0efa80d9a7031b7d7932f73dfb32adea14ff303cfac64de849a4b7f335e8f06c

Analysis

max time kernel
93s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2024, 00:47

Target

2024-09-08_ba9cd83e39fb606ecdb053cb2a88a312_ryuk.exe
Size

3.9MB
MD5

ba9cd83e39fb606ecdb053cb2a88a312
SHA1

1a504cbb6484585cb898d3cb581bc8c2463a9be0
SHA256

0efa80d9a7031b7d7932f73dfb32adea14ff303cfac64de849a4b7f335e8f06c
SHA512

4872202d9a8b3bba0a7887898ee583f63ab15fc633928c8f55939f19a2419edf580d8b0511d7fadc68ef7a442a43979f9136b79e8792365812aa8cc20972e20c
SSDEEP

98304:kH8CXVPOOwexy2sovq/V/R7d64PtTTbW0mK2ZvfljtitsECcnbHJK:kHt5E2sovq/hRhkm2ZFos2bHk

Score

7^/10

Loads dropped DLL 2 IoCs

pid	Process
3504	2024-09-08_ba9cd83e39fb606ecdb053cb2a88a312_ryuk.exe
3504	2024-09-08_ba9cd83e39fb606ecdb053cb2a88a312_ryuk.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 3504	2356	2024-09-08_ba9cd83e39fb606ecdb053cb2a88a312_ryuk.exe	84
PID 2356 wrote to memory of 3504	2356	2024-09-08_ba9cd83e39fb606ecdb053cb2a88a312_ryuk.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-09-08_ba9cd83e39fb606ecdb053cb2a88a312_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-08_ba9cd83e39fb606ecdb053cb2a88a312_ryuk.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Users\Admin\AppData\Local\Temp\2024-09-08_ba9cd83e39fb606ecdb053cb2a88a312_ryuk.exe
  "C:\Users\Admin\AppData\Local\Temp\2024-09-08_ba9cd83e39fb606ecdb053cb2a88a312_ryuk.exe"
  2⤵
  - Loads dropped DLL
  PID:3504

C:\Users\Admin\AppData\Local\Temp\_MEI23562\MAC_loader3.exe.manifest

Filesize
1019B

MD5
f8fef02667c2cd349f208c35b9365d13

SHA1
9c4a899630660f911e7f1b87d303fed4316f7243

SHA256
b928c600a189d7571694edec5e2e779ab4920d9da69352a55b3a24db812daa34

SHA512
057d8e6474f520a7efd666d2e8f79dcbbb8785443468384343b05c4dca1d81d6cdb2416d25895094b7743a8a61a3927b826085e644a616726fb87e70016aa38c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23562\python27.dll

Filesize
3.3MB

MD5
94391b3e094ee0752476a3e9b0276271

SHA1
cd5d8d26dd700b7611f6abdc1909bf6ced54f746

SHA256
38c4bdbc869139afcc8738924d400dea6f6e83eec91af29e176792e7c66bc1e0

SHA512
b77afecb7ceed795c359c0509c5f898bb3da4d6b260da188f40ba3934ddfcc41560f34e81b980e1adddaa755b2a74db83fcfcc605a2e4582b36e12719d40b00e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23~1\_ctypes.pyd

Filesize
119KB

MD5
f5ec0b24dfc7952241c7a86abfb61455

SHA1
84176ec5d9f6d106a3ac1724539dfccb7c4c6c33

SHA256
6c560fb6bac55b5b75ecd80d6f6efe797544fb6db060818f0a6e510ac5abd191

SHA512
91fad0a9b3a887b227fc5e40ebd0dc2e3a37805c02185ccd91547575e02c8196c76b96ce4bcc463e9993190e3b0a67ab5c8af1f5ada557f346a194455bc83040

Download Submit