Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
06-08-2024 00:58
General
-
Target
2024-08-06_572fb5882f580ed2cfe33bdec95b621d_ryuk.exe
-
Size
91KB
-
MD5
572fb5882f580ed2cfe33bdec95b621d
-
SHA1
e080244c4279eacf111c2019cd06bd399ff5292f
-
SHA256
421cee317b744b4f486cb631c2a0386532eebf569b1cffd5fbe8dfb3f680a9db
-
SHA512
37f9563ff401bf9211ab24151582d1308f282d9eed298b423ec733d3bc3f63237569345732d09a6cc992fab72367d6e2e2104aa2c9107f239c680a308d9a9b4f
-
SSDEEP
1536:6uRFSPMJQAS2K7+gZfkEgaIwgKG1sWVdc9dlDXnGa9VhR68x8:6uzSPwq7BFkErHRGHUl3t9VhRZ
Score
10/10
Malware Config
Extracted
Family
metasploit
Version
metasploit_stager
C2
192.168.220.128:5555
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-08-06_572fb5882f580ed2cfe33bdec95b621d_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-06_572fb5882f580ed2cfe33bdec95b621d_ryuk.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB