Overview

overview

7

Static

static

3

2024-09-07...uk.exe

windows7-x64

7

2024-09-07...uk.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    07/09/2024, 10:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-09-07_fab75a840f4bfd4389b70880a11380ec_ryuk.exe

  • Size

    12.4MB

  • MD5

    fab75a840f4bfd4389b70880a11380ec

  • SHA1

    5703d392f14b730437efe0e6d8651975a2ccc8e9

  • SHA256

    fce6b9bf4d4af445cd481fc8dfff4c2251a2910526fbee3719e3866570c72bfa

  • SHA512

    d193ec6b64b832e1ea1a37fe096c169b8272b9595f063ee410a8be7d4c4e1fcdbc9d7da3d71ac5ce3c98165d1bac1be02f50f3ac9e0dc7d8bc054816aa46703c

  • SSDEEP

    393216:xx2ZTP1hmX9c5hlERo2WmfDZPtN3ZW6mrBOjUGlKi:xxo9hUEhkd7FtN3orZA

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 33 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-09-07_fab75a840f4bfd4389b70880a11380ec_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-09-07_fab75a840f4bfd4389b70880a11380ec_ryuk.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2084
    • C:\Users\Admin\AppData\Local\Temp\2024-09-07_fab75a840f4bfd4389b70880a11380ec_ryuk.exe
      "C:\Users\Admin\AppData\Local\Temp\2024-09-07_fab75a840f4bfd4389b70880a11380ec_ryuk.exe"
      2⤵
      • Loads dropped DLL
      PID:2916

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI20842\VCRUNTIME140.dll
    Filesize

    99KB

    MD5

    8697c106593e93c11adc34faa483c4a0

    SHA1

    cd080c51a97aa288ce6394d6c029c06ccb783790

    SHA256

    ff43e813785ee948a937b642b03050bb4b1c6a5e23049646b891a66f65d4c833

    SHA512

    724bbed7ce6f7506e5d0b43399fb3861dda6457a2ad2fafe734f8921c9a4393b480cdd8a435dbdbd188b90236cb98583d5d005e24fa80b5a0622a6322e6f3987

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI20842\_hashlib.pyd
    Filesize

    45KB

    MD5

    496cde3c381c8e33186354631dfad0f1

    SHA1

    cbdb280ecb54469fd1987b9eff666d519e20249f

    SHA256

    f9548e3b71764ac99efb988e4daac249e300eb629c58d2a341b753299180c679

    SHA512

    f7245eb24f2b6d8bc22f876d6abb90e77db46bf0e5ab367f2e02e4ca936c898a5a14d843235adc5502f6d74715da0b93d86222e8dec592ae41ab59d56432bf4f

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI20842\_ssl.pyd
    Filesize

    150KB

    MD5

    fefbb91866778278460e16e44cfb8151

    SHA1

    53890f03a999078b70b921b104df198f2f481a7c

    SHA256

    8a10b301294a35bc3a96a59ca434a628753a13d26de7c7cb51d37cf96c3bdbb5

    SHA512

    449b5f0c089626db1824ebe405b97a67b073ea7ce22cee72aa3b2490136b3b6218e9f15d71da6fd32fba090255d3a0ba0e77a36c1f8b8bea45f6be95a91e388d

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI20842\api-ms-win-core-file-l1-2-0.dll
    Filesize

    21KB

    MD5

    4454791276f4716342de12eaa6ab5007

    SHA1

    cfeab7a4aed07adf0e22bb40ca408046896173fa

    SHA256

    0545cfcb511dcca7764a31465c211ff3d6b91ed5070c00a8613599edff4b7979

    SHA512

    e86ae200f473ffc00b4e4f3fcdb094cdf896184dd048aed3c408f145282cf5da67889e11334460984c60f332d2faecf9a89a5f3774c81b488aeaadb5e1520497

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI20842\api-ms-win-core-file-l2-1-0.dll
    Filesize

