be9a71fb71c7cd415fde4c8545daa820addb8c2a698596a23d0d8c2f27c885d8

Analysis

max time kernel
93s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-10-2024 17:25

Target

2024-10-13_56fd67a1c8858bcaff061bce33f9bb81_cobalt-strike_ryuk.exe
Size

4.0MB
MD5

56fd67a1c8858bcaff061bce33f9bb81
SHA1

00f21580a7722f83e95d370d1d2b3d1f786f2e15
SHA256

be9a71fb71c7cd415fde4c8545daa820addb8c2a698596a23d0d8c2f27c885d8
SHA512

e663ddbbe2cade1294163ba005960c1c14bf4319661a88f3fcb8f7c0fd17f1915b6b27ee5c954e48439164895753bbce7a9bbc64988478212982c1c2e38d1f59
SSDEEP

49152:06YsNAYAmoXin1OBfuHS1IFfv1remoXin1OBfuHS1IFfv1r6:XjZAm51OBfujFfvIm51OBfujFfvI

Score

1^/10

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4728	timeout.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4080 wrote to memory of 1476	4080	2024-10-13_56fd67a1c8858bcaff061bce33f9bb81_cobalt-strike_ryuk.exe	86
PID 4080 wrote to memory of 1476	4080	2024-10-13_56fd67a1c8858bcaff061bce33f9bb81_cobalt-strike_ryuk.exe	86
PID 1476 wrote to memory of 4728	1476	cmd.exe	88
PID 1476 wrote to memory of 4728	1476	cmd.exe	88

C:\Users\Admin\AppData\Local\Temp\2024-10-13_56fd67a1c8858bcaff061bce33f9bb81_cobalt-strike_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-13_56fd67a1c8858bcaff061bce33f9bb81_cobalt-strike_ryuk.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4080
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c timeout 5 & del /f C:\Users\Admin\AppData\Local\Temp\2024-10-13_56fd67a1c8858bcaff061bce33f9bb81_cobalt-strike_ryuk.exe & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1476
- - C:\Windows\system32\timeout.exe
    timeout 5
    3⤵
    - Delays execution with timeout.exe
    PID:4728