Analysis

  • max time kernel
    120s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    16-05-2021 04:38

General

  • Target

    b8f6d8445b9fb56c7da8b89c54e4e5108ee22f5b09f379440c5d9b48f2328f0c.exe

  • Size

    160KB

  • MD5

    c13212695945649b14a5b56aa72a4c3c

  • SHA1

    f910797389f823beb1ef88ead07dc1870684f08c

  • SHA256

    b8f6d8445b9fb56c7da8b89c54e4e5108ee22f5b09f379440c5d9b48f2328f0c

  • SHA512

    1e6ac8e2347271fc90e87f71884358d11e2b5e104bb18d58311f7342a968b78297d65d06dc7c1961d83e025a5d2c77ef993a789e5923dc22d7c9fc35ca8db536

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 1 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: MapViewOfSection 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\wininit.exe
    wininit.exe
    1⤵
      PID:372
      • C:\Windows\system32\lsass.exe
        C:\Windows\system32\lsass.exe
        2⤵
          PID:480
        • C:\Windows\system32\services.exe
          C:\Windows\system32\services.exe
          2⤵
            PID:464
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k RPCSS
              3⤵
                PID:656
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k DcomLaunch
                3⤵
                  PID:580
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
                  3⤵
                    PID:744
                  • C:\Windows\System32\svchost.exe
                    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
                    3⤵
                      PID:808
                      • C:\Windows\system32\Dwm.exe
                        "C:\Windows\system32\Dwm.exe"
                        4⤵
                          PID:1180
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k LocalService
                        3⤵
                          PID:832
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k netsvcs
                          3⤵
                            PID:856
                            • C:\Windows\system32\wbem\WMIADAP.EXE
                              wmiadap.exe /F /T /R
                              4⤵
                                PID:1800
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k NetworkService
                              3⤵
                                PID:272
                              • C:\Windows\System32\spoolsv.exe
                                C:\Windows\System32\spoolsv.exe
                                3⤵
                                  PID:928
                                • C:\Windows\system32\taskhost.exe
                                  "taskhost.exe"
                                  3⤵
                                    PID:1124
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
                                    3⤵
                                      PID:1064
                                  • C:\Windows\system32\lsm.exe
                                    C:\Windows\system32\lsm.exe
                                    2⤵
                                      PID:488
                                  • C:\Windows\system32\csrss.exe
                                    %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
                                    1⤵
                                      PID:380
                                    • C:\Windows\system32\winlogon.exe
                                      winlogon.exe
                                      1⤵
                                        PID:420
                                      • C:\Windows\Explorer.EXE
                                        C:\Windows\Explorer.EXE
                                        1⤵
                                          PID:1208
                                          • C:\Users\Admin\AppData\Local\Temp\b8f6d8445b9fb56c7da8b89c54e4e5108ee22f5b09f379440c5d9b48f2328f0c.exe
                                            "C:\Users\Admin\AppData\Local\Temp\b8f6d8445b9fb56c7da8b89c54e4e5108ee22f5b09f379440c5d9b48f2328f0c.exe"
                                            2⤵
                                            • Loads dropped DLL
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious behavior: MapViewOfSection
                                            • Suspicious use of AdjustPrivilegeToken
                                            • Suspicious use of WriteProcessMemory
                                            PID:1688
                                            • C:\Users\Admin\AppData\Local\Temp\b8f6d8445b9fb56c7da8b89c54e4e5108ee22f5b09f379440c5d9b48f2328f0cSrv.exe
                                              C:\Users\Admin\AppData\Local\Temp\b8f6d8445b9fb56c7da8b89c54e4e5108ee22f5b09f379440c5d9b48f2328f0cSrv.exe
                                              3⤵
                                              • Executes dropped EXE
                                              • Drops file in Program Files directory
                                              PID:1816

                                        Network

                                        MITRE ATT&CK Matrix

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • C:\Users\Admin\AppData\Local\Temp\b8f6d8445b9fb56c7da8b89c54e4e5108ee22f5b09f379440c5d9b48f2328f0cSrv.exe
                                          MD5

                                          e7efb2a2b36ab241b6c9b770abf95000

                                          SHA1

                                          d4c253cbf80dc65a04747aea4afc91de6a4a4c5d

                                          SHA256

                                          4c7bf8d4e1ad5bd27b4b990791d4968be2a1d9cbb092c1af2e19a42c1b93e4c8

                                          SHA512

                                          958e64677c0acc6b2c0ef8e5ff5c39ea12986b8d5d0820710572af7669fdb6fe740e3ee609c1d9dfcdbfaee6a6f8fdeda25f64f7ad4d335627a024d6a1b4fcf3

                                        • C:\Users\Admin\AppData\Local\Temp\b8f6d8445b9fb56c7da8b89c54e4e5108ee22f5b09f379440c5d9b48f2328f0cSrv.exe
                                          MD5

                                          e7efb2a2b36ab241b6c9b770abf95000

                                          SHA1

                                          d4c253cbf80dc65a04747aea4afc91de6a4a4c5d

                                          SHA256

                                          4c7bf8d4e1ad5bd27b4b990791d4968be2a1d9cbb092c1af2e19a42c1b93e4c8

                                          SHA512

                                          958e64677c0acc6b2c0ef8e5ff5c39ea12986b8d5d0820710572af7669fdb6fe740e3ee609c1d9dfcdbfaee6a6f8fdeda25f64f7ad4d335627a024d6a1b4fcf3

                                        • \Users\Admin\AppData\Local\Temp\b8f6d8445b9fb56c7da8b89c54e4e5108ee22f5b09f379440c5d9b48f2328f0cSrv.exe
                                          MD5

                                          e7efb2a2b36ab241b6c9b770abf95000

                                          SHA1

                                          d4c253cbf80dc65a04747aea4afc91de6a4a4c5d

                                          SHA256

                                          4c7bf8d4e1ad5bd27b4b990791d4968be2a1d9cbb092c1af2e19a42c1b93e4c8

                                          SHA512

                                          958e64677c0acc6b2c0ef8e5ff5c39ea12986b8d5d0820710572af7669fdb6fe740e3ee609c1d9dfcdbfaee6a6f8fdeda25f64f7ad4d335627a024d6a1b4fcf3

                                        • memory/1816-61-0x0000000000000000-mapping.dmp
                                        • memory/1816-63-0x0000000075011000-0x0000000075013000-memory.dmp
                                          Filesize

                                          8KB

                                        • memory/1816-66-0x0000000000400000-0x000000000042E000-memory.dmp
                                          Filesize

                                          184KB

                                        • memory/1816-67-0x000000007EFA0000-0x000000007EFAC000-memory.dmp
                                          Filesize

                                          48KB

                                        • memory/1816-65-0x0000000000230000-0x000000000023F000-memory.dmp
                                          Filesize

                                          60KB