91d5fe6dd25a873126aabcd3e8de048c248fcd7d4c913c2d68ddbfab784a747d

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23-11-2024 21:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-11-23_ecbc0c9ade6cad19f8cccff003b73558_ismagent_ryuk_sliver.exe
Size

3.3MB
MD5

ecbc0c9ade6cad19f8cccff003b73558
SHA1

2994bc4af27107a55704a661cc158c2a747e13dd
SHA256

91d5fe6dd25a873126aabcd3e8de048c248fcd7d4c913c2d68ddbfab784a747d
SHA512

ce644719a8d9b2123cafb3db8a9ca14fbb42a0d9124fa66d19a4aff613f3480ecee96ac52e718dd1662ba9e769752f2f1e7fdc1306354c88224783117d8e454a
SSDEEP

49152:iX3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQe85QP:ilRsZ47/QXoHUOfAoj1x6P

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 40 IoCs

Processes:

wmic.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2512	wmic.exe
Token: SeSecurityPrivilege	2512	wmic.exe
Token: SeTakeOwnershipPrivilege	2512	wmic.exe
Token: SeLoadDriverPrivilege	2512	wmic.exe
Token: SeSystemProfilePrivilege	2512	wmic.exe
Token: SeSystemtimePrivilege	2512	wmic.exe
Token: SeProfSingleProcessPrivilege	2512	wmic.exe
Token: SeIncBasePriorityPrivilege	2512	wmic.exe
Token: SeCreatePagefilePrivilege	2512	wmic.exe
Token: SeBackupPrivilege	2512	wmic.exe
Token: SeRestorePrivilege	2512	wmic.exe
Token: SeShutdownPrivilege	2512	wmic.exe
Token: SeDebugPrivilege	2512	wmic.exe
Token: SeSystemEnvironmentPrivilege	2512	wmic.exe
Token: SeRemoteShutdownPrivilege	2512	wmic.exe
Token: SeUndockPrivilege	2512	wmic.exe
Token: SeManageVolumePrivilege	2512	wmic.exe
Token: 33	2512	wmic.exe
Token: 34	2512	wmic.exe
Token: 35	2512	wmic.exe
Token: SeIncreaseQuotaPrivilege	2512	wmic.exe
Token: SeSecurityPrivilege	2512	wmic.exe
Token: SeTakeOwnershipPrivilege	2512	wmic.exe
Token: SeLoadDriverPrivilege	2512	wmic.exe
Token: SeSystemProfilePrivilege	2512	wmic.exe
Token: SeSystemtimePrivilege	2512	wmic.exe
Token: SeProfSingleProcessPrivilege	2512	wmic.exe
Token: SeIncBasePriorityPrivilege	2512	wmic.exe
Token: SeCreatePagefilePrivilege	2512	wmic.exe
Token: SeBackupPrivilege	2512	wmic.exe
Token: SeRestorePrivilege	2512	wmic.exe
Token: SeShutdownPrivilege	2512	wmic.exe
Token: SeDebugPrivilege	2512	wmic.exe
Token: SeSystemEnvironmentPrivilege	2512	wmic.exe
Token: SeRemoteShutdownPrivilege	2512	wmic.exe
Token: SeUndockPrivilege	2512	wmic.exe
Token: SeManageVolumePrivilege	2512	wmic.exe
Token: 33	2512	wmic.exe
Token: 34	2512	wmic.exe
Token: 35	2512	wmic.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-11-23_ecbc0c9ade6cad19f8cccff003b73558_ismagent_ryuk_sliver.exe

description	pid	process	target process
PID 1920 wrote to memory of 2512	1920	2024-11-23_ecbc0c9ade6cad19f8cccff003b73558_ismagent_ryuk_sliver.exe	wmic.exe
PID 1920 wrote to memory of 2512	1920	2024-11-23_ecbc0c9ade6cad19f8cccff003b73558_ismagent_ryuk_sliver.exe	wmic.exe
PID 1920 wrote to memory of 2512	1920	2024-11-23_ecbc0c9ade6cad19f8cccff003b73558_ismagent_ryuk_sliver.exe	wmic.exe

C:\Users\Admin\AppData\Local\Temp\2024-11-23_ecbc0c9ade6cad19f8cccff003b73558_ismagent_ryuk_sliver.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-23_ecbc0c9ade6cad19f8cccff003b73558_ismagent_ryuk_sliver.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Windows\system32\wbem\wmic.exe
  wmic os get oslanguage /FORMAT:LIST
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2512

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads