Overview
overview
9Static
static
7ryomen-gen.rar
windows7-x64
3ryomen-gen.rar
windows10-2004-x64
3ryomen-gen...g.json
windows7-x64
3ryomen-gen...g.json
windows10-2004-x64
3ryomen-gen...gs.vbs
windows7-x64
1ryomen-gen...gs.vbs
windows10-2004-x64
1ryomen-gen...ol.exe
windows7-x64
7ryomen-gen...ol.exe
windows10-2004-x64
7out.exe
windows7-x64
out.exe
windows10-2004-x64
ryomen-gen...ol.ini
windows7-x64
1ryomen-gen...ol.ini
windows10-2004-x64
1ryomen-gen...me.txt
windows7-x64
1ryomen-gen...me.txt
windows10-2004-x64
1ryomen-gen/ryomen.exe
windows7-x64
9ryomen-gen/ryomen.exe
windows10-2004-x64
9ryomen.pyc
windows7-x64
3ryomen.pyc
windows10-2004-x64
3Analysis
-
max time kernel
102s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
12-08-2024 01:58
Behavioral task
behavioral1
Sample
ryomen-gen.rar
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
ryomen-gen.rar
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
ryomen-gen/config.json
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
ryomen-gen/config.json
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
ryomen-gen/dcontrol/Defender_Settings.vbs
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
ryomen-gen/dcontrol/Defender_Settings.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
ryomen-gen/dcontrol/dControl.exe
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
ryomen-gen/dcontrol/dControl.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
out.exe
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
out.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
ryomen-gen/dcontrol/dControl.ini
Resource
win7-20240729-en
Behavioral task
behavioral12
Sample
ryomen-gen/dcontrol/dControl.ini
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
ryomen-gen/read-me.txt
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
ryomen-gen/read-me.txt
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
ryomen-gen/ryomen.exe
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
ryomen-gen/ryomen.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
ryomen.pyc
Resource
win7-20240705-en
Behavioral task
behavioral18
Sample
ryomen.pyc
Resource
win10v2004-20240802-en
General
-
Target
ryomen.pyc
-
Size
13KB
-
MD5
d0b035072cc904311841848e8b9cbdc4
-
SHA1
9e4ca44e796cc2836f79e1c3e4be036234ccfe36
-
SHA256
9daf11520957ee1e9bd446ce6bbbc473318f6f48e98d8ccfa36a00379a1b45f6
-
SHA512
f9783025f0f9b0b702327dc45045440fc27e9a97134fce555bc3da7af89379cd7df1429336f780bb99c8c51e5b2f8707f5d892a3d8b57555f20f4b0f806516e5
-
SSDEEP
192:oLZg6jPB3MLw237AePzaYR+NnwSXCkYyLXRi/54X4mRK0UZcB+WqAq38:oLBcz37AIzfRUwSSoNA5M4mM0Ugvss
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_Classes\Local Settings rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\pyc_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\pyc_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\pyc_auto_file rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\.pyc rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\.pyc\ = "pyc_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\pyc_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\pyc_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2836 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2836 AcroRd32.exe 2836 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2320 wrote to memory of 2764 2320 cmd.exe 30 PID 2320 wrote to memory of 2764 2320 cmd.exe 30 PID 2320 wrote to memory of 2764 2320 cmd.exe 30 PID 2764 wrote to memory of 2836 2764 rundll32.exe 31 PID 2764 wrote to memory of 2836 2764 rundll32.exe 31 PID 2764 wrote to memory of 2836 2764 rundll32.exe 31 PID 2764 wrote to memory of 2836 2764 rundll32.exe 31
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\ryomen.pyc1⤵
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\ryomen.pyc2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ryomen.pyc"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2836
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD59fa96621525fc8402b82e6c9953b4baf
SHA1f44044ef8fa5d0c87bab5b963d2e4874be9954cb
SHA256ab03ee7618af23104f1f4a1dde5fdfe0284a54097b8d564387b15b78cc727b58
SHA512fd5dcad28247d39a2f4d49f2832007542ac308aee8410091af2ffefc92a75fd1f8c2733b079d92f87b6f6bcd185b30b89ac9886f6211b350d4915fcf34995c34