Overview

overview

10

Static

static

8

2ebc6cc0eb...8d.exe

windows7_x64

10

2ebc6cc0eb...8d.exe

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    15-05-2021 11:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2ebc6cc0eb028071216502404e6935ec6faa3ca5f5f016ec923eefadd399a08d.exe

  • Size

    1.1MB

  • MD5

    0e4bd5604ce39c05edd755990ed830ad

  • SHA1

    99e2a36b902b831bcb592fe97e0d48f04aee67a5

  • SHA256

    2ebc6cc0eb028071216502404e6935ec6faa3ca5f5f016ec923eefadd399a08d

  • SHA512

    b0a8614acccaa7c509ec5a74d5b5ddaaaac3057c0711e19a3fb2250a85103969230ca60b7d65a8601c747f3c2ac627f9b263d3b58d60fe3a77ca36c02e8bcd00

Score
10/10
ramnitbankerevasionspywarestealertrojanupxworm

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

    trojanspywarestealerwormbankerramnit
  • Executes dropped EXE 2 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Loads dropped DLL 2 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Drops file in Program Files directory 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 29 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2ebc6cc0eb028071216502404e6935ec6faa3ca5f5f016ec923eefadd399a08d.exe
    "C:\Users\Admin\AppData\Local\Temp\2ebc6cc0eb028071216502404e6935ec6faa3ca5f5f016ec923eefadd399a08d.exe"
    1⤵
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • Modifies Internet Explorer settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1616
    • C:\Users\Admin\AppData\Local\Temp\2ebc6cc0eb028071216502404e6935ec6faa3ca5f5f016ec923eefadd399a08dSrv.exe
      C:\Users\Admin\AppData\Local\Temp\2ebc6cc0eb028071216502404e6935ec6faa3ca5f5f016ec923eefadd399a08dSrv.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:2036
      • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
        "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1208
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1316
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1316 CREDAT:275457 /prefetch:2
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:1148

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
    MD5

    ff5e1f27193ce51eec318714ef038bef

    SHA1

    b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

    SHA256

    fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

    SHA512

    c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

    Download Submit
  • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
    MD5

    ff5e1f27193ce51eec318714ef038bef

    SHA1

    b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

    SHA256

    fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

    SHA512

    c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\2ebc6cc0eb028071216502404e6935ec6faa3ca5f5f016ec923eefadd399a08dSrv.exe
    MD5

    ff5e1f27193ce51eec318714ef038bef

    SHA1

    b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

    SHA256

    fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

    SHA512

    c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\2ebc6cc0eb028071216502404e6935ec6faa3ca5f5f016ec923eefadd399a08dSrv.exe
    MD5

    ff5e1f27193ce51eec318714ef038bef

    SHA1

    b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

    SHA256

    fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

    SHA512

    c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\37X22B34.txt
    MD5

    4d60bc8de6e069b3b2e2c3e891da2fd8

    SHA1

    463ce0c48b95ac34dc765d673a8efa62aae57f77

    SHA256

    31256a78f9869fc057800d49fc51bcd8be5a285c27ad7e6167ee276ccb9cd647

    SHA512

    4ba969312f9a361d411f74b4f64789cf5b1640e95e17f2243e4311c379020f11250acb7abdb39a84856498a284f46caa622c79c7ee586148e94443926a08d923

    Download Submit
  • \Program Files (x86)\Microsoft\DesktopLayer.exe
    MD5

    ff5e1f27193ce51eec318714ef038bef

    SHA1

    b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

    SHA256

    fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

    SHA512

    c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

    Download Submit
  • \Users\Admin\AppData\Local\Temp\2ebc6cc0eb028071216502404e6935ec6faa3ca5f5f016ec923eefadd399a08dSrv.exe
    MD5

    ff5e1f27193ce51eec318714ef038bef

    SHA1

    b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

    SHA256

    fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

    SHA512

    c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

    Download Submit
  • memory/1148-77-0x0000000000000000-mapping.dmp
    Download
  • memory/1148-79-0x0000000000330000-0x0000000000332000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1208-66-0x0000000000000000-mapping.dmp
    Download
  • memory/1208-70-0x00000000001D0000-0x00000000001D1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1316-71-0x0000000000000000-mapping.dmp
    Download
  • memory/1316-72-0x000007FEFB881000-0x000007FEFB883000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1616-59-0x0000000075631000-0x0000000075633000-memory.dmp
    Filesize

    8KB

    Download
  • memory/2036-61-0x0000000000000000-mapping.dmp
    Download
  • memory/2036-73-0x0000000000230000-0x000000000023F000-memory.dmp
    Filesize

    60KB

    Download
  • memory/2036-74-0x0000000000400000-0x000000000042E000-memory.dmp
    Filesize

    184KB

    Download