacl AllocateAndInitializeSid FreeSid InitializeSecurityDescriptor InitializeAcl GetLengthSid AddAccessAllowedAce QueryServiceStatus CloseServiceHandle OpenSCManagerW ControlService StartServiceW OpenServiceW RegCloseKey RegOpenKeyExW RegQueryValueExW

shell32

SHGetFolderPathA

Name

.text

Size

170KB

Virtual Size

169KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

67KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

816B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2024-06-13_b2149d05e880de13114f79a56a00b4a4_ryuk

wtsapi32

userenv

setupapi

kernel32

user32

advapi32

shell32

generic