12f3d087b535db0d9200bda9603661ed6e820847d6413711df9db8ce2c17b513

Analysis

max time kernel
136s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2024, 00:36

Target
2024-08-23_3befb5b4aaf041eff2616417987dce10_cobalt-strike_ryuk.exe
Size 6.2MB
Sample240823-ax2caaydjq
SHA256 12f3d087b535db0d9200bda9603661ed6e820847d6413711df9db8ce2c17b513
MD5 3befb5b4aaf041eff2616417987dce10
SHA1 685b5fec3a862c5107966c36cf2f51b1be9f9109
SHA512 a8580475515327272347492e01a0c1aa6accc6eb727ed8a6aaa1c16c0587345f3af77316e8f6ff4cfff95bfcab00961231014cb1f48b4617916ec41369e411ec
SSDEEP 196608:zzM2c3kqQbrANZvTE2l6sFYSK0Xlscn/G2:zz2Ob+ZIEFFYN0XlsyG2
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
8	sonictest.exe

Loads dropped DLL 2 IoCs

pid	Process
8	sonictest.exe
8	sonictest.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3668 wrote to memory of 8	3668	2024-08-23_3befb5b4aaf041eff2616417987dce10_cobalt-strike_ryuk.exe	92
PID 3668 wrote to memory of 8	3668	2024-08-23_3befb5b4aaf041eff2616417987dce10_cobalt-strike_ryuk.exe	92

C:\Users\Admin\AppData\Local\Temp\2024-08-23_3befb5b4aaf041eff2616417987dce10_cobalt-strike_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-08-23_3befb5b4aaf041eff2616417987dce10_cobalt-strike_ryuk.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3668
- C:\Users\Admin\AppData\Local\Temp\onefile_3668_133688469855358767\sonictest.exe
  "C:\Users\Admin\AppData\Local\Temp\2024-08-23_3befb5b4aaf041eff2616417987dce10_cobalt-strike_ryuk.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3880,i,2904906934812054273,11716976550456127484,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:8
1⤵
PID:2092

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_3668_133688469855358767\VCRUNTIME140.dll
Size 116KB
SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
MD5 be8dbe2dc77ebe7f88f910c61aec691a
SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
SSDEEP 1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
MD5 SHA1 SHA512 SSDEEP

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_3668_133688469855358767\python312.dll
Size 6.6MB
SHA256 c98ba3354a7d1f69bdca42560feec933ccba93afcc707391049a065e1079cddb
MD5 3c388ce47c0d9117d2a50b3fa5ac981d
SHA1 038484ff7460d03d1d36c23f0de4874cbaea2c48
SHA512 e529c5c1c028be01e44a156cd0e7cad0a24b5f91e5d34697fafc395b63e37780dc0fac8f4c5d075ad8fe4bd15d62a250b818ff3d4ead1e281530a4c7e3ce6d35
SSDEEP 49152:77dFcaC296MwQx0AWOO5JqSEShouly4XUV/x3aOvi5lnX79DxW/En8tdFNPhD2SI:7Z+aCnAh8lRA4jvE0ivHHDMiEBaw
MD5 SHA1 SHA512 SSDEEP

Submit Download

sonictest.exe

Path C:\Users\Admin\AppData\Local\Temp\onefile_3668_133688469855358767\sonictest.exe
Size 6.5MB
SHA256 8b7208063af03dbe753aa1b67c0ac89ea26f863ac8b0e90840e03866180a9ee4
MD5 3d096e83b336612f3902b8d331854c8b
SHA1 058a90be7064483b3c068c74d89e9e8ce5c92492
SHA512 f5d5abd8bdfa2b01c6fcc85a4e86839c4d7b00bdc268e5765a8e51588e18b0065df00b2e8c982230b078b3cf8d7357cbaab7a6ff81e9dc30e83d98691082ec49
SSDEEP 98304:J0MGeJV3tJseJDaocQ17UpJzrX4yzWubPPBkWT:J3GOV3t+eJDaiM
MD5 SHA1 SHA512 SSDEEP

Submit Download