462f6e2a08a6250591da8d414c22b250bc6033f996a924c7c08a03ba929d6f2b

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28-12-2024 17:22

Target

2024-12-28_0920f55f8f80d22820f048b76781214b_cobalt-strike_ryuk.exe
Size

14.7MB
MD5

0920f55f8f80d22820f048b76781214b
SHA1

41f65a940ef7aa8e9316d6d8f805effaace2196e
SHA256

462f6e2a08a6250591da8d414c22b250bc6033f996a924c7c08a03ba929d6f2b
SHA512

d47aa08565f2d38f46d39bc4a7861f587ae943ebe86b09b6c0b49337a67967f8a995680152df115adf2a309279d9e7ad588083e91a103ccf912c5cb72655d52f
SSDEEP

393216:LijiMENzS8H/VIEJjI1PbV/jIJ92/juXnkIwvyx:LiWMSzS8H/egs15r+jwv

Score

5^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2388-2-0x0000000000400000-0x00000000004C9000-memory.dmp	upx

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 2160	1984	2024-12-28_0920f55f8f80d22820f048b76781214b_cobalt-strike_ryuk.exe	30
PID 1984 wrote to memory of 2160	1984	2024-12-28_0920f55f8f80d22820f048b76781214b_cobalt-strike_ryuk.exe	30
PID 1984 wrote to memory of 2160	1984	2024-12-28_0920f55f8f80d22820f048b76781214b_cobalt-strike_ryuk.exe	30
PID 1984 wrote to memory of 2160	1984	2024-12-28_0920f55f8f80d22820f048b76781214b_cobalt-strike_ryuk.exe	30
PID 1984 wrote to memory of 2388	1984	2024-12-28_0920f55f8f80d22820f048b76781214b_cobalt-strike_ryuk.exe	31
PID 1984 wrote to memory of 2388	1984	2024-12-28_0920f55f8f80d22820f048b76781214b_cobalt-strike_ryuk.exe	31
PID 1984 wrote to memory of 2388	1984	2024-12-28_0920f55f8f80d22820f048b76781214b_cobalt-strike_ryuk.exe	31
PID 1984 wrote to memory of 2388	1984	2024-12-28_0920f55f8f80d22820f048b76781214b_cobalt-strike_ryuk.exe	31
PID 1984 wrote to memory of 2388	1984	2024-12-28_0920f55f8f80d22820f048b76781214b_cobalt-strike_ryuk.exe	31

C:\Users\Admin\AppData\Local\Temp\2024-12-28_0920f55f8f80d22820f048b76781214b_cobalt-strike_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-12-28_0920f55f8f80d22820f048b76781214b_cobalt-strike_ryuk.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\SysWOW64\dxdiag.exe
  "C:\Windows\SysWOW64\dxdiag.exe"
  2⤵
  PID:2160
- C:\Windows\SysWOW64\dxdiag.exe
  "C:\Windows\SysWOW64\dxdiag.exe"
  2⤵
  PID:2388

memory/2388-2-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/2388-0-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download