2024-09-25_1b4266df079e12818238902409416809_ryuk

Sharing

Copy URL Twitter E-mail

General

Target

2024-09-25_1b4266df079e12818238902409416809_ryuk
Size

2.2MB
MD5

1b4266df079e12818238902409416809
SHA1

7002c1857a4054f6883e03ececb12736ece9716d
SHA256

f9f486789f176128960d54625bb6e4c9626fb52786f92460c1a1ea84899104bf
SHA512

111f65c57efbf3d32ef68fffb245d01d357c185093b7d30244dcfb1fe1d02232f429aea27bc5579cb086ba61715b82dbf2f6befbbad0e4fcb1669ef2624e76c1
SSDEEP

49152:mIg02miwWoUV3vLSUWWN0G19TckoGdgwZ+QUR:/gDwm1gwi

Score

1^/10

Malware Config

Signatures

Files

2024-09-25_1b4266df079e12818238902409416809_ryuk
.exe windows:6 windows x64 arch:x64

e024a85ed293461a821bdafa5b4930e3

Code Sign

1c:3b:21:e0:5a:34:9f:62:b8:f7:ac:65:55:6c:8e:fb
Certificate

Issuer

CN=Dell (Test)

Not Before

21/11/2013, 23:35

Not After

31/12/2039, 23:59

Subject

CN=Dell (Test)

60:73:a0:c2:77:25:be:7b:78:90:df:89:12:94:b0:32:82:86:94:a9
Signer

Actual PE Digest

60:73:a0:c2:77:25:be:7b:78:90:df:89:12:94:b0:32:82:86:94:a9

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\bamboo\xml-data\build-dir\CRED-CWS2637-JOB1\bin\Win64R\LSARecoveryDecrypt.pdb

Imports

shell32

SHCreateDirectoryExA
SHCreateDirectoryExW
SHGetKnownFolderPath
SHGetFolderPathAndSubDirW
SHFileOperationW
CommandLineToArgvW

comctl32

ImageList_ReplaceIcon
ImageList_Create
InitCommonControlsEx

user32

LoadStringW
GetMessageW
wsprintfW
TranslateMessage
DispatchMessageW
ExitWindowsEx
SendMessageW
PostMessageW
PostQuitMessage
DestroyWindow
ShowWindow
SetWindowPos
CreateDialogParamW
GetDlgItem
SetDlgItemTextA
SetDlgItemTextW
GetDlgItemTextW
SendDlgItemMessageW
SetFocus
EnableWindow
GetDC
InvalidateRect
GetWindowRect
MessageBoxW
ScreenToClient
GetWindowLongPtrW
SetWindowLongPtrW
SetClassLongPtrW
LoadIconW
IsDialogMessageW
CharNextW
wsprintfA
GetSystemMetrics

gdi32

GetDeviceCaps
SelectObject
DeleteObject
CreateFontIndirectW

advapi32

ImpersonateLoggedOnUser
DuplicateToken
SetEntriesInAclW
SetFileSecurityW
RegSetValueExW
RegQueryValueExA
RegOpenKeyExA
CryptEncrypt
CryptDestroyKey
CryptAcquireContextW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
LookupPrivilegeValueW
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
RevertToSelf
IsValidSecurityDescriptor
InitializeSecurityDescriptor
InitializeAcl
CloseServiceHandle
ControlService
CreateServiceW
DeleteService
OpenSCManagerW
OpenServiceW
QueryServiceStatusEx
StartServiceW
OpenProcessToken
OpenThreadToken
AccessCheck
AddAccessAllowedAce
AdjustTokenPrivileges
AllocateAndInitializeSid
FreeSid
GetLengthSid
ImpersonateSelf

ole32

CoTaskMemFree

crypt32

CryptImportPublicKeyInfo
CryptProtectMemory
CryptUnprotectData
CryptDecodeObject

winhttp

WinHttpSetStatusCallback
WinHttpOpen
WinHttpCloseHandle
WinHttpConnect
WinHttpReadData
WinHttpQueryOption
WinHttpSetOption
WinHttpSetTimeouts
WinHttpOpenRequest
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpGetProxyForUrl
WinHttpGetIEProxyConfigForCurrentUser

setupapi

SetupDiEnumDeviceInfo
SetupDiGetClassDevsW
SetupDiGetDeviceRegistryPropertyW
SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList

ws2_32

getaddrinfo
freeaddrinfo
WSAStartup
WSACleanup

kernel32

FindFirstFileExA
GetConsoleMode
GetConsoleCP
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetACP
GetStdHandle
GetModuleFileNameA
GetModuleHandleExW
ExitProcess
GetFileType
InitializeCriticalSectionEx
SetWaitableTimer
CancelWaitableTimer
CreateWaitableTimerW
SetThreadPriority
TerminateThread
SetStdHandle
LoadLibraryExW
RtlPcToFileHeader
GetEnvironmentVariableW
Sleep
GetTickCount
CreateDirectoryW
CreateFileW
GetFileAttributesW
WriteFile
CloseHandle
GetLastError
InitializeCriticalSection
DeleteCriticalSection
ReleaseMutex
WaitForSingleObject
CreateMutexW
GetSystemTime
MoveFileW
MoveFileExW
GetCommandLineW
GetCurrentProcess
GetCurrentThread
CreateProcessW
FreeLibrary
GetModuleFileNameW
GetProcAddress
LoadLibraryW
LocalAlloc
LocalFree
MulDiv
FormatMessageW
SystemTimeToFileTime
CreateMutexA
MultiByteToWideChar
ExpandEnvironmentStringsA
GetTempPathW
WideCharToMultiByte
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
CreateFileA
DeleteFileW
FindClose
FindFirstFileA
FindFirstFileW
GetFileSize
ReadFile
SetEndOfFile
SetFilePointer
OutputDebugStringW
HeapFree
GetProcessHeap
VirtualAlloc
VirtualFree
FlushFileBuffers
SetLastError
OutputDebugStringA
DeviceIoControl
SetEvent
CreateEventA
GetCurrentThreadId
GetSystemInfo
GetLocalTime
GetTickCount64
MapViewOfFile
CreateFileMappingA
GetDateFormatW
GetTimeFormatW
GetCurrentProcessId
GetSystemTimeAsFileTime
GetSystemDirectoryA
GetModuleHandleA
LoadLibraryA
lstrlenW
RemoveDirectoryW
GetSystemDirectoryW
GetComputerNameExW
GetDiskFreeSpaceExW
GetCurrentDirectoryW
GetTempFileNameW
EnterCriticalSection
LeaveCriticalSection
FormatMessageA
GetVolumeInformationW
GetLogicalDrives
FindFirstVolumeW
GetVolumePathNameW
GetVolumeNameForVolumeMountPointW
GetLogicalDriveStringsW
FindVolumeClose
FindNextVolumeW
GetDriveTypeW
DecodePointer
RaiseException
HeapDestroy
HeapReAlloc
HeapSize
InitializeCriticalSectionAndSpinCount
OpenProcess
FindResourceExW
LoadResource
LockResource
SizeofResource
FindResourceW
GlobalFree
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
IsDebuggerPresent
GetStringTypeW
EncodePointer
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
ResetEvent
WaitForSingleObjectEx
GetStartupInfoW
QueryPerformanceCounter
InitializeSListHead
RtlUnwindEx
WaitForMultipleObjects
DuplicateHandle
WriteConsoleW
ReadConsoleW
SetFilePointerEx
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
LoadLibraryExA
GetOEMCP
IsValidCodePage
FindNextFileA
HeapAlloc
CreateThread
FileTimeToSystemTime

bcrypt

BCryptDestroyKey
BCryptCloseAlgorithmProvider
BCryptGenRandom
BCryptGetProperty
BCryptSetProperty
BCryptGenerateSymmetricKey
BCryptEncrypt
BCryptDecrypt
BCryptOpenAlgorithmProvider
BCryptDeriveKeyPBKDF2
BCryptDestroyHash
BCryptCreateHash
BCryptHashData
BCryptFinishHash

rpcrt4

UuidCreate
UuidToStringW
RpcStringFreeW

Exports

Exports

GetProxyServer

Sections

.text
Size: 758KB - Virtual size: 758KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

RT_CODE
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 283KB - Virtual size: 282KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 13B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 369KB - Virtual size: 369KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e024a85ed293461a821bdafa5b4930e3

Code Sign

1c:3b:21:e0:5a:34:9f:62:b8:f7:ac:65:55:6c:8e:fbCertificate

60:73:a0:c2:77:25:be:7b:78:90:df:89:12:94:b0:32:82:86:94:a9Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shell32

comctl32

user32

gdi32

advapi32

ole32

crypt32

winhttp

setupapi

ws2_32

kernel32

bcrypt

rpcrt4

Exports

Exports

Sections

.text Size: 758KB - Virtual size: 758KB

RT_CODE Size: 2KB - Virtual size: 2KB

.rdata Size: 283KB - Virtual size: 282KB

.data Size: 13KB - Virtual size: 29KB

.pdata Size: 46KB - Virtual size: 45KB

.tls Size: 512B - Virtual size: 13B

.rsrc Size: 369KB - Virtual size: 369KB

.reloc Size: 9KB - Virtual size: 9KB

1c:3b:21:e0:5a:34:9f:62:b8:f7:ac:65:55:6c:8e:fb
Certificate

60:73:a0:c2:77:25:be:7b:78:90:df:89:12:94:b0:32:82:86:94:a9
Signer

.text
Size: 758KB - Virtual size: 758KB

RT_CODE
Size: 2KB - Virtual size: 2KB

.rdata
Size: 283KB - Virtual size: 282KB

.data
Size: 13KB - Virtual size: 29KB

.pdata
Size: 46KB - Virtual size: 45KB

.tls
Size: 512B - Virtual size: 13B

.rsrc
Size: 369KB - Virtual size: 369KB

.reloc
Size: 9KB - Virtual size: 9KB