2024-06-13_a6214c20cb483692978378dbfda2c51e_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2024-06-13_a6214c20cb483692978378dbfda2c51e_ryuk
Size 16.3MB
Sample240613-mmcmdsyglm
SHA256 9713407aa7fa65eb505fc301bac705c5099d589f7c79380d4d99554cae788e9a
MD5 a6214c20cb483692978378dbfda2c51e
SHA1 ab13dc420d50b5b826cec009d908bb33d951994b
SHA512 e712733930af6ea696da33728b48e68a11afc55b35a86460972c4a7bace512de6a38572239f528725adf407bd4569306fd9ff0b1c0b49ebc8618b6ea744a7c22
SSDEEP 196608:8TmiTxzNspL4k210Ny561XA7+0QD+PRMA2DGBB:AmiTwpL4tiN1JV0QD+5MnGBB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-13_a6214c20cb483692978378dbfda2c51e_ryuk

File Explorer

2024-06-13_a6214c20cb483692978378dbfda2c51e_ryuk

.exe 16.3MB

2024-06-13_a6214c20cb483692978378dbfda2c51e_ryuk

IMPHASH aaeeed56fa93fc0b47fabeb3cae04f64
SHA256 9713407aa7fa65eb505fc301bac705c5099d589f7c79380d4d99554cae788e9a
MD5 a6214c20cb483692978378dbfda2c51e
SHA1 ab13dc420d50b5b826cec009d908bb33d951994b
SHA512 e712733930af6ea696da33728b48e68a11afc55b35a86460972c4a7bace512de6a38572239f528725adf407bd4569306fd9ff0b1c0b49ebc8618b6ea744a7c22
SSDEEP 196608:8TmiTxzNspL4k210Ny561XA7+0QD+PRMA2DGBB:AmiTwpL4tiN1JV0QD+5MnGBB
MD5 SHA1 SHA512 SSDEEP

Detects Windows executables referencing non-Windows User-Agents
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6564128

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\b\s\w\ir\cache\builder\src\out\Release_x64\chromedriver.exe.pdb

advapi32

BuildTrusteeWithSidW ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertStringSidToSidW CreateProcessAsUserW GetLengthSid GetNamedSecurityInfoW GetSecurityDescriptorControl GetSecurityDescriptorDacl GetSecurityDescriptorGroup GetSecurityDescriptorOwner GetSecurityDescriptorSacl InitializeAcl InitializeSecurityDescriptor IsValidAcl IsValidSecurityDescriptor IsValidSid RegCloseKey RegCreateKeyExW RegEnumKeyExW RegNotifyChangeKeyValue RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExW SetEntriesInAclW SetNamedSecurityInfoW SetSecurityDescriptorDacl SetSecurityInfo

dbghelp

SymCleanup SymFromAddr SymGetLineFromAddr64 SymGetSearchPathW SymInitialize SymSetOptions SymSetSearchPathW

user32

AllowSetForegroundWindow CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW GetActiveWindow GetQueueStatus KillTimer LoadKeyboardLayoutW MapVirtualKeyW MsgWaitForMultipleObjectsEx PeekMessageW PostMessageW PostQuitMessage RegisterClassExW SetTimer ToUnicode TranslateMessage UnregisterClassW VkKeyScanW

ws2_32

WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAGetLastError WSAGetOverlappedResult WSAIoctl WSARecvFrom WSAResetEvent WSASend WSASendTo WSASetLastError WSASocketW WSAStartup accept bind closesocket connect freeaddrinfo getaddrinfo gethostname getpeername getsockname getsockopt htonl htons inet_ntop ioctlsocket listen ntohs recv recvfrom sendto setsockopt shutdown socket

