Analysis
-
max time kernel
31s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-11-2024 22:21
Static task
static1
Behavioral task
behavioral1
Sample
2024-11-20_0bef3b7ac8a7088b43913aeb50872cb5_ryuk.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-11-20_0bef3b7ac8a7088b43913aeb50872cb5_ryuk.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-11-20_0bef3b7ac8a7088b43913aeb50872cb5_ryuk.exe
-
Size
4.1MB
-
MD5
0bef3b7ac8a7088b43913aeb50872cb5
-
SHA1
4c049e504cadb46001b97866d4cc182a2ebe8ed5
-
SHA256
c793ad4e3cf5aaf4a58fae55b8ef20e936392a5ab36b68baeba38e58f356f900
-
SHA512
58b7b06c4a0164e00533af8060b01c89c92049d9d65c6a38faccafc91a025c4f74e0dfca4229018bfed1496ed19a38300dedc485ab5d0c7370da979bc52d5d68
-
SSDEEP
49152:qxGK0l3e3umT4jb2czkx+Lb81vcjZ2UBj1KzRSui1h5ZCTZ:qxGK09yukZ
Malware Config
Extracted
meduza
109.107.181.162
-
anti_dbg
true
-
anti_vm
true
-
build_name
6
-
extensions
none
-
grabber_max_size
1.048576e+06
-
links
none
-
port
15666
-
self_destruct
true
Signatures
-
Meduza Stealer payload 50 IoCs
Processes:
resource yara_rule behavioral1/memory/2688-10-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/2688-19-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/2688-22-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/2688-24-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/2688-28-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/2688-23-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/2688-21-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/2688-20-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/2688-17-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/2688-16-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/2688-26-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/2688-15-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/2688-14-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/2688-12-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/2688-8-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/2688-7-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/2688-6-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/2688-5-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/2688-45-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/2688-57-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/2688-56-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/2688-55-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/2688-54-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/2688-53-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/2688-50-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/2688-51-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/2688-49-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/2688-48-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/2688-47-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/2688-44-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/2688-59-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/2688-58-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/2688-62-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/2688-89-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/2688-88-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/2688-86-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/2688-84-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/2688-82-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/2688-83-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/2688-78-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/2688-77-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/2688-73-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/2688-70-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/2688-67-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/2688-66-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/2688-64-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/2688-95-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/2688-91-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/2688-98-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/2688-99-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza -
Meduza family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2024-11-20_0bef3b7ac8a7088b43913aeb50872cb5_ryuk.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Control Panel\International\Geo\Nation 2024-11-20_0bef3b7ac8a7088b43913aeb50872cb5_ryuk.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid Process 2944 cmd.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs
Processes:
