| File name: | RyuuManifestTool.exe |
| Full analysis: | https://app.any.run/tasks/7e8284d6-2052-45ac-836d-5c302a801cc1 |
| Verdict: | Malicious activity |
| Analysis date: | June 04, 2025, 07:56:38 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32+ executable (GUI) x86-64, for MS Windows, 6 sections |
| MD5: | 624CBA1C6538F6E5C61D0304CEBA78A7 |
| SHA1: | 12C81D2483DD6D71501A0499D8A624569260B9D4 |
| SHA256: | E7913A1867BD9AE40AD16F661D81C0DC29843DF1AFFDA9CE00A6A0D3709517D8 |
| SSDEEP: | 98304:BJ3x30LYvI9yf+8Gm14vpm+Jak3Gm4jSmZUMUwitHfktEzafhOsE+XZ0TvGnRig1:FFfr0h7DGckQBObuTy9I6Nz4l0k/ |
MALICIOUS
No malicious indicators.SUSPICIOUS
Process drops legitimate windows executable
- RyuuManifestTool.exe (PID: 4220)
Executable content was dropped or overwritten
- RyuuManifestTool.exe (PID: 4220)
The process drops C-runtime libraries
- RyuuManifestTool.exe (PID: 4220)
Process drops python dynamic module
- RyuuManifestTool.exe (PID: 4220)
Loads Python modules
- RyuuManifestTool.exe (PID: 3268)
Application launched itself
- RyuuManifestTool.exe (PID: 4220)
INFO
Reads the computer name
- RyuuManifestTool.exe (PID: 4220)
- RyuuManifestTool.exe (PID: 3268)
Create files in a temporary directory
- RyuuManifestTool.exe (PID: 4220)
- RyuuManifestTool.exe (PID: 3268)
The sample compiled with english language support
- RyuuManifestTool.exe (PID: 4220)
Checks supported languages
- RyuuManifestTool.exe (PID: 4220)
- RyuuManifestTool.exe (PID: 3268)
Reads the software policy settings
- slui.exe (PID: 2392)
Checks proxy server information
- RyuuManifestTool.exe (PID: 3268)
- slui.exe (PID: 2392)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | InstallShield setup (57.6) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (36.9) |
| .exe | | | Generic Win/DOS Executable (2.6) |
| .exe | | | DOS Executable Generic (2.6) |
EXIF
EXE
| MachineType: | AMD AMD64 |
|---|---|
| TimeStamp: | 2025:04:12 18:12:51+00:00 |
| ImageFileCharacteristics: | Executable, Large address aware |
| PEType: | PE32+ |
| LinkerVersion: | 14.41 |
| CodeSize: | 172032 |
| InitializedDataSize: | 302080 |
| UninitializedDataSize: | - |
| EntryPoint: | 0xce20 |
| OSVersion: | 6 |
| ImageVersion: | - |
| SubsystemVersion: | 6 |
| Subsystem: | Windows GUI |
Total processes
125
Monitored processes
3
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2392 | C:\WINDOWS\System32\slui.exe -Embedding | C:\Windows\System32\slui.exe | svchost.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Activation Client Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3268 | "C:\Users\admin\Desktop\RyuuManifestTool.exe" | C:\Users\admin\Desktop\RyuuManifestTool.exe | RyuuManifestTool.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 1 Modules
| |||||||||||||||
| 4220 | "C:\Users\admin\Desktop\RyuuManifestTool.exe" | C:\Users\admin\Desktop\RyuuManifestTool.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 1 Modules
| |||||||||||||||
Total events
3 651
Read events
3 651
Write events
0
Delete events
0
Modification events
Executable files
62
Suspicious files
1
Text files
15
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 4220 | RyuuManifestTool.exe | C:\Users\admin\AppData\Local\Temp\_MEI42202\VCRUNTIME140_1.dll | executable | |
MD5:68156F41AE9A04D89BB6625A5CD222D4 | SHA256:82A2F9AE1E6146AE3CB0F4BC5A62B7227E0384209D9B1AEF86BBCC105912F7CD | |||
| 4220 | RyuuManifestTool.exe | C:\Users\admin\AppData\Local\Temp\_MEI42202\_lzma.pyd | executable | |
MD5:02B16654F73129B1A1220C00D757112D | SHA256:F6E0C786395CCC7B22F4C435B19F7073EB5974EB29E09F4C91060CAB10450E6A | |||
| 4220 | RyuuManifestTool.exe | C:\Users\admin\AppData\Local\Temp\_MEI42202\VCRUNTIME140.dll | executable | |
MD5:862F820C3251E4CA6FC0AC00E4092239 | SHA256:36585912E5EAF83BA9FEA0631534F690CCDC2D7BA91537166FE53E56C221E153 | |||
| 4220 | RyuuManifestTool.exe | C:\Users\admin\AppData\Local\Temp\_MEI42202\api-ms-win-core-file-l1-1-0.dll | executable | |
MD5:EFAD0EE0136532E8E8402770A64C71F9 | SHA256:3D2C55902385381869DB850B526261DDEB4628B83E690A32B67D2E0936B2C6ED | |||
| 4220 | RyuuManifestTool.exe | C:\Users\admin\AppData\Local\Temp\_MEI42202\api-ms-win-core-debug-l1-1-0.dll | executable | |
MD5:33BBECE432F8DA57F17BF2E396EBAA58 | SHA256:7CF0944901F7F7E0D0B9AD62753FC2FE380461B1CCE8CDC7E9C9867C980E3B0E | |||
| 4220 | RyuuManifestTool.exe | C:\Users\admin\AppData\Local\Temp\_MEI42202\_queue.pyd | executable | |
MD5:6F8624F0746FA31CF72EF568D6A121F1 | SHA256:37622CA591FB8E45A894DB9C0DA99BFCB18A820A48F028E4949D9256B69247E3 | |||
| 4220 | RyuuManifestTool.exe | C:\Users\admin\AppData\Local\Temp\_MEI42202\_wmi.pyd | executable | |
MD5:E203A46E89F443646CEC65D96ACEADBA | SHA256:AF1077D6377D5A0AEA123F0C324CC6D151AC4A29A84AAE23A6936B6D1C64B70A | |||
| 4220 | RyuuManifestTool.exe | C:\Users\admin\AppData\Local\Temp\_MEI42202\api-ms-win-core-datetime-l1-1-0.dll | executable | |
MD5:CFE0C1DFDE224EA5FED9BD5FF778A6E0 | SHA256:0D0F80CBF476AF5B1C9FD3775E086ED0DFDB510CD0CC208EC1CCB04572396E3E | |||
| 4220 | RyuuManifestTool.exe | C:\Users\admin\AppData\Local\Temp\_MEI42202\api-ms-win-core-console-l1-1-0.dll | executable | |
MD5:E8B9D74BFD1F6D1CC1D99B24F44DA796 | SHA256:B1B3FD40AB437A43C8DB4994CCFFC7F88000CC8BB6E34A2BCBFF8E2464930C59 | |||
| 4220 | RyuuManifestTool.exe | C:\Users\admin\AppData\Local\Temp\_MEI42202\_socket.pyd | executable | |
MD5:DC5A5AB89E6E2B48CB50B463B214FD89 | SHA256:0E2C1089974A2757426DAC3295201A33C990C36F3C09593F8A2B6E07FD36B99C | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
21
TCP/UDP connections
40
DNS requests
15
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | POST | 200 | 20.190.159.68:443 | https://login.live.com/RST2.srf | unknown | xml | 11.1 Kb | whitelisted |
7224 | RUXIMICS.exe | GET | 200 | 2.16.241.19:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
7224 | RUXIMICS.exe | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
— | — | POST | 200 | 20.190.159.68:443 | https://login.live.com/RST2.srf | unknown | xml | 11.0 Kb | whitelisted |
— | — | GET | 304 | 4.175.87.197:443 | https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL | unknown | — | — | unknown |
736 | SIHClient.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl | unknown | — | — | whitelisted |
— | — | POST | 500 | 40.91.76.224:443 | https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail | unknown | xml | 512 b | whitelisted |
736 | SIHClient.exe | GET | 200 | 23.216.77.28:80 | http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 40.69.42.241:443 | https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping | unknown | — | — | unknown |
736 | SIHClient.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.2.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 40.127.240.158:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
7224 | RUXIMICS.exe | 40.127.240.158:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
7224 | RUXIMICS.exe | 2.16.241.19:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
7224 | RUXIMICS.exe | 2.23.246.101:80 | www.microsoft.com | Ooredoo Q.S.C. | QA | whitelisted |
3268 | RyuuManifestTool.exe | 188.114.96.3:443 | generator.ryuu.lol | CLOUDFLARENET | NL | unknown |
6544 | svchost.exe | 20.190.160.4:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
3216 | svchost.exe | 172.211.123.250:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
736 | SIHClient.exe | 20.109.210.53:443 | slscr.update.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
generator.ryuu.lol |
| unknown |
login.live.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
activation-v2.sls.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
self.events.data.microsoft.com |
| whitelisted |