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AreFileApisANSI AssignProcessToJobObject CancelIo CancelIoEx CloseHandle CompareStringW ConnectNamedPipe CreateDirectoryW CreateEventW CreateFileA CreateFileMappingW CreateFileW CreateIoCompletionPort CreateMutexW CreateNamedPipeW CreatePipe CreateProcessW CreateSemaphoreA CreateThread DeleteCriticalSection DeleteFileA DeleteFileW DeleteProcThreadAttributeList DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread ExpandEnvironmentStringsW FileTimeToSystemTime FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FlushViewOfFile FormatMessageA FormatMessageW FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrencyFormatEx GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatEx GetDateFormatW GetDiskFreeSpaceA GetDiskFreeSpaceExW GetDiskFreeSpaceW GetDriveTypeW GetDynamicTimeZoneInformation GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesA GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileSize GetFileSizeEx GetFileType GetFullPathNameA GetFullPathNameW GetGeoInfoW GetLastError GetLocalTime GetLocaleInfoEx GetLocaleInfoW GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLongPathNameW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNamedPipeClientProcessId GetNamedPipeServerProcessId GetNativeSystemInfo GetNumberFormatEx GetOEMCP GetProcAddress GetProcessHeap GetProcessId GetProcessTimes GetProductInfo GetQueuedCompletionStatus GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetTempPathA GetTempPathW GetThreadId GetThreadPriority GetTickCount GetTimeFormatEx GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetUserGeoID GetVersionExW GetWindowsDirectoryW GlobalFree GlobalMemoryStatusEx HeapAlloc HeapCompact HeapCreate HeapDestroy HeapFree HeapReAlloc HeapSize HeapValidate InitOnceExecuteOnce InitializeConditionVariable InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeProcThreadAttributeList InitializeSListHead InitializeSRWLock InterlockedPushEntrySList IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale IsWow64Process K32GetModuleInformation K32QueryWorkingSetEx LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadLibraryW LocalFree LockFile LockFileEx MapViewOfFile MoveFileExW MoveFileW MultiByteToWideChar OpenProcess OutputDebugStringA OutputDebugStringW PostQueuedCompletionStatus PrefetchVirtualMemory QueryPerformanceCounter QueryPerformanceFrequency QueryThreadCycleTime RaiseException ReadConsoleW ReadFile RegisterWaitForSingleObject ReleaseSRWLockExclusive ReleaseSRWLockShared ReleaseSemaphore RemoveDirectoryW ReplaceFileW ResetEvent ResolveLocaleName RtlCaptureContext RtlCaptureStackBackTrace RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetEndOfFile SetEnvironmentVariableW SetEvent SetFileAttributesW SetFileInformationByHandle SetFilePointer SetFilePointerEx SetFileTime SetHandleInformation SetLastError SetStdHandle SetThreadInformation SetThreadPriority SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SwitchToThread SystemTimeToFileTime SystemTimeToTzSpecificLocalTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive TryEnterCriticalSection TzSpecificLocalTimeToSystemTime UnhandledExceptionFilter UnlockFile UnlockFileEx UnmapViewOfFile UnregisterWaitEx UpdateProcThreadAttribute VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WaitNamedPipeW WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile lstrlenA

iphlpapi

GetAdaptersAddresses

ntdll

RtlGetLastNtStatus

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

shell32

CommandLineToArgvW ord680 SHGetFolderPathW SHGetKnownFolderPath ShellExecuteExW

shlwapi

PathMatchSpecW

winmm

timeBeginPeriod timeEndPeriod timeGetTime

ole32

CoInitializeEx CoRegisterInitializeSpy CoRevokeInitializeSpy CoTaskMemFree CoUninitialize

secur32

AcquireCredentialsHandleW DeleteSecurityContext FreeContextBuffer FreeCredentialsHandle InitializeSecurityContextW QueryContextAttributesW QuerySecurityPackageInfoW

winhttp

WinHttpCloseHandle WinHttpGetIEProxyConfigForCurrentUser WinHttpGetProxyForUrl WinHttpOpen WinHttpSetTimeouts

api-ms-win-core-winrt-l1-1-0

RoInitialize RoUninitialize

urlmon

CoInternetCreateSecurityManager

crypt32

CertAddStoreToCollection CertCloseStore CertControlStore CertFindCertificateInStore CertGetEnhancedKeyUsage CertOpenStore

dhcpcsvc

DhcpCApiInitialize DhcpRequestParams

Name

.text

Size

12.0MB

Virtual Size

12.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.7MB

Virtual Size

3.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

99KB

Virtual Size

190KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

386KB

Virtual Size

385KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gxfg

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.retplne

Size

512B

Virtual Size

172B

Characteristics

Name

.rodata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

721B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

malloc_h

Size

512B

Virtual Size

228B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

59KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2024-06-13_a6214c20cb483692978378dbfda2c51e_ryuk

advapi32

dbghelp

user32

ws2_32

kernel32

iphlpapi

ntdll

userenv

shell32

shlwapi

winmm

ole32

secur32

winhttp

api-ms-win-core-winrt-l1-1-0

urlmon

crypt32

dhcpcsvc

generic