ramnit | c0a68401f157e11bbaa8f00687410c74e0a92b3ac1c2c9ab0304bb1e8e98de20

General

Target

c0a68401f157e11bbaa8f00687410c74e0a92b3ac1c2c9ab0304bb1e8e98de20.exe
Size

3.0MB
MD5

6fb77db725e8348cc5f65d224a46a880
SHA1

5cbf64bd67d8a2ae93f87c6b9988652448235cee
SHA256

c0a68401f157e11bbaa8f00687410c74e0a92b3ac1c2c9ab0304bb1e8e98de20
SHA512

c45a88884c3867a824832712f6fae8105eeeeac21b67934dcfe3d46efbe8b6d03ccd087e9c3df168d218769b116fddf5a2ffad697b95b36d0496078c09916492

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Executes dropped EXE 2 IoCs

Processes:

c0a68401f157e11bbaa8f00687410c74e0a92b3ac1c2c9ab0304bb1e8e98de20Srv.exeDesktopLayer.exe

pid process

1204 c0a68401f157e11bbaa8f00687410c74e0a92b3ac1c2c9ab0304bb1e8e98de20Srv.exe
2028 DesktopLayer.exe

pid	process
1204	c0a68401f157e11bbaa8f00687410c74e0a92b3ac1c2c9ab0304bb1e8e98de20Srv.exe
2028	DesktopLayer.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\c0a68401f157e11bbaa8f00687410c74e0a92b3ac1c2c9ab0304bb1e8e98de20Srv.exe	upx
C:\Users\Admin\AppData\Local\Temp\c0a68401f157e11bbaa8f00687410c74e0a92b3ac1c2c9ab0304bb1e8e98de20Srv.exe	upx
C:\Users\Admin\AppData\Local\Temp\c0a68401f157e11bbaa8f00687410c74e0a92b3ac1c2c9ab0304bb1e8e98de20Srv.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
behavioral1/memory/1204-74-0x0000000000400000-0x000000000042E000-memory.dmp	upx

Loads dropped DLL 2 IoCs

Processes:

c0a68401f157e11bbaa8f00687410c74e0a92b3ac1c2c9ab0304bb1e8e98de20.exec0a68401f157e11bbaa8f00687410c74e0a92b3ac1c2c9ab0304bb1e8e98de20Srv.exe

pid	process
1888	c0a68401f157e11bbaa8f00687410c74e0a92b3ac1c2c9ab0304bb1e8e98de20.exe
1204	c0a68401f157e11bbaa8f00687410c74e0a92b3ac1c2c9ab0304bb1e8e98de20Srv.exe

Drops file in Program Files directory 3 IoCs

Processes:

c0a68401f157e11bbaa8f00687410c74e0a92b3ac1c2c9ab0304bb1e8e98de20Srv.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	c0a68401f157e11bbaa8f00687410c74e0a92b3ac1c2c9ab0304bb1e8e98de20Srv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	c0a68401f157e11bbaa8f00687410c74e0a92b3ac1c2c9ab0304bb1e8e98de20Srv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px1536.tmp	c0a68401f157e11bbaa8f00687410c74e0a92b3ac1c2c9ab0304bb1e8e98de20Srv.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exec0a68401f157e11bbaa8f00687410c74e0a92b3ac1c2c9ab0304bb1e8e98de20.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main	c0a68401f157e11bbaa8f00687410c74e0a92b3ac1c2c9ab0304bb1e8e98de20.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F054F741-B5AF-11EB-B526-FEC9D8D8C4F3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "327870257"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

c0a68401f157e11bbaa8f00687410c74e0a92b3ac1c2c9ab0304bb1e8e98de20.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	c0a68401f157e11bbaa8f00687410c74e0a92b3ac1c2c9ab0304bb1e8e98de20.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	c0a68401f157e11bbaa8f00687410c74e0a92b3ac1c2c9ab0304bb1e8e98de20.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

DesktopLayer.exe

pid process

2028 DesktopLayer.exe
2028 DesktopLayer.exe
2028 DesktopLayer.exe
2028 DesktopLayer.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

