Static task
static1
Behavioral task
behavioral1
Sample
2024-07-03_df1043f99c7ee8a1b7cb5f7cba079a59_ryuk.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
2024-07-03_df1043f99c7ee8a1b7cb5f7cba079a59_ryuk.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-07-03_df1043f99c7ee8a1b7cb5f7cba079a59_ryuk
-
Size
1.4MB
-
MD5
df1043f99c7ee8a1b7cb5f7cba079a59
-
SHA1
60bb52bd6d01d323a7cec99e3562bfe8cac17a5d
-
SHA256
79f668e0b36f117317749330453a13dd438f6d2878ec4f976056c4838b752443
-
SHA512
d9b16edb3c37fe659302a390f3de3f396663c2eb3b5700b7378f4d6bc9c52623c568be302dd58d3c17611d2b156b27968b1f2144fce24ffcb429b141b1909059
-
SSDEEP
24576:qZQlPNOzyypcg2KSlTCguRSnUPTDvgzkf3bcFM0VIH06iyuI0n:qelVOzFpcg1SlTCguCUPTDvgzkf325I+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-07-03_df1043f99c7ee8a1b7cb5f7cba079a59_ryuk
Files
-
2024-07-03_df1043f99c7ee8a1b7cb5f7cba079a59_ryuk.exe windows:6 windows x64 arch:x64
f4b16d57aaa6f8446206e1be26ad7a1a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntdll
RtlPcToFileHeader
RtlUnwindEx
RtlNtStatusToDosError
NtDeviceIoControlFile
NtCreateFile
NtWriteFile
NtReadFile
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
NtCancelIoFileEx
kernel32
LCMapStringW
CompareStringW
CreateFileW
GetFileInformationByHandle
GetFileInformationByHandleEx
CloseHandle
SetLastError
GetFullPathNameW
GetLastError
AcquireSRWLockExclusive
HeapSize
FlushFileBuffers
SetCurrentDirectoryW
GetStringTypeW
GetFileType
CreateIoCompletionPort
GetCommandLineW
SetStdHandle
SetEnvironmentVariableW
GetConsoleCP
AddVectoredExceptionHandler
HeapFree
HeapReAlloc
GetFinalPathNameByHandleW
TryAcquireSRWLockExclusive
GetQueuedCompletionStatusEx
SetFileCompletionNotificationModes
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleInformation
GetCPInfo
SetFilePointerEx
GetProcAddress
GetStdHandle
GetConsoleMode
WaitForSingleObject
MultiByteToWideChar
WriteConsoleW
GetModuleHandleW
FormatMessageW
ReleaseSRWLockExclusive
SetThreadStackGuarantee
GetCurrentThread
GetEnvironmentVariableW
QueryPerformanceCounter
QueryPerformanceFrequency
lstrlenW
GetCurrentProcess
WideCharToMultiByte
GetModuleFileNameW
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
ExitProcess
GetSystemTimeAsFileTime
HeapAlloc
GetProcessHeap
GetCurrentDirectoryW
GetCurrentProcessId
WaitForSingleObjectEx
LoadLibraryA
ReleaseMutex
SleepConditionVariableSRW
WakeConditionVariable
WakeAllConditionVariable
PostQueuedCompletionStatus
CreateThread
FindFirstFileExW
FindClose
GetCommandLineA
SetConsoleCtrlHandler
GetModuleHandleExW
GetModuleHandleA
WriteFile
CreateMutexA
LoadLibraryExW
FreeLibrary
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
RaiseException
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ws2_32
WSAGetLastError
WSASocketW
freeaddrinfo
setsockopt
getsockopt
connect
ioctlsocket
socket
closesocket
getaddrinfo
WSAStartup
WSACleanup
recv
send
WSASend
shutdown
bind
WSAIoctl
advapi32
RegisterServiceCtrlHandlerExA
SystemFunction036
SetServiceStatus
StartServiceCtrlDispatcherA
user32
GetProcessWindowStation
GetUserObjectInformationA
bcrypt
BCryptGenRandom
Sections
.text Size: 874KB - Virtual size: 873KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 470KB - Virtual size: 469KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 48KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 209B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 192B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