2024-11-20_0bef3b7ac8a7088b43913aeb50872cb5_ryuk.exedescription ioc Process Key opened \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 2024-11-20_0bef3b7ac8a7088b43913aeb50872cb5_ryuk.exe Key opened \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 2024-11-20_0bef3b7ac8a7088b43913aeb50872cb5_ryuk.exe Key opened \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 2024-11-20_0bef3b7ac8a7088b43913aeb50872cb5_ryuk.exe Key opened \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\SOFTWARE\Microsoft\Office\12.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 2024-11-20_0bef3b7ac8a7088b43913aeb50872cb5_ryuk.exe Key opened \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\SOFTWARE\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 2024-11-20_0bef3b7ac8a7088b43913aeb50872cb5_ryuk.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 api.ipify.org 5 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
2024-11-20_0bef3b7ac8a7088b43913aeb50872cb5_ryuk.exedescription pid Process procid_target PID 2172 set thread context of 2688 2172 2024-11-20_0bef3b7ac8a7088b43913aeb50872cb5_ryuk.exe 30 -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
Processes:
cmd.exePING.EXEpid Process 2944 cmd.exe 2636 PING.EXE -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
2024-11-20_0bef3b7ac8a7088b43913aeb50872cb5_ryuk.exepid Process 2688 2024-11-20_0bef3b7ac8a7088b43913aeb50872cb5_ryuk.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
2024-11-20_0bef3b7ac8a7088b43913aeb50872cb5_ryuk.exedescription pid Process Token: SeDebugPrivilege 2688 2024-11-20_0bef3b7ac8a7088b43913aeb50872cb5_ryuk.exe Token: SeImpersonatePrivilege 2688 2024-11-20_0bef3b7ac8a7088b43913aeb50872cb5_ryuk.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
2024-11-20_0bef3b7ac8a7088b43913aeb50872cb5_ryuk.exe2024-11-20_0bef3b7ac8a7088b43913aeb50872cb5_ryuk.execmd.exedescription pid Process procid_target PID 2172 wrote to memory of 2688 2172 2024-11-20_0bef3b7ac8a7088b43913aeb50872cb5_ryuk.exe 30 PID 2172 wrote to memory of 2688 2172 2024-11-20_0bef3b7ac8a7088b43913aeb50872cb5_ryuk.exe 30 PID 2172 wrote to memory of 2688 2172 2024-11-20_0bef3b7ac8a7088b43913aeb50872cb5_ryuk.exe 30 PID 2172 wrote to memory of 2688 2172 2024-11-20_0bef3b7ac8a7088b43913aeb50872cb5_ryuk.exe 30 PID 2172 wrote to memory of 2688 2172 2024-11-20_0bef3b7ac8a7088b43913aeb50872cb5_ryuk.exe 30 PID 2172 wrote to memory of 2688 2172 2024-11-20_0bef3b7ac8a7088b43913aeb50872cb5_ryuk.exe 30 PID 2172 wrote to memory of 2688 2172 2024-11-20_0bef3b7ac8a7088b43913aeb50872cb5_ryuk.exe 30 PID 2172 wrote to memory of 2688 2172 2024-11-20_0bef3b7ac8a7088b43913aeb50872cb5_ryuk.exe 30 PID 2172 wrote to memory of 2688 2172 2024-11-20_0bef3b7ac8a7088b43913aeb50872cb5_ryuk.exe 30 PID 2172 wrote to memory of 2688 2172 2024-11-20_0bef3b7ac8a7088b43913aeb50872cb5_ryuk.exe 30 PID 2172 wrote to memory of 2688 2172 2024-11-20_0bef3b7ac8a7088b43913aeb50872cb5_ryuk.exe 30 PID 2688 wrote to memory of 2944 2688 2024-11-20_0bef3b7ac8a7088b43913aeb50872cb5_ryuk.exe 32 PID 2688 wrote to memory of 2944 2688 2024-11-20_0bef3b7ac8a7088b43913aeb50872cb5_ryuk.exe 32 PID 2688 wrote to memory of 2944 2688 2024-11-20_0bef3b7ac8a7088b43913aeb50872cb5_ryuk.exe 32 PID 2944 wrote to memory of 2636 2944 cmd.exe 34 PID 2944 wrote to memory of 2636 2944 cmd.exe 34 PID 2944 wrote to memory of 2636 2944 cmd.exe 34 -
outlook_office_path 1 IoCs
Processes:
2024-11-20_0bef3b7ac8a7088b43913aeb50872cb5_ryuk.exedescription ioc Process Key opened \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 2024-11-20_0bef3b7ac8a7088b43913aeb50872cb5_ryuk.exe -
outlook_win_path 1 IoCs
Processes:
2024-11-20_0bef3b7ac8a7088b43913aeb50872cb5_ryuk.exedescription ioc Process Key opened \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 2024-11-20_0bef3b7ac8a7088b43913aeb50872cb5_ryuk.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-20_0bef3b7ac8a7088b43913aeb50872cb5_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-20_0bef3b7ac8a7088b43913aeb50872cb5_ryuk.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\2024-11-20_0bef3b7ac8a7088b43913aeb50872cb5_ryuk.exeC:\Users\Admin\AppData\Local\Temp\2024-11-20_0bef3b7ac8a7088b43913aeb50872cb5_ryuk.exe2⤵
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:2688 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\2024-11-20_0bef3b7ac8a7088b43913aeb50872cb5_ryuk.exe"3⤵
- Deletes itself
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Windows\system32\PING.EXEping 1.1.1.1 -n 1 -w 30004⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2636
-
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1