2024-08-22_e1f0903b2258c195616fc934c86e4071_ryuk

Sharing

Copy URL Twitter E-mail

General

Target

2024-08-22_e1f0903b2258c195616fc934c86e4071_ryuk
Size

2.2MB
MD5

e1f0903b2258c195616fc934c86e4071
SHA1

d6f582c78f630578ad881ed3d8c6c801d65b1485
SHA256

d02a691e478ac54c9f7157a61081a19997e20ce408cb6128fd1b3fdbbfd90a35
SHA512

6de5accd42e191042d4ff7efed6d97ce60313b4ae10d77b66a9112ae6aef35f42879ab519dc4a07807ca0e871cb35f5cb9f8c8bbb75a065776793da773ab870d
SSDEEP

49152:XdZjEyJFK4WDZHf7zLNiXicJFFRGNzj3:LqXVX7wRGpj3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-08-22_e1f0903b2258c195616fc934c86e4071_ryuk

Files

2024-08-22_e1f0903b2258c195616fc934c86e4071_ryuk
.exe windows:6 windows x64 arch:x64

feb6fd9e44b406db0863bb443c5340d0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\TCWork\f41609d3e46cb95b\ESIF\Products\ESIF_UF\Sources\win\projs\x64\Win10Release\esif_uf_64.pdb

Imports

wtsapi32

WTSQueryUserToken

ole32

CoInitializeEx
CoDecrementMTAUsage
CoTaskMemFree
CoCreateInstance
PropVariantClear
CoUninitialize
CoIncrementMTAUsage

wsock32

WSAGetLastError
WSACleanup
WSAStartup
getservbyname
socket
select
recv
listen
ioctlsocket
htons
closesocket
bind
accept
__WSAFDIsSet
send

setupapi

SetupDiCreateDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailA
SetupDiGetClassDevsW
SetupDiCallClassInstaller
SetupDiRemoveDevice
SetupDiGetDeviceRegistryPropertyW
SetupDiSetDeviceRegistryPropertyW
SetupDiSetClassInstallParamsW
SetupDiCreateDeviceInfoW

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

powrprof

SetSuspendState
PowerGetActiveScheme
PowerSetActiveScheme
PowerReadPossibleFriendlyName
PowerWritePossibleFriendlyName
PowerWriteSettingAttributes
PowerRemovePowerSetting
PowerWriteACValueIndex
PowerWriteDCValueIndex
PowerReadACValueIndex
PowerReadDCValueIndex

kernel32

CreateDirectoryW
SetStdHandle
GetFullPathNameA
GetFullPathNameW
GetCurrentDirectoryW
SetCurrentDirectoryW
GetCurrentThread
HeapAlloc
GetTimeFormatW
GetDateFormatW
GetTimeZoneInformation
HeapFree
GetACP
GetCommandLineA
GetModuleFileNameA
GetModuleHandleExW
ExitProcess
WideCharToMultiByte
MultiByteToWideChar
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileType
CloseHandle
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSemaphore
WaitForSingleObject
SetWaitableTimerEx
CancelWaitableTimer
CreateSemaphoreW
CreateWaitableTimerW
UnregisterWaitEx
RegisterWaitForSingleObject
ReleaseSRWLockShared
AcquireSRWLockShared
QueryPerformanceCounter
QueryPerformanceFrequency
FindClose
FindFirstFileA
FindNextFileA
ReleaseMutex
CreateMutexW
Sleep
CreateThread
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryA
LocalFree
FormatMessageA
OutputDebugStringA
SetEvent
CreateEventW
GetCurrentThreadId
HeapReAlloc
CreateFileA
DeviceIoControl
GetEnvironmentVariableA
GetTempPathW
GetTempPathA
SetLastError
CreateMutexA
GetCurrentProcess
SetPriorityClass
GetSystemDirectoryA
GetSystemDirectoryW
GetSystemWindowsDirectoryA
GetModuleFileNameW
GetSystemPowerStatus
ResetEvent
GetStdHandle
GetCommandLineW
WaitForMultipleObjects
TerminateProcess
GetExitCodeProcess
ExitThread
GetExitCodeThread
CreateProcessW
SetDllDirectoryA
WriteConsoleInputW
CreateFileW
FlushFileBuffers
ReadFile
WriteFile
ConnectNamedPipe
DisconnectNamedPipe
SetNamedPipeHandleState
CreateNamedPipeW
WaitNamedPipeW
GetOverlappedResult
WTSGetActiveConsoleSessionId
DeleteFileW
CopyFileW
GetModuleHandleW
GetFileInformationByHandle
GetDriveTypeW
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
EncodePointer
InterlockedFlushSList
InterlockedPushEntrySList
RaiseException
RtlPcToFileHeader
RtlUnwindEx
GetStringTypeW
GetConsoleMode
ReadConsoleW
GetConsoleCP
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
CreateProcessA
GetFileAttributesExW
OutputDebugStringW
WaitForSingleObjectEx
FindFirstFileExA
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetEnvironmentVariableW
GetProcessHeap
SetConsoleCtrlHandler
WriteConsoleW
HeapSize
SetEndOfFile
GetThreadId
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
SetFilePointerEx

user32

ShowWindow
CreateWindowExW
LoadCursorW
RegisterClassExW
UnregisterClassW
SendMessageW
DispatchMessageW
TranslateMessage
GetMessageW
EnumDisplayDevicesW
GetSystemMetrics
RegisterPowerSettingNotification
UnregisterPowerSettingNotification
DefWindowProcW
UpdateWindow
PostQuitMessage

advapi32

SystemFunction036
ReportEventA
RegisterEventSourceW
DeregisterEventSource
StartServiceW
StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerExW
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
DeleteService
CreateServiceW
ControlService
CloseServiceHandle
ChangeServiceConfig2W
DuplicateTokenEx
CreateProcessAsUserW
ConvertStringSidToSidW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
InitializeAcl
GetTokenInformation
GetLengthSid
GetAclInformation
AddAce
AddAccessAllowedAce
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 301KB - Virtual size: 300KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 29KB - Virtual size: 125KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.cfguard
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 283B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 576KB - Virtual size: 580KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

feb6fd9e44b406db0863bb443c5340d0

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

wtsapi32

ole32

wsock32

setupapi

userenv

powrprof

kernel32

user32

advapi32

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 301KB - Virtual size: 300KB

.data Size: 29KB - Virtual size: 125KB

.pdata Size: 55KB - Virtual size: 55KB

.idata Size: 12KB - Virtual size: 11KB

.cfguard Size: 2KB - Virtual size: 2KB

.00cfg Size: 512B - Virtual size: 283B

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 576KB - Virtual size: 580KB

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 301KB - Virtual size: 300KB

.data
Size: 29KB - Virtual size: 125KB

.pdata
Size: 55KB - Virtual size: 55KB

.idata
Size: 12KB - Virtual size: 11KB

.cfguard
Size: 2KB - Virtual size: 2KB

.00cfg
Size: 512B - Virtual size: 283B

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 576KB - Virtual size: 580KB