1836 iexplore.exe

pid	process
2028	DesktopLayer.exe
2028	DesktopLayer.exe
2028	DesktopLayer.exe
2028	DesktopLayer.exe

pid	process
1836	iexplore.exe

Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

c0a68401f157e11bbaa8f00687410c74e0a92b3ac1c2c9ab0304bb1e8e98de20.exeiexplore.exe

pid	process
1888	c0a68401f157e11bbaa8f00687410c74e0a92b3ac1c2c9ab0304bb1e8e98de20.exe
1888	c0a68401f157e11bbaa8f00687410c74e0a92b3ac1c2c9ab0304bb1e8e98de20.exe
1888	c0a68401f157e11bbaa8f00687410c74e0a92b3ac1c2c9ab0304bb1e8e98de20.exe
1888	c0a68401f157e11bbaa8f00687410c74e0a92b3ac1c2c9ab0304bb1e8e98de20.exe
1836	iexplore.exe

Suspicious use of SendNotifyMessage 4 IoCs

Processes:

c0a68401f157e11bbaa8f00687410c74e0a92b3ac1c2c9ab0304bb1e8e98de20.exe

pid	process
1888	c0a68401f157e11bbaa8f00687410c74e0a92b3ac1c2c9ab0304bb1e8e98de20.exe
1888	c0a68401f157e11bbaa8f00687410c74e0a92b3ac1c2c9ab0304bb1e8e98de20.exe
1888	c0a68401f157e11bbaa8f00687410c74e0a92b3ac1c2c9ab0304bb1e8e98de20.exe
1888	c0a68401f157e11bbaa8f00687410c74e0a92b3ac1c2c9ab0304bb1e8e98de20.exe

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

c0a68401f157e11bbaa8f00687410c74e0a92b3ac1c2c9ab0304bb1e8e98de20.exeiexplore.exeIEXPLORE.EXE

pid	process
1888	c0a68401f157e11bbaa8f00687410c74e0a92b3ac1c2c9ab0304bb1e8e98de20.exe
1888	c0a68401f157e11bbaa8f00687410c74e0a92b3ac1c2c9ab0304bb1e8e98de20.exe
1836	iexplore.exe
1836	iexplore.exe
1888	c0a68401f157e11bbaa8f00687410c74e0a92b3ac1c2c9ab0304bb1e8e98de20.exe
1888	c0a68401f157e11bbaa8f00687410c74e0a92b3ac1c2c9ab0304bb1e8e98de20.exe
1564	IEXPLORE.EXE
1564	IEXPLORE.EXE
1564	IEXPLORE.EXE
1564	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

c0a68401f157e11bbaa8f00687410c74e0a92b3ac1c2c9ab0304bb1e8e98de20.exec0a68401f157e11bbaa8f00687410c74e0a92b3ac1c2c9ab0304bb1e8e98de20Srv.exeDesktopLayer.exeiexplore.exe

description	pid	process	target process
PID 1888 wrote to memory of 1204	1888	c0a68401f157e11bbaa8f00687410c74e0a92b3ac1c2c9ab0304bb1e8e98de20.exe	c0a68401f157e11bbaa8f00687410c74e0a92b3ac1c2c9ab0304bb1e8e98de20Srv.exe
PID 1888 wrote to memory of 1204	1888	c0a68401f157e11bbaa8f00687410c74e0a92b3ac1c2c9ab0304bb1e8e98de20.exe	c0a68401f157e11bbaa8f00687410c74e0a92b3ac1c2c9ab0304bb1e8e98de20Srv.exe
PID 1888 wrote to memory of 1204	1888	c0a68401f157e11bbaa8f00687410c74e0a92b3ac1c2c9ab0304bb1e8e98de20.exe	c0a68401f157e11bbaa8f00687410c74e0a92b3ac1c2c9ab0304bb1e8e98de20Srv.exe
PID 1888 wrote to memory of 1204	1888	c0a68401f157e11bbaa8f00687410c74e0a92b3ac1c2c9ab0304bb1e8e98de20.exe	c0a68401f157e11bbaa8f00687410c74e0a92b3ac1c2c9ab0304bb1e8e98de20Srv.exe
PID 1204 wrote to memory of 2028	1204	c0a68401f157e11bbaa8f00687410c74e0a92b3ac1c2c9ab0304bb1e8e98de20Srv.exe	DesktopLayer.exe
PID 1204 wrote to memory of 2028	1204	c0a68401f157e11bbaa8f00687410c74e0a92b3ac1c2c9ab0304bb1e8e98de20Srv.exe	DesktopLayer.exe
PID 1204 wrote to memory of 2028	1204	c0a68401f157e11bbaa8f00687410c74e0a92b3ac1c2c9ab0304bb1e8e98de20Srv.exe	DesktopLayer.exe
PID 1204 wrote to memory of 2028	1204	c0a68401f157e11bbaa8f00687410c74e0a92b3ac1c2c9ab0304bb1e8e98de20Srv.exe	DesktopLayer.exe
PID 2028 wrote to memory of 1836	2028	DesktopLayer.exe	iexplore.exe
PID 2028 wrote to memory of 1836	2028	DesktopLayer.exe	iexplore.exe
PID 2028 wrote to memory of 1836	2028	DesktopLayer.exe	iexplore.exe
PID 2028 wrote to memory of 1836	2028	DesktopLayer.exe	iexplore.exe
PID 1836 wrote to memory of 1564	1836	iexplore.exe	IEXPLORE.EXE
PID 1836 wrote to memory of 1564	1836	iexplore.exe	IEXPLORE.EXE
PID 1836 wrote to memory of 1564	1836	iexplore.exe	IEXPLORE.EXE
PID 1836 wrote to memory of 1564	1836	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\c0a68401f157e11bbaa8f00687410c74e0a92b3ac1c2c9ab0304bb1e8e98de20.exe
"C:\Users\Admin\AppData\Local\Temp\c0a68401f157e11bbaa8f00687410c74e0a92b3ac1c2c9ab0304bb1e8e98de20.exe"
1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1888

