91d5fe6dd25a873126aabcd3e8de048c248fcd7d4c913c2d68ddbfab784a747d

Analysis

max time kernel
95s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2024 21:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-11-23_ecbc0c9ade6cad19f8cccff003b73558_ismagent_ryuk_sliver.exe
Size

3.3MB
MD5

ecbc0c9ade6cad19f8cccff003b73558
SHA1

2994bc4af27107a55704a661cc158c2a747e13dd
SHA256

91d5fe6dd25a873126aabcd3e8de048c248fcd7d4c913c2d68ddbfab784a747d
SHA512

ce644719a8d9b2123cafb3db8a9ca14fbb42a0d9124fa66d19a4aff613f3480ecee96ac52e718dd1662ba9e769752f2f1e7fdc1306354c88224783117d8e454a
SSDEEP

49152:iX3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQe85QP:ilRsZ47/QXoHUOfAoj1x6P

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 42 IoCs

Processes:

wmic.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	4964	wmic.exe
Token: SeSecurityPrivilege	4964	wmic.exe
Token: SeTakeOwnershipPrivilege	4964	wmic.exe
Token: SeLoadDriverPrivilege	4964	wmic.exe
Token: SeSystemProfilePrivilege	4964	wmic.exe
Token: SeSystemtimePrivilege	4964	wmic.exe
Token: SeProfSingleProcessPrivilege	4964	wmic.exe
Token: SeIncBasePriorityPrivilege	4964	wmic.exe
Token: SeCreatePagefilePrivilege	4964	wmic.exe
Token: SeBackupPrivilege	4964	wmic.exe
Token: SeRestorePrivilege	4964	wmic.exe
Token: SeShutdownPrivilege	4964	wmic.exe
Token: SeDebugPrivilege	4964	wmic.exe
Token: SeSystemEnvironmentPrivilege	4964	wmic.exe
Token: SeRemoteShutdownPrivilege	4964	wmic.exe
Token: SeUndockPrivilege	4964	wmic.exe
Token: SeManageVolumePrivilege	4964	wmic.exe
Token: 33	4964	wmic.exe
Token: 34	4964	wmic.exe
Token: 35	4964	wmic.exe
Token: 36	4964	wmic.exe
Token: SeIncreaseQuotaPrivilege	4964	wmic.exe
Token: SeSecurityPrivilege	4964	wmic.exe
Token: SeTakeOwnershipPrivilege	4964	wmic.exe
Token: SeLoadDriverPrivilege	4964	wmic.exe
Token: SeSystemProfilePrivilege	4964	wmic.exe
Token: SeSystemtimePrivilege	4964	wmic.exe
Token: SeProfSingleProcessPrivilege	4964	wmic.exe
Token: SeIncBasePriorityPrivilege	4964	wmic.exe
Token: SeCreatePagefilePrivilege	4964	wmic.exe
Token: SeBackupPrivilege	4964	wmic.exe
Token: SeRestorePrivilege	4964	wmic.exe
Token: SeShutdownPrivilege	4964	wmic.exe
Token: SeDebugPrivilege	4964	wmic.exe
Token: SeSystemEnvironmentPrivilege	4964	wmic.exe
Token: SeRemoteShutdownPrivilege	4964	wmic.exe
Token: SeUndockPrivilege	4964	wmic.exe
Token: SeManageVolumePrivilege	4964	wmic.exe
Token: 33	4964	wmic.exe
Token: 34	4964	wmic.exe
Token: 35	4964	wmic.exe
Token: 36	4964	wmic.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

2024-11-23_ecbc0c9ade6cad19f8cccff003b73558_ismagent_ryuk_sliver.exe

description	pid	process	target process
PID 4692 wrote to memory of 4964	4692	2024-11-23_ecbc0c9ade6cad19f8cccff003b73558_ismagent_ryuk_sliver.exe	wmic.exe
PID 4692 wrote to memory of 4964	4692	2024-11-23_ecbc0c9ade6cad19f8cccff003b73558_ismagent_ryuk_sliver.exe	wmic.exe

C:\Users\Admin\AppData\Local\Temp\2024-11-23_ecbc0c9ade6cad19f8cccff003b73558_ismagent_ryuk_sliver.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-23_ecbc0c9ade6cad19f8cccff003b73558_ismagent_ryuk_sliver.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4692
- C:\Windows\system32\wbem\wmic.exe
  wmic os get oslanguage /FORMAT:LIST
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4964

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads