Analysis
-
max time kernel
93s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11-12-2024 13:24
Behavioral task
behavioral1
Sample
2024-12-11_341be12c967618ec1f15c1a5abd93f23_ismagent_ryuk_sliver.exe
Resource
win7-20240903-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-12-11_341be12c967618ec1f15c1a5abd93f23_ismagent_ryuk_sliver.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-12-11_341be12c967618ec1f15c1a5abd93f23_ismagent_ryuk_sliver.exe
-
Size
3.3MB
-
MD5
341be12c967618ec1f15c1a5abd93f23
-
SHA1
3aeb6aa534138682d70173cd4a7d3d02a948cfe1
-
SHA256
94552c3cf5c6fd5b158c621d990fa378e8297de6b349b3f1481483596fdc2dd6
-
SHA512
65d473b85dd0637dde4d485ef3bbd7ce322a2bf56c7d2c920b3d2388ed5ecc154df717ada42186bb99a2679fed3f0f5b902bd1d7dee6b923f3b941fc54fe65e4
-
SSDEEP
49152:kX3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQe85QU:klRsZ47/QXoHUOfAoj1x6U
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1256 wmic.exe Token: SeSecurityPrivilege 1256 wmic.exe Token: SeTakeOwnershipPrivilege 1256 wmic.exe Token: SeLoadDriverPrivilege 1256 wmic.exe Token: SeSystemProfilePrivilege 1256 wmic.exe Token: SeSystemtimePrivilege 1256 wmic.exe Token: SeProfSingleProcessPrivilege 1256 wmic.exe Token: SeIncBasePriorityPrivilege 1256 wmic.exe Token: SeCreatePagefilePrivilege 1256 wmic.exe Token: SeBackupPrivilege 1256 wmic.exe Token: SeRestorePrivilege 1256 wmic.exe Token: SeShutdownPrivilege 1256 wmic.exe Token: SeDebugPrivilege 1256 wmic.exe Token: SeSystemEnvironmentPrivilege 1256 wmic.exe Token: SeRemoteShutdownPrivilege 1256 wmic.exe Token: SeUndockPrivilege 1256 wmic.exe Token: SeManageVolumePrivilege 1256 wmic.exe Token: 33 1256 wmic.exe Token: 34 1256 wmic.exe Token: 35 1256 wmic.exe Token: 36 1256 wmic.exe Token: SeIncreaseQuotaPrivilege 1256 wmic.exe Token: SeSecurityPrivilege 1256 wmic.exe Token: SeTakeOwnershipPrivilege 1256 wmic.exe Token: SeLoadDriverPrivilege 1256 wmic.exe Token: SeSystemProfilePrivilege 1256 wmic.exe Token: SeSystemtimePrivilege 1256 wmic.exe Token: SeProfSingleProcessPrivilege 1256 wmic.exe Token: SeIncBasePriorityPrivilege 1256 wmic.exe Token: SeCreatePagefilePrivilege 1256 wmic.exe Token: SeBackupPrivilege 1256 wmic.exe Token: SeRestorePrivilege 1256 wmic.exe Token: SeShutdownPrivilege 1256 wmic.exe Token: SeDebugPrivilege 1256 wmic.exe Token: SeSystemEnvironmentPrivilege 1256 wmic.exe Token: SeRemoteShutdownPrivilege 1256 wmic.exe Token: SeUndockPrivilege 1256 wmic.exe Token: SeManageVolumePrivilege 1256 wmic.exe Token: 33 1256 wmic.exe Token: 34 1256 wmic.exe Token: 35 1256 wmic.exe Token: 36 1256 wmic.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 676 wrote to memory of 1256 676 2024-12-11_341be12c967618ec1f15c1a5abd93f23_ismagent_ryuk_sliver.exe 84 PID 676 wrote to memory of 1256 676 2024-12-11_341be12c967618ec1f15c1a5abd93f23_ismagent_ryuk_sliver.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-11_341be12c967618ec1f15c1a5abd93f23_ismagent_ryuk_sliver.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-11_341be12c967618ec1f15c1a5abd93f23_ismagent_ryuk_sliver.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:676 -
C:\Windows\system32\wbem\wmic.exewmic os get oslanguage /FORMAT:LIST2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1256
-