C:\Users\Admin\AppData\Local\Temp\c0a68401f157e11bbaa8f00687410c74e0a92b3ac1c2c9ab0304bb1e8e98de20Srv.exe
C:\Users\Admin\AppData\Local\Temp\c0a68401f157e11bbaa8f00687410c74e0a92b3ac1c2c9ab0304bb1e8e98de20Srv.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1204

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2028

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1836

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1836 CREDAT:275457 /prefetch:2
5⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1564

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Install Root Certificate

1

T1130

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe
MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
6113e5cc7d437e7e4d2bca88020f52e7

SHA1
89bcaf3d62f1dd91ca138aaf7629f59d1222720b

SHA256
a178df3c5d5b9ae4911bfd9da80ad41dd2048b637992901af6d6328c63c1c932

SHA512
8122bb2774cbab28aba6bc091854ef96ab13d559bcc1e2058fa1d573d6d4b3b4cc4385ddfa190ea44b94eaf20e94871e93576defbce19fb473919027c5b56b41

Download Submit
C:\Users\Admin\AppData\Local\Temp\c0a68401f157e11bbaa8f00687410c74e0a92b3ac1c2c9ab0304bb1e8e98de20Srv.exe
MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\c0a68401f157e11bbaa8f00687410c74e0a92b3ac1c2c9ab0304bb1e8e98de20Srv.exe
MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\VRMW00LD.txt
MD5
fd6b161370341cf4650388cc499fb52f

SHA1
4f1e50cd495b0d343b22fb5552f7ec94f3066002

SHA256
ce4b01e79bd26a3697d412224350ae73aec85f606777c05e18438a7a79b9542b

SHA512
5e865c698950d498714b818f495cfba052a8dcaa1f720837e59acbdce39894a194ec29ed32c09d3662cacd0f3ced63fdc7e11dccd3dd322b6ce22c4107d8537c

Download Submit
\Program Files (x86)\Microsoft\DesktopLayer.exe
MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
\Users\Admin\AppData\Local\Temp\c0a68401f157e11bbaa8f00687410c74e0a92b3ac1c2c9ab0304bb1e8e98de20Srv.exe
MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
memory/1204-73-0x00000000002B0000-0x00000000002BF000-memory.dmp

Filesize
60KB

Download
memory/1204-74-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1204-61-0x0000000000000000-mapping.dmp

Download
memory/1564-72-0x0000000000000000-mapping.dmp

Download
memory/1836-71-0x0000000000000000-mapping.dmp

Download
memory/1836-77-0x0000000004070000-0x0000000004071000-memory.dmp

Filesize
4KB

Download
memory/1888-59-0x0000000075161000-0x0000000075163000-memory.dmp

Filesize
8KB

Download
memory/2028-70-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/2028-66-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads