C:\Temp\bcpd_meshagent-meshagent2\Release\MeshService64.pdb
Behavioral task
behavioral1
Sample
2024-10-07_055266407042bb0d5121ef5375f7ca99_ryuk.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-10-07_055266407042bb0d5121ef5375f7ca99_ryuk.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-10-07_055266407042bb0d5121ef5375f7ca99_ryuk
-
Size
2.1MB
-
MD5
055266407042bb0d5121ef5375f7ca99
-
SHA1
fc765c68ee2a7c12267ed40b5e151f15ec92b4d8
-
SHA256
988293f20cc427d98b76f22bda80bc38458065a0846777c4aa61c5fe2ba392c1
-
SHA512
5552a162211ef26cbd224ddf2492a27523d86d1ee865edaa128ab848ed885545564f18096160814aae08d71dec7ff1db37caa2c8604827efae4a4852821c4ca6
-
SSDEEP
49152:/m+4kMUMUfgyzbZVuw7HMIWpDLv+wlVp6k2yjcU0FXPCN/mRi:ZhffgkbeZDLVlh2Yd/mRi
Malware Config
Signatures
-
Detects MeshAgent payload 1 IoCs
Processes:
resource yara_rule sample family_meshagent -
Meshagent family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 2024-10-07_055266407042bb0d5121ef5375f7ca99_ryuk
Files
-
2024-10-07_055266407042bb0d5121ef5375f7ca99_ryuk.exe windows:6 windows x64 arch:x64
8d696c76e26a7f89ddba1e2dba041414
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
setupapi
SetupDiGetDeviceInterfaceDetailA
SetupDiGetClassDevsA
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
dbghelp
StackWalk64
SymInitialize
SymFunctionTableAccess64
SymGetLineFromAddr64
SymGetModuleBase64
SymFromAddr
iphlpapi
ConvertLengthToIpv4Mask
SendARP
GetAdaptersAddresses
GetAdaptersInfo
ws2_32
ntohl
WSAGetLastError
ioctlsocket
recv
ntohs
WSASocketW
listen
closesocket
bind
accept
setsockopt
socket
gethostname
htonl
htons
send
WSASetLastError
WSACleanup
FreeAddrInfoW
select
WSAStartup
GetAddrInfoW
WSAIoctl
shutdown
connect
recvfrom
getsockopt
sendto
__WSAFDIsSet
getsockname
wintrust
WTHelperGetProvSignerFromChain
WTHelperGetProvCertFromChain
WTHelperProvDataFromStateData
WinVerifyTrust
version
VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
gdiplus
GdipCloneImage
GdipGetImageEncoders
GdipAlloc
GdiplusStartup
GdipDisposeImage
GdipFree
GdipGetImageEncodersSize
GdipSaveImageToStream
GdiplusShutdown
GdipLoadImageFromStream
winhttp
WinHttpGetIEProxyConfigForCurrentUser
kernel32
GetModuleFileNameA
GetStdHandle
WriteFile
GetFullPathNameA
GetSystemPowerStatus
SetCurrentDirectoryA
Sleep
GetLastError
CloseHandle
CreateProcessA
LoadLibraryA
GetProcAddress
FreeLibrary
ReadFile
GetCurrentThreadId
GetVersionExA
CreateThread
SleepEx
SetSystemPowerState
GetCurrentProcess
SetThreadExecutionState
FileTimeToSystemTime
QueryPerformanceFrequency
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
GetSystemTime
QueryPerformanceCounter
WaitForSingleObject
CancelIo
FindFirstFileW
FindNextFileW
RemoveDirectoryW
GetDriveTypeA
FindFirstVolumeA
FindClose
GetVolumePathNamesForVolumeNameA
GetFileAttributesExW
CreateFileA
ReadDirectoryChangesW
FindNextVolumeA
FindVolumeClose
GetDiskFreeSpaceExA
CreateEventA
ReleaseSemaphore
GetModuleHandleExA
CreateSemaphoreA
DeviceIoControl
ResetEvent
QueueUserAPC
CompareStringW
MultiByteToWideChar
WideCharToMultiByte
SetConsoleOutputCP
IsDebuggerPresent
CancelSynchronousIo
SetEvent
WaitForSingleObjectEx
GetThreadId
GetEnvironmentStrings
FreeEnvironmentStringsA
CopyFileA
RtlCaptureContext
DuplicateHandle
GetModuleHandleA
DeleteFileA
GetTickCount
OpenThread
