Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
21-08-2024 18:52
General
-
Target
2024-08-21_781853a5c139d6f6c5215eb610f50d2d_cobalt-strike_ryuk.exe
-
Size
2.0MB
-
MD5
781853a5c139d6f6c5215eb610f50d2d
-
SHA1
1fb542d69ca80d85aca4fc1e727da23f6caf42a1
-
SHA256
db3bbd678785299bfd9d3ef18b847504bbcec5fbdb523aeacce3e458cd6863c5
-
SHA512
5c7cb246f2e9355ada4d504f0fe7c4523e840a1f4f0e077e024e01245f6ebfb38a77c47f0d4f08c3559f020d5f322bdae7a013dd749e6ffb01901fa78e5add40
-
SSDEEP
24576:lcTyYv0FteQUd5I2kjgD6iQacAksqjnhMgeiCl7G0nehbGZpbD:luXv0FtpU5606zOADmg27RnWGj
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Drops file in System32 directory 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-21_781853a5c139d6f6c5215eb610f50d2d_cobalt-strike_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-21_781853a5c139d6f6c5215eb610f50d2d_cobalt-strike_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2340 -s 2202⤵
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5568526115d78e1d28e254e5791ce930f
SHA1452b0016db0ba4388e2deca6c4b8e7b1a2fd5bbc
SHA2563a481ed825b313833b187525865ff445dc5188cce4f3f20a338dc7417926c6a5
SHA512b3a13a8dacd408b3753f1866e5e2d4c414f0120852e43542f590d80db77a499628f9732aa71877f2f3f2027608b3119d3c115f8c0d000e962df90f8bb3ba988a
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
1.2MB