Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    13-11-2024 04:52

General

  • Target

    2024-11-13_e90686fc03289172f29bcaf7bc7905fe_ismagent_ryuk_sliver.exe

  • Size

    3.3MB

  • MD5

    e90686fc03289172f29bcaf7bc7905fe

  • SHA1

    5ca31bbdf80c0049c0ff9d3a4d8cbe83007cc4d7

  • SHA256

    18244fd16a0210e4d4ee3c1fefce64ae722271283bbf4aa337f93af67c68489a

  • SHA512

    90641b4090e53c8b51170fbc8f0e3e8f07bdd91231d85d53f3e04e7f94d08244da65241c059c5fab1cd832463ada375574d18b14b03f221480d86f752be192c0

  • SSDEEP

    49152:AX3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ12Z7NAjHQej5Q:AlRsZ47/QXoHUOfAoj17a

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 40 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-11-13_e90686fc03289172f29bcaf7bc7905fe_ismagent_ryuk_sliver.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-11-13_e90686fc03289172f29bcaf7bc7905fe_ismagent_ryuk_sliver.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2068
    • C:\Windows\system32\wbem\wmic.exe
      wmic os get oslanguage /FORMAT:LIST
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.