    11KB

    MD5

    721b60b85094851c06d572f0bd5d88cd

    SHA1

    4d0ee4d717aeb9c35da8621a545d3e2b9f19b4e7

    SHA256

    dac867476caa42ff8df8f5dfe869ffd56a18dadee17d47889afb69ed6519afbf

    SHA512

    430a91fcecde4c8cc4ac7eb9b4c6619243ab244ee88c34c9e93ca918e54bd42b08aca8ea4475d4c0f5fa95241e4aacb3206cbae863e92d15528c8e7c9f45601b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI20842\api-ms-win-core-localization-l1-2-0.dll
    Filesize

    21KB

    MD5

    584935f54f7a9947a2fec9a6d827e558

    SHA1

    3ee71afa08464bab300983a2bc627cd791d574dc

    SHA256

    78b921153dd5776295b464f6b887d6cf3e24097d53305a0c584256b8f569f9fb

    SHA512

    933658ceeb0a79d968b1ad32fa392f0e9f630c0264919fc729986f0d97ce72c5e5c554a42c068eacbbea24e4adca686ce10701803c6e80c77f7ed6d121cff749

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI20842\api-ms-win-core-processthreads-l1-1-1.dll
    Filesize

    21KB

    MD5

    fb60a721cfca0b3307067a7db90a996e

    SHA1

    fd4d776f3b9f1f7b658a2abdb5d321721eb19488

    SHA256

    2f031764abb092fa03732d27876a29f62d40ba0fdce08b66559915dc2879d10c

    SHA512

    b510c8a1436463ee4206cc6d3585a883bb195cdb3ed134eda286939ba50027ae2c01e409654252966717ccb0fbd2d09aae9d9412fa94491bf403103e7b62a5bb

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI20842\api-ms-win-core-timezone-l1-1-0.dll
    Filesize

    21KB

    MD5

    9be41c3476bdf52936e25368c14b87c4

    SHA1

    22a068671f0e3fc9041a193158cfb95fa3618419

    SHA256

    9c208b51ad3331ae87ce2642d9a8b119add74798524ea1c3cb1e995045f452b9

    SHA512

    0756986284b8ea16cc1d35c8a87352e70b7b44a892b3b4a1266c64607aa0dd161e5da4b0286c6dbb38f040d538c85e6c4af26148a31d1382f86b12b4b389463d

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI20842\api-ms-win-crt-convert-l1-1-0.dll
    Filesize

    25KB

    MD5

    0a0d2936a57779edb0e919d032435bc6

    SHA1

    e509b2b1e4c3d6988e2aa7bf034bdbf42761f66e

    SHA256

    fd744bbf003e2fccdaf2284d8c379ec175dd8ca585488c7f841e2b8aeb82e27e

    SHA512

    c825c0b7a67dae5337a53f0251b474d69986155ac50ce9a109e72813ebfb18c040f4140e406d03fb718573d0fd8828a976d034705d48f2879a14e5929dc40c7b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI20842\api-ms-win-crt-environment-l1-1-0.dll
    Filesize

    21KB

    MD5

    b582a5ea3fd23c495b727d6cadf98a63

    SHA1

    60d4f115aa47b7ba20163a64509dc7640a5a24ab

    SHA256

    6daed79d0f340935e52db5a68c2c5362fcc3292a86dc2fa55cd60d07459ce37e

    SHA512

    0a0b2af30138f17b28606a74e11cbfc31f16e9ba2d4c01e681d30dd0c4157481dcc0f6399f489f45a9bfc25b5dca16b90bf99f0d9f70979f47768f65992806de

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI20842\api-ms-win-crt-filesystem-l1-1-0.dll
    Filesize

    21KB

    MD5

    64c75a0451d011129d0ff769ebae06ce

    SHA1

    16a861cdcc298288170f47bb0f190d91d2fd03bf

    SHA256

    470776fbfc8477f7cb644ba9dc950754f66d70984b45af4366f4ae9ed680d11d

    SHA512

    12b98589d3a6088d4a2c48e823c3030ad741b48a1494373b4f6ee88abd8470153cfeaf86923dbd931a2ebaf3c6d35c57879cd9b7f33f1327101d0869f22db904

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI20842\api-ms-win-crt-process-l1-1-0.dll
    Filesize

    21KB

    MD5

    ee15c529082f04d5578aa3a09243accf

    SHA1

    b5a9e91d01085d6f792c4b8894e70bc6142d9b41

    SHA256

    01122ca37930cce8316c878c0f7127179f0b38dae8047ccacc31311d6d10ad2f

    SHA512

    1c14f15b9d7777559175f4dacea401333cdad843c0795903dbc249f2f8d39ae9cabcd966b786bed28f36d4e349ef8425e0a7b1c15ac296e4a97541e858964e6d

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI20842\api-ms-win-crt-stdio-l1-1-0.dll
    Filesize

    25KB

    MD5

    00074bb1589c1d4cca6135af85b94474

    SHA1

    58ad1d3d346c4e83265c9716248b18df5ab1447b

    SHA256

    adf6b907e3716bb60aa130aa293e28ee8aebd615c45b05c9f4448a64a6934d4a

    SHA512

    e0033c631ccba933e3252279fadaa82d35ded8d9911aa50060607ef780298d21185f5c7f85121c95a0150f80c44c0a998dc4290b824af4f8e44356ee5c11676f

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI20842\api-ms-win-crt-string-l1-1-0.dll
    Filesize

    25KB

    MD5

    4b4af7d47b357fcf37ca0070a3375e91

    SHA1

    3974cb63859eab17ab5ddfdcf15b403340ae34bf

    SHA256

    69f528d02686b1b847be48609903089a032af9e5c23a7b1c2a462bf564e5e723

    SHA512

    e508df34943e6542982d4153ab78d7c23559f32b79968353876a3b0dd43fd8312781084a031534ad92f86f44a115a49c05a4fb51abf51b788c062eacab7cf0e2

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI20842\base_library.zip
    Filesize

    764KB

    MD5

    a5ba28d7e3f5aca006bd1bd79a2251c5

    SHA1

    d7203fa3c9a69f44f5906ced6c506931e1131da0

    SHA256

    88b13a1d42ac7c4f8681a71b353699ee7677863eaa741619c358a8a76ff06803

    SHA512

    05246b4ecb89c539d29c150d430eb2743f4967579cc7d755ca67508178a667e8792d0353835b01ae2216a54dc848e4dd821f29cef770d9367f9877111ba907a4

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI20842\heima.exe.manifest
    Filesize

    1KB

    MD5

    fc28e181e5b08c65c7ec0fdb9344fc3e

    SHA1

    3cbf8aea122b34eeaa70fc97274fac90e2321cd7

    SHA256

    496cc71cbbe02198f0ba58eaecffd1d0f83efc753d206c652eafb8e841ff0ca5

    SHA512

    12bd4cfe3244996defe268a84bc2d7f0b4f5185cdae4dded648a4fa3b5bc987bbf4147e4442f022f34d905dc4d06e85b328c5b60f66e3721e158003ad2c63c77

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI20842\python38.dll
    Filesize

    4.0MB

    MD5

    3cd1e87aeb3d0037d52c8e51030e1084

    SHA1

    49ecd5f6a55f26b0fb3aeb4929868b93cc4ec8af

    SHA256

    13f7c38dc27777a507d4b7f0bd95d9b359925f6f5bf8d0465fe91e0976b610c8

    SHA512

    497e48a379885fdd69a770012e31cd2a62536953e317bb28e3a50fdb177e202f8869ea58fc11802909cabb0552d8c8850537e9fb4ead7dd14a99f67283182340

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI20842\ucrtbase.dll
    Filesize

    1020KB

    MD5

    2c8fe06966d5085a595ffa3c98fe3098

    SHA1

    e82945e3e63ffef0974d6dd74f2aef2bf6d0a908

    SHA256

    de8d08d01291df93821314176381f3d1ae863e6c5584a7f8ea42f0b94b15ef65

    SHA512

    fb08838983c16082a362b3fc89d5b82e61ae629207c13c3cb76b8a0af557ad95c842ce5197ae458b5af61e5449cbab579f509fa72866308aa6fbd3d751522d0f

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI20842\_bz2.pyd
    Filesize

    84KB

    MD5

    b89b6c064cd8241ae12addb7f376cab2

    SHA1

    29e86a1df404c442e14344042d39a98dd15425f7

    SHA256

    0563df6e938b836f817c49e0cf9828cc251b2092a84273152ea5a7c537c03beb

    SHA512

    f87b1c6d90cfb01316a17ad37f27287d5ef4ff3a0f7fd25303203ea7c7fa1ed12c1aef486dc9bbb8b4d527f37e771b950fa5142b2bac01f52afbfdbf7a77111d

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI20842\_ctypes.pyd
    Filesize

    123KB

    MD5

    4d13a7b3ecc8c7dc96a0424c465d7251

    SHA1

    0c72f7259ac9108d956aede40b6fcdf3a3943cb5

    SHA256

    2995ef03e784c68649fa7898979cbb2c1737f691348fae15f325d9fc524df8ed

    SHA512

    68ff7c421007d63a970269089afb39c949d6cf9f4d56aff7e4e0b88d3c43cfaa352364c5326523386c00727cc36e64274a51b5dbb3a343b16201cf5fc264fec8

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI20842\_queue.pyd
    Filesize

    27KB

    MD5

    1707a6aeeb0278ee445e86ee4354c86c

    SHA1

    50c30823b1dc995a03f5989c774d6541e5eaaef9

    SHA256

    dd8c39ff48de02f3f74256a61bf3d9d7e411c051dd4205ca51446b909458f0cd

    SHA512

    404b99b8c70de1d5e6a4f747df44f514a4b6480b6c30b468f35e9e0257fd75c1a480641bc88180f6eb50f0bd96bdcafb65bb25364c0757a6e601090ae5989838

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI20842\_socket.pyd
    Filesize

    77KB

    MD5

    eb974aeda30d7478bb800bb4c5fbc0a2

    SHA1

    c5b7bc326bd003d42bcf620d657cac3f46f9d566

    SHA256

    1db7b4f6ae31c4d35ef874eb328f735c96a2457677a3119e9544ee2a79bc1016

    SHA512

    f9eea3636371ba508d563cf21541a21879ce50a5666e419ecfd74255c8decc3ae5e2ceb4a8f066ae519101dd71a116335a359e3343e8b2ff3884812099ae9b1b

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI20842\api-ms-win-crt-conio-l1-1-0.dll
    Filesize

    21KB

    MD5

    2fef3607053bb580be058f982643ce5e

    SHA1

    67a1502af21ea0ecee138005247cc659685c6292

    SHA256

    a74105c989a5840f881d1c2a6aeee5ccafb471b73a7851ed780e51b921ac7c27

    SHA512

    21c84cb5c78a9abcd08fcea09e949a6c5be01f792f63a03c6e8308769fced91ac7e6d3dfbceab034b39a6281be7c9ce58b2a61487ebfbca4a0e3f850e840060f

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI20842\api-ms-win-crt-heap-l1-1-0.dll
    Filesize

    21KB

    MD5

    da9b25217135febe916b0d32889023ba

    SHA1

    8f1c5df9bd0a767d8d8cc5ec41f64574711a73c1

    SHA256

    fc2d5bb19c5340fa785d292ecc663f9e829b065c59d185ff963678f55f1c4cf0

    SHA512

    8b938b88fdca40c5b7a0662f155d468482d7e549f8b755a1b1d7dfecb4a7b8dff99d40eba26031e0c17dcee72528e79efa3bdda76b9629b7c38280aa731dee5e

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI20842\api-ms-win-crt-locale-l1-1-0.dll
    Filesize

    21KB

    MD5

    9d7eb5d9ed6e78f6d36435060405ec76

    SHA1

    a210d964bd80aa256848cf3e9315557b54b14d7c

    SHA256

    a2ecb8ea28b057dd0687ca8171e0ea680b1af2a06bc8a856b76ae5a7d603d276

    SHA512

    71864a8b2d0f9601fbf690af543a00170536481a5e0883d821f9c09090fb50c4ae1cfcffc7963d6479334783f7b8826a2fa4f693e1a6d869702862a9d927e17a

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI20842\api-ms-win-crt-math-l1-1-0.dll
    Filesize

    29KB

    MD5

    5bb362360e119dc4a3bee32bc64d3e95

    SHA1

    7d0f8f79dad1b377b38762c1b3cb4ea9170faaad

    SHA256

    f056e98fb44c16e22212925b2e532ccc7737ec51a60addef5e079188004c0f45

    SHA512

    bbe9e26d31779f09b68f637583227f331e67e3592d94d8e9304e3c9c4459f6f99716f2bfc9730afa047bbd9188a3cc9e9a32f0f6b2a942f695629a016dbc310c

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI20842\api-ms-win-crt-runtime-l1-1-0.dll
    Filesize

    25KB

    MD5

    34e317390c31ffa71a1f8b56ff97841f

    SHA1

    55961559a45bf96a62568f9f3b63a6753584c4ad

    SHA256

    787020267f15e2fcca4b788489a189186a6ee5198790bfdd10ac43ab6f8be9e8

    SHA512

    fcd8e43c1fb53a2c7255c89701286792f32c873d8cf270b71e565b4012b622179a4654ac44c28cf3928bdb7b3089ce3acfa3733987ef8c2cf43de0ba4bdc5330

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI20842\api-ms-win-crt-time-l1-1-0.dll
    Filesize

    21KB

    MD5

    2f6b133f271ae4d51c44325b5c8a3906

    SHA1

    bace8c46e0c9b49317c2348883709f280ffd3967

    SHA256

    7b94c325f88b8dded9030920397cb748332b737cb8869dcc0b4d11e70c444c9d

    SHA512

    28bd8a2086945e0031438acf03a6b3a3db9e3e7ddd9e4a37bec6b0eb0f3331a7ed4b790e3865fdee6acb6d890f13a7cb9152141ab16dab4323fe1fa7738b0b26

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI20842\api-ms-win-crt-utility-l1-1-0.dll
    Filesize

    21KB

    MD5

    c7e7a86754a0c5b38f01f74b188e6b4f

    SHA1

    65b36b27263f6db841d2da64ee76cb3893a3b8dc

    SHA256

    1fb3bf281e6accbd7a770199a2def42f3e850f2418fdc378d0af090f0057ead4

    SHA512

    aa9b6d1fae4205143e853388555ee4dd90b312a8fd5ee6573d70b37a0bae9612425965f01de09f912c6ef084a119f0984b5959108390074312d668c9ce0aeeed

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI20842\libcrypto-1_1.dll
    Filesize

    3.2MB

    MD5

    cc4cbf715966cdcad95a1e6c95592b3d

    SHA1

    d5873fea9c084bcc753d1c93b2d0716257bea7c3

    SHA256

    594303e2ce6a4a02439054c84592791bf4ab0b7c12e9bbdb4b040e27251521f1

    SHA512

    3b5af9fbbc915d172648c2b0b513b5d2151f940ccf54c23148cd303e6660395f180981b148202bef76f5209acc53b8953b1cb067546f90389a6aa300c1fbe477

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI20842\libffi-7.dll
    Filesize

    32KB

    MD5

    eef7981412be8ea459064d3090f4b3aa

    SHA1

    c60da4830ce27afc234b3c3014c583f7f0a5a925

    SHA256

    f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

    SHA512

    dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI20842\libssl-1_1.dll
    Filesize

    673KB

    MD5

    bc778f33480148efa5d62b2ec85aaa7d

    SHA1

    b1ec87cbd8bc4398c6ebb26549961c8aab53d855

    SHA256

    9d4cf1c03629f92662fc8d7e3f1094a7fc93cb41634994464b853df8036af843

    SHA512

    80c1dd9d0179e6cc5f33eb62d05576a350af78b5170bfdf2ecda16f1d8c3c2d0e991a5534a113361ae62079fb165fff2344efd1b43031f1a7bfda696552ee173

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI20842\select.pyd
    Filesize

    26KB

    MD5

    08b499ae297c5579ba05ea87c31aff5b

    SHA1

    4a1a9f1bf41c284e9c5a822f7d018f8edc461422

    SHA256

    940fb90fd78b5be4d72279dcf9c24a8b1fcf73999f39909980b12565a7921281

    SHA512

    ab26f4f80449aa9cc24e68344fc89aeb25d5ba5aae15aeed59a804216825818edfe31c7fda837a93a6db4068ccfb1cc7e99173a80bd9dda33bfb2d3b5937d7e9

    Download Submit