CreateNamedPipeA
TerminateProcess
WaitForMultipleObjectsEx
WTSGetActiveConsoleSessionId
GetExitCodeProcess
SetConsoleCtrlHandler
GetModuleFileNameW
GlobalFree
FreeConsole
RemoveDirectoryA
CreateDirectoryA
GetFileType
GetModuleHandleW
SwitchToFiber
DeleteFiber
CreateFiber
GetSystemTimeAsFileTime
ConvertFiberToThread
ConvertThreadToFiber
GetCurrentProcessId
GlobalMemoryStatus
GetEnvironmentVariableW
GetConsoleMode
ReadConsoleA
ReadConsoleW
SetConsoleMode
SetLastError
RtlUnwindEx
GetStartupInfoW
InitializeSListHead
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
LCMapStringW
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetFilePointerEx
GetConsoleCP
GetStringTypeW
HeapReAlloc
FlushFileBuffers
GetCPInfo
SetStdHandle
FindFirstFileExA
FindNextFileA
LoadLibraryExW
ExitProcess
GetModuleHandleExW
CreateDirectoryW
DeleteFileW
MoveFileExW
GetTimeZoneInformation
GetCommandLineA
GetCommandLineW
GetACP
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetProcessHeap
WriteConsoleW
CreateFileW
RaiseException
HeapSize
HeapFree
HeapAlloc
GetDateFormatW
GetCurrentThread
GetTimeFormatW
SetEndOfFile
GetDriveTypeW
PeekNamedPipe
GetCurrentDirectoryW
GetFullPathNameW
RtlPcToFileHeader
GetOverlappedResult
EncodePointer
user32
GetUserObjectInformationW
GetProcessWindowStation
EndDialog
DialogBoxParamA
MessageBoxW
MessageBoxA
GetDlgItem
EnableWindow
MessageBeep
ExitWindowsEx
SetWindowTextA
FindWindowA
SetProcessDPIAware
SendInput
SetForegroundWindow
GetForegroundWindow
GetDC
ReleaseDC
GetUserObjectInformationA
CloseWindowStation
MapVirtualKeyA
SendMessageA
OpenInputDesktop
SetProcessWindowStation
GetMonitorInfoA
EnumDisplayMonitors
GetSystemMetrics
SetThreadDesktop
GetThreadDesktop
CloseDesktop
OpenWindowStationA
OpenDesktopA
gdi32
CreateCompatibleDC
SelectObject
GetDIBits
DeleteDC
SetStretchBltMode
DeleteObject
CreateCompatibleBitmap
BitBlt
StretchBlt
advapi32
CryptReleaseContext
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
OpenSCManagerA
RegisterServiceCtrlHandlerExA
DeleteService
ControlService
StartServiceA
FreeSid
CheckTokenMembership
ChangeServiceConfig2A
OpenServiceA
CreateProcessAsUserA
SetTokenInformation
DuplicateTokenEx
AdjustTokenPrivileges
LookupPrivilegeValueA
InitiateSystemShutdownA
OpenProcessToken
RegCreateKeyA
RegCloseKey
RegDeleteKeyA
RegQueryValueExA
RegSetValueExA
RegOpenKeyExA
RegDeleteValueA
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptCreateHash
CryptDestroyHash
CryptSignHashW
CryptEnumProvidersW
CryptGenRandom
AllocateAndInitializeSid
CloseServiceHandle
QueryServiceStatus
StartServiceCtrlDispatcherA
CreateServiceA
SetServiceStatus
shell32
SHGetFolderPathA
ole32
CoInitializeEx
CoUninitialize
CreateStreamOnHGlobal
CoCreateInstance
oleaut32
SysAllocString
SysFreeString
SysStringLen
crypt32
CertGetCertificateContextProperty
CertFreeCertificateContext
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertFindCertificateInStore
Sections
.text Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 468KB - Virtual size: 467KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 13KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 83KB - Virtual size: 83KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 512B - Virtual size: 196B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