Static task
static1
Behavioral task
behavioral1
Sample
2024-09-05_b75e589c6a291f59abfd664f48bdf23d_ryuk.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-05_b75e589c6a291f59abfd664f48bdf23d_ryuk.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-05_b75e589c6a291f59abfd664f48bdf23d_ryuk
-
Size
34.1MB
-
MD5
b75e589c6a291f59abfd664f48bdf23d
-
SHA1
f2a01176c68e4fa66277bde3169b35af5afc1872
-
SHA256
919b834bd62a1c4e381bf31ae6cc252e54e7762ad7a2bd81bc3fa71e14c01c71
-
SHA512
7c0f037eef79468dcc3aee6f786c01e533b16af5103b3bc6c40d8087924940bb6932b60be1e2c1d5d2a2a37acc721c90d5de25056115ffa89194dc2aa3fcdeed
-
SSDEEP
24576:8EEEEEEDp7LpmKA666W666QhO6h+6AMpjWjMncqxT68TwDxmfVg8+3EU:bcQzTy0fVgB3H
Malware Config
Signatures
Files
-
2024-09-05_b75e589c6a291f59abfd664f48bdf23d_ryuk.exe windows:6 windows x64 arch:x64
d874fb24fdd7f1f3f1db6505f1db2e9d
Code Sign
6f:60:fd:5f:b8:09:f3:ba:48:3e:7b:2f:30:83:9e:24Certificate
IssuerCN=FortuneSmileWorkTeam,L=Scottsdale,ST=Arizona,C=USNot Before09/03/2023, 00:00Not After09/03/2024, 23:59SubjectCN=FortuneSmileWorkTeam,L=Scottsdale,ST=Arizona,C=USSigner
Actual PE DigestDigest AlgorithmPE Digest MatchesfalseHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
HeapDestroy
HeapSize
HeapReAlloc
GetModuleHandleA
WideCharToMultiByte
DeleteCriticalSection
MultiByteToWideChar
GetThreadIOPendingFlag
SetCurrentConsoleFontEx
MoveFileTransactedW
LeaveCriticalSection
GetLogicalDriveStringsA
GetLargestConsoleWindowSize
GetFileAttributesExA
GetDiskFreeSpaceExW
GetCommConfig
FoldStringA
FlushViewOfFile
FlsAlloc
FindFirstVolumeA
InitializeCriticalSectionEx
GetProcAddress
WriteConsoleW
FlushFileBuffers
SetFilePointerEx
GetConsoleMode
GetConsoleCP
SetStdHandle
GetProcessHeap
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
IsDebuggerPresent
OutputDebugStringW
RaiseException
GetLastError
EnterCriticalSection
CloseHandle
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlPcToFileHeader
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
RtlUnwindEx
SetLastError
GetCurrentProcess
TerminateProcess
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetStdHandle
WriteFile
GetCommandLineA
GetCommandLineW
GetACP
HeapFree
HeapAlloc
GetFileType
CompareStringW
LCMapStringW
GetStringTypeW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
CreateFileW
gdi32
AddFontResourceA
PolyPolyline
GdiGradientFill
DeleteEnhMetaFile
advapi32
RegDeleteKeyValueA
PrivilegedServiceAuditAlarmW
LookupPrivilegeDisplayNameA
GetTrusteeTypeA
GetSidSubAuthorityCount
CredRenameA
CredIsMarshaledCredentialW
BuildTrusteeWithSidW
RegUnLoadKeyW
shlwapi
PathIsRootW
ord280
StrStrIW
AssocQueryStringA
oledlg
OleUIBusyW
ord11
ord9
ord8
Sections
.text Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 127KB - Virtual size: 126KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 512B - Virtual size: 236B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32.2MB - Virtual size: 32.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