Analysis

  • max time kernel
    109s
  • max time network
    141s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    15-05-2021 13:38

General

  • Target

    ea10ab05b618be5b1fd74b2cecf0a1742c250bd4f5fc1b5a2cc7631a5378d366.dll

  • Size

    400KB

  • MD5

    d391a62494cbf96820137783e186c8d8

  • SHA1

    0cd9bf75231c5beee5b6fd2ffc53f9dce53684a2

  • SHA256

    ea10ab05b618be5b1fd74b2cecf0a1742c250bd4f5fc1b5a2cc7631a5378d366

  • SHA512

    55c1697a9dbf443f0078dfac9bba189a32b089276a71c47de9ceb5e33f95f719e31e2052339ebdce343e5b21e11108380db3bc209ec32431f08d02922d024a45

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Program crash 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 40 IoCs
  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\ea10ab05b618be5b1fd74b2cecf0a1742c250bd4f5fc1b5a2cc7631a5378d366.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4448
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\ea10ab05b618be5b1fd74b2cecf0a1742c250bd4f5fc1b5a2cc7631a5378d366.dll,#1
      2⤵
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:4472
      • C:\Windows\SysWOW64\rundll32Srv.exe
        C:\Windows\SysWOW64\rundll32Srv.exe
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:4664
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4704
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4792
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4792 CREDAT:82945 /prefetch:2
              6⤵
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:5064
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4472 -s 624
        3⤵
        • Program crash
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4852

Network

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

1
T1112

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
    MD5

    ff5e1f27193ce51eec318714ef038bef

    SHA1

    b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

    SHA256

    fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

    SHA512

    c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

  • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
    MD5

    ff5e1f27193ce51eec318714ef038bef

    SHA1

    b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

    SHA256

    fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

    SHA512

    c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
    MD5

    a0a5a4d72ad62fd610b043c84033deaf

    SHA1

    aa5c3deaba3b479e004880b369f63f2b59b23b9a

    SHA256

    35d20d28885d84fef2a2e06125bf9626fbab13b99d1238a435a444a8db1cb9c6

    SHA512

    20dd0d4276e854bca2767bd4cf7f04068a23742ff33926a7ba5296d2b0a453d456f37662e443c4df2fc3027bbead658a8ca6f8be40a61c82e3d6085cf85b9243

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
    MD5

    0ed48a8ca35f454136277e227c28d577

    SHA1

    0154513e848442efe6a0da610aa476e71eea175c

    SHA256

    5d288fe49f6ab9b80211e35feb4a30e078ccc38b8f25512624acf3c45c8ce426

    SHA512

    4f29bb84c56f9d286b13ca9198a61288ce4848c752715a97e5bb67b94a5e507eceb153689dbc9b6e85f4ef9be687e68f78d54196806a0e804c9e64c94ab65f90

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\NZUV1ERF.cookie
    MD5

    bf3ec645ad9d5614683f635fe187338e

    SHA1

    31d8cd7049d5e25c8ac83ec990030a5512e1f35c

    SHA256

    292b714b9a5d7874585a2859050fb40e19317fb0671fd8a38018f3f1288241ca

    SHA512

    5961807998f430b893da3126eddc098f6b6af4d3d1faef14b5c195b28d949509028c98e183876847ec7b74210529d4715a9b41fdb4f894f980e8e99d587c51df

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\V8258I83.cookie
    MD5

    edcb56a87beaec13eb132037acf4613b

    SHA1

    2be5199a5c355651b6a3bb5c900ea5b02d213124

    SHA256

    9c51d869537d6d847c767ad0dfc9346ceeb61cea670999bac18df490d120857f

    SHA512

    261b9fc7e724c0aca13d85377535a39eb5e52234b7acf486ba350f5869c72c6d42d53496accd2f8f5bcddce0f7ff6a69f83f25618eb802cd022277d42fd5d167

  • C:\Windows\SysWOW64\rundll32Srv.exe
    MD5

    ff5e1f27193ce51eec318714ef038bef

    SHA1

    b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

    SHA256

    fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

    SHA512

    c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

  • C:\Windows\SysWOW64\rundll32Srv.exe
    MD5

    ff5e1f27193ce51eec318714ef038bef

    SHA1

    b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

    SHA256

    fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

    SHA512

    c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

  • memory/4472-114-0x0000000000000000-mapping.dmp
  • memory/4664-115-0x0000000000000000-mapping.dmp
  • memory/4664-119-0x00000000001E0000-0x00000000001EF000-memory.dmp
    Filesize

    60KB

  • memory/4704-123-0x0000000000400000-0x000000000042E000-memory.dmp
    Filesize

    184KB

  • memory/4704-124-0x00000000001F0000-0x00000000001F1000-memory.dmp
    Filesize

    4KB

  • memory/4704-118-0x0000000000000000-mapping.dmp
  • memory/4792-127-0x00007FF9E7050000-0x00007FF9E70BB000-memory.dmp
    Filesize

    428KB

  • memory/4792-126-0x0000000000000000-mapping.dmp
  • memory/5064-128-0x0000000000000000-mapping.dmp