4a2d69f63e533905b3dc20727eca16d194de0db517279914a2c659bec2f864a6

Analysis

max time kernel
133s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2024, 21:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-08-25_31d6d8b5277cddad0ccf421c8c6292b6_cobalt-strike_ryuk.exe
Size

4.9MB
MD5

31d6d8b5277cddad0ccf421c8c6292b6
SHA1

2cfa4a09e5099e6277f25a827720e678bef7eb28
SHA256

4a2d69f63e533905b3dc20727eca16d194de0db517279914a2c659bec2f864a6
SHA512

eeb7876cf0eabf402ef1541cbe60acca7d8a1ed47339c62353d9e912ff5c3e996e5ba3e4a6e2a699a3ed13fc03c3467f9a2863c98acac2faf199256bbfd7217a
SSDEEP

49152:wJfRyVqslCy8N72sPAD35nbBef4xfAJrtIszkPB9FXow7gnOfctpKQDn9kRHmQ5S:BB/t1xfqtIdeldKQ5Omk7E

Score

7^/10

spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	2024-08-25_31d6d8b5277cddad0ccf421c8c6292b6_cobalt-strike_ryuk.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 3676	5044	2024-08-25_31d6d8b5277cddad0ccf421c8c6292b6_cobalt-strike_ryuk.exe	84
PID 5044 wrote to memory of 3676	5044	2024-08-25_31d6d8b5277cddad0ccf421c8c6292b6_cobalt-strike_ryuk.exe	84
PID 3676 wrote to memory of 1952	3676	2024-08-25_31d6d8b5277cddad0ccf421c8c6292b6_cobalt-strike_ryuk.exe	86
PID 3676 wrote to memory of 1952	3676	2024-08-25_31d6d8b5277cddad0ccf421c8c6292b6_cobalt-strike_ryuk.exe	86

C:\Users\Admin\AppData\Local\Temp\2024-08-25_31d6d8b5277cddad0ccf421c8c6292b6_cobalt-strike_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-08-25_31d6d8b5277cddad0ccf421c8c6292b6_cobalt-strike_ryuk.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Users\Admin\AppData\Local\Temp\2024-08-25_31d6d8b5277cddad0ccf421c8c6292b6_cobalt-strike_ryuk.exe
  "C:\Users\Admin\AppData\Local\Temp\2024-08-25_31d6d8b5277cddad0ccf421c8c6292b6_cobalt-strike_ryuk.exe" --verbose-logging --run-as-admin --target-path="C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application" --child-setup-process --restart-as-admin-time=478743396
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3676
- - C:\Users\Admin\AppData\Local\Temp\2024-08-25_31d6d8b5277cddad0ccf421c8c6292b6_cobalt-strike_ryuk.exe
    C:\Users\Admin\AppData\Local\Temp\2024-08-25_31d6d8b5277cddad0ccf421c8c6292b6_cobalt-strike_ryuk.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id=488dca4c15f9a1d330ad312b391a804e --annotation=main_process_pid=3676 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=24.7.2.1074 --initial-client-data=0x26c,0x270,0x274,0x248,0x278,0x7ff6c508e708,0x7ff6c508e714,0x7ff6c508e720
    3⤵
    PID:1952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\yandex_browser_installer.log

Filesize
1KB

MD5
47c6ba50ed29a22015932f1c6122de90

SHA1
28920c0183e838299d1da9f3c1b23142d6d22acb

SHA256
b4a23cc8937799e50ad4a083d72a52b308b31f353eed395293b66a20ddb0c66b

SHA512
c9e1762baa1a1663bba110df3bd9844697b7368949e209192b92d0661cfae333c7b920e0b4e196ed02dcbb0bb6b2e0991d8d6d8e72e62a1bf56e87054de82d3a

Download Submit