2024-09-27_b19ca1790f998ade806d1ad44df8b1c0_ryuk

Sharing

Copy URL Twitter E-mail

General

Target

2024-09-27_b19ca1790f998ade806d1ad44df8b1c0_ryuk
Size

1.3MB
MD5

b19ca1790f998ade806d1ad44df8b1c0
SHA1

306dca1b6cf4dbdf72b16db4e9451bea06116277
SHA256

8973f3391d3fe6eaa81e32b32939fc46745cd3cc2552c8ea8969e9e74551d775
SHA512

9136221a6cd9a7e048450b739db94806a52c55ba1f22b183a91a60b7d42755f4652646be52832b169f59c4391c3a4cdf98e74dbb0cff9edeec6b9a839200a310
SSDEEP

12288:85h0QakILwilYssP3YD7Gl8Gqcq1iWHaoIJbUFxJ8flCHIhwlW9rK:JrkI8ilYs+3Yel8Cq2JYPJClCohr9O

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-09-27_b19ca1790f998ade806d1ad44df8b1c0_ryuk

Files

2024-09-27_b19ca1790f998ade806d1ad44df8b1c0_ryuk
.exe windows:6 windows x64 arch:x64

cbe0257803d0906f055744885073447a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

E:\build_que\pm-driver-VM5\run\x64\release\LPlatSvc.pdb

Imports

kernel32

GetTickCount64
FreeLibraryAndExitThread
ResumeThread
ExitThread
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
WriteConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
TerminateProcess
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
GetCurrentProcess
WTSGetActiveConsoleSessionId
FreeLibrary
GetProcAddress
LoadLibraryExW
DisconnectNamedPipe
ReadFile
ConnectNamedPipe
CreateNamedPipeW
ResetEvent
WaitNamedPipeW
SetEvent
WaitForSingleObject
LocalAlloc
WriteFile
lstrlenW
GetCurrentProcessId
ProcessIdToSessionId
CreateThread
Sleep
CreateMutexW
WaitForMultipleObjects
CloseHandle
CreateEventW
GetModuleFileNameW
LocalFree
lstrcmpiW
DeviceIoControl
CreateFileW
SetLastError
FindNextFileW
FindFirstFileExW
FindClose
GetLastError
LCMapStringW
GetStringTypeW
GetFileType
GetACP
RtlUnwindEx
ExitProcess
WideCharToMultiByte
MultiByteToWideChar
GetStdHandle
HeapFree
InitializeCriticalSectionEx
HeapSize
HeapReAlloc
RaiseException
HeapAlloc
HeapDestroy
DeleteCriticalSection
GetProcessHeap
GetSystemPowerStatus
CallNamedPipeW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
CreateProcessW
OpenMutexW
ReleaseMutex
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObjectEx
GetModuleHandleW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
OutputDebugStringW
RtlPcToFileHeader
EncodePointer
GetModuleHandleExW

user32

GetMessageW
TranslateMessage
LoadAcceleratorsW
LoadStringW
RegisterPowerSettingNotification
GetRawInputData
GetRawInputDeviceInfoW
SendMessageW
TranslateAcceleratorW
EndDialog
PostQuitMessage
EndPaint
BeginPaint
DefWindowProcW
DestroyWindow
DialogBoxParamW
RegisterRawInputDevices
UpdateWindow
ShowWindow
DispatchMessageW
LoadIconW
LoadCursorW
RegisterClassExW
CreateWindowExW
FindWindowW

advapi32

OpenServiceW
RegisterServiceCtrlHandlerExW
ChangeServiceConfigW
StartServiceW
QueryServiceStatusEx
DeleteService
QueryServiceStatus
ControlService
CloseServiceHandle
CreateServiceW
OpenSCManagerW
DuplicateTokenEx
AdjustTokenPrivileges
LookupPrivilegeValueW
CreateProcessAsUserW
RevertToSelf
ImpersonateLoggedOnUser
SetTokenInformation
OpenProcessToken
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegSetValueExW
RegCreateKeyExW
DeregisterEventSource
ReportEventW
RegisterEventSourceW
SetServiceStatus
StartServiceCtrlDispatcherW

shell32

CommandLineToArgvW

wtsapi32

WTSQueryUserToken
WTSQuerySessionInformationW

userenv

CreateEnvironmentBlock

hid

HidD_GetAttributes

setupapi

SetupDiDestroyDeviceInfoList
SetupDiGetDeviceRegistryPropertyW
SetupDiGetClassDevsW
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailW

shlwapi

PathFindExtensionW

powrprof

CallNtPowerInformation
GetCurrentPowerPolicies

ole32

CoCreateInstance
CoInitializeEx
CoUninitialize
CoInitializeSecurity

oleaut32

VariantInit
VariantClear
SysAllocString
SysFreeString
SysStringByteLen
SysAllocStringByteLen

Exports

Exports

EXP_ParseCommandLine
OnSvcCtrlHandlerEx
OnSvcExit
OnSvcInit

Sections

.text
Size: 106KB - Virtual size: 106KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 556KB - Virtual size: 555KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 568KB - Virtual size: 572KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

cbe0257803d0906f055744885073447a

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

wtsapi32

userenv

hid

setupapi

shlwapi

powrprof

ole32

oleaut32

Exports

Exports

Sections

.text Size: 106KB - Virtual size: 106KB

.rdata Size: 57KB - Virtual size: 57KB

.data Size: 3KB - Virtual size: 8KB

.pdata Size: 7KB - Virtual size: 6KB

.gfids Size: 512B - Virtual size: 248B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 556KB - Virtual size: 555KB

.reloc Size: 568KB - Virtual size: 572KB

.text
Size: 106KB - Virtual size: 106KB

.rdata
Size: 57KB - Virtual size: 57KB

.data
Size: 3KB - Virtual size: 8KB

.pdata
Size: 7KB - Virtual size: 6KB

.gfids
Size: 512B - Virtual size: 248B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 556KB - Virtual size: 555KB

.reloc
Size: 568KB - Virtual size: 572KB