Analysis
-
max time kernel
95s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
19-09-2024 05:54
General
-
Target
2024-09-19_a2c4015c90bc1030c2fca8aafea3c091_cobalt-strike_ryuk.exe
-
Size
2.1MB
-
MD5
a2c4015c90bc1030c2fca8aafea3c091
-
SHA1
d534b651d0a7bc5e11886b1474a02770d2972527
-
SHA256
52e50b6a239afc05586d77b87877784a926f452f792579456ac54da27832b19d
-
SHA512
d5fc7703971782b1087ec4562f6e7f5517e86859c64c2ae560fe9c9275be21bad23341b4b0fdddd4da14e8e99efa46f1d2a3ea1fb01d629507020c07d4126e6d
-
SSDEEP
49152:t59PYHvI7wi/lIKuLFrFXlMWaxbg5aB0zj0yjoB2:tGglIKgMTB2Yyjl
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-19_a2c4015c90bc1030c2fca8aafea3c091_cobalt-strike_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-19_a2c4015c90bc1030c2fca8aafea3c091_cobalt-strike_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.2MB