Static task
static1
Behavioral task
behavioral1
Sample
2024-11-19_c2450d0f66c07a78c1a7a5c2664d9910_ryuk.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-11-19_c2450d0f66c07a78c1a7a5c2664d9910_ryuk.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-11-19_c2450d0f66c07a78c1a7a5c2664d9910_ryuk
-
Size
33.3MB
-
MD5
c2450d0f66c07a78c1a7a5c2664d9910
-
SHA1
0cbf7fae26f7de29fd63b263aa7ce9c055e520ab
-
SHA256
526638421154d503f4dfc76fefc7706ce98bd9436a0e38677a591e816eee5adb
-
SHA512
808890bbdee47cb022fd97a3c45c9ad932cb10d2cdaff7f2935572dc0f5708915d0db8e0124ca2323e1b33a338c9effc3dba93a64e73654e97236ca98142abe1
-
SSDEEP
12288:PDY0/yyAuUCOwkowl771VoAV+xyBqg+EX3287:rACOdoRAV+Isg+EWq
Malware Config
Signatures
Files
-
2024-11-19_c2450d0f66c07a78c1a7a5c2664d9910_ryuk.exe windows:6 windows x64 arch:x64
5f679f1fcc1b842ee1b7d06f33f3695e
Code Sign
3b:68:5b:3f:7a:f7:06:82:4e:57:0d:f5:34:9f:6a:e7Certificate
IssuerCN=FortuneSmileWorkTeam,L=Scottsdale,ST=Arizona,C=USNot Before09/03/2023, 00:00Not After09/03/2024, 23:59SubjectCN=FortuneSmileWorkTeam,L=Scottsdale,ST=Arizona,C=USSigner
Actual PE DigestDigest AlgorithmPE Digest MatchesfalseHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
WideCharToMultiByte
HeapDestroy
HeapSize
HeapReAlloc
TlsSetValue
InitializeCriticalSectionEx
DeleteCriticalSection
MultiByteToWideChar
SetUnhandledExceptionFilter
ReleaseSemaphoreWhenCallbackReturns
OutputDebugStringA
GetFileInformationByHandle
HeapUnlock
GetDiskFreeSpaceA
GetACP
FindNextVolumeMountPointW
CreateFileW
CreateBoundaryDescriptorA
CopyFileA
ConvertDefaultLocale
ActivateActCtx
GetModuleHandleA
GetProcAddress
FlushFileBuffers
SetFilePointerEx
GetConsoleMode
GetConsoleCP
SetStdHandle
GetProcessHeap
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
IsDebuggerPresent
OutputDebugStringW
RaiseException
GetLastError
EnterCriticalSection
LeaveCriticalSection
CloseHandle
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlPcToFileHeader
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsFree
FreeLibrary
LoadLibraryExW
RtlUnwindEx
SetLastError
GetCurrentProcess
TerminateProcess
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetStdHandle
WriteFile
GetCommandLineA
GetCommandLineW
HeapFree
HeapAlloc
GetFileType
CompareStringW
LCMapStringW
GetStringTypeW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
WriteConsoleW
gdi32
SetLayout
DPtoLP
CreateCompatibleDC
SetMapMode
advapi32
PerfSetULongCounterValue
PerfIncrementULongLongCounterValue
GetTrusteeTypeA
FreeSid
CreateProcessWithLogonW
AddAuditAccessAceEx
AccessCheckByTypeResultList
AbortSystemShutdownA
SetSecurityDescriptorOwner
shlwapi
ord345
SHRegCreateUSKeyA
UrlIsOpaqueW
PathFindOnPathA
oledlg
ord12
OleUIObjectPropertiesW
OleUIPasteSpecialW
OleUIBusyW
Sections
.text Size: 923KB - Virtual size: 923KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 143KB - Virtual size: 142KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 512B - Virtual size: 236B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32.2MB - Virtual size: 32.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