ramnit | 680e418e349d611812a6afd357c39fa4fe3baf32cd95012f9b0632a364f2f349

General

Target

759e5f4dbc7432a87a19bcff1ae50ab7.exe
Size

328KB
MD5

759e5f4dbc7432a87a19bcff1ae50ab7
SHA1

2502825181f4b8c13461ba2002cea0e2b3511136
SHA256

680e418e349d611812a6afd357c39fa4fe3baf32cd95012f9b0632a364f2f349
SHA512

a9f304bc605f8806dbfbc33081e96883c11af9e5dd53068393ba00440c916c3f8f11c583fd10993a47ac282b14674c028484bf71497174601ff812f2e94d8abf

Score

10^/10

ramnit banker persistence spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Executes dropped EXE 2 IoCs

Processes:

759e5f4dbc7432a87a19bcff1ae50ab7Srv.exeDesktopLayer.exe

pid process

580 759e5f4dbc7432a87a19bcff1ae50ab7Srv.exe
3956 DesktopLayer.exe

pid	process
580	759e5f4dbc7432a87a19bcff1ae50ab7Srv.exe
3956	DesktopLayer.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\759e5f4dbc7432a87a19bcff1ae50ab7Srv.exe	upx
C:\Users\Admin\AppData\Local\Temp\759e5f4dbc7432a87a19bcff1ae50ab7Srv.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
behavioral2/memory/580-126-0x0000000000400000-0x000000000042E000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

759e5f4dbc7432a87a19bcff1ae50ab7.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\759e5f4dbc7432a87a19bcff1ae50ab7.exe"	759e5f4dbc7432a87a19bcff1ae50ab7.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

759e5f4dbc7432a87a19bcff1ae50ab7.exe

description	ioc	process
File opened (read-only)	\??\B:	759e5f4dbc7432a87a19bcff1ae50ab7.exe
File opened (read-only)	\??\P:	759e5f4dbc7432a87a19bcff1ae50ab7.exe
File opened (read-only)	\??\S:	759e5f4dbc7432a87a19bcff1ae50ab7.exe
File opened (read-only)	\??\Y:	759e5f4dbc7432a87a19bcff1ae50ab7.exe
File opened (read-only)	\??\E:	759e5f4dbc7432a87a19bcff1ae50ab7.exe
File opened (read-only)	\??\L:	759e5f4dbc7432a87a19bcff1ae50ab7.exe
File opened (read-only)	\??\Q:	759e5f4dbc7432a87a19bcff1ae50ab7.exe
File opened (read-only)	\??\R:	759e5f4dbc7432a87a19bcff1ae50ab7.exe
File opened (read-only)	\??\X:	759e5f4dbc7432a87a19bcff1ae50ab7.exe
File opened (read-only)	\??\F:	759e5f4dbc7432a87a19bcff1ae50ab7.exe
File opened (read-only)	\??\G:	759e5f4dbc7432a87a19bcff1ae50ab7.exe
File opened (read-only)	\??\J:	759e5f4dbc7432a87a19bcff1ae50ab7.exe
File opened (read-only)	\??\O:	759e5f4dbc7432a87a19bcff1ae50ab7.exe
File opened (read-only)	\??\U:	759e5f4dbc7432a87a19bcff1ae50ab7.exe
File opened (read-only)	\??\W:	759e5f4dbc7432a87a19bcff1ae50ab7.exe
File opened (read-only)	\??\Z:	759e5f4dbc7432a87a19bcff1ae50ab7.exe
File opened (read-only)	\??\H:	759e5f4dbc7432a87a19bcff1ae50ab7.exe
File opened (read-only)	\??\I:	759e5f4dbc7432a87a19bcff1ae50ab7.exe
File opened (read-only)	\??\K:	759e5f4dbc7432a87a19bcff1ae50ab7.exe
File opened (read-only)	\??\M:	759e5f4dbc7432a87a19bcff1ae50ab7.exe
File opened (read-only)	\??\N:	759e5f4dbc7432a87a19bcff1ae50ab7.exe
File opened (read-only)	\??\T:	759e5f4dbc7432a87a19bcff1ae50ab7.exe
File opened (read-only)	\??\V:	759e5f4dbc7432a87a19bcff1ae50ab7.exe

Drops file in Program Files directory 3 IoCs

Processes:

759e5f4dbc7432a87a19bcff1ae50ab7Srv.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	759e5f4dbc7432a87a19bcff1ae50ab7Srv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px55BC.tmp	759e5f4dbc7432a87a19bcff1ae50ab7Srv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	759e5f4dbc7432a87a19bcff1ae50ab7Srv.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

759e5f4dbc7432a87a19bcff1ae50ab7.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	759e5f4dbc7432a87a19bcff1ae50ab7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	759e5f4dbc7432a87a19bcff1ae50ab7.exe

Modifies Internet Explorer settings 1 TTPs 40 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "339869140"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz!	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "339885734"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3623070666"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3622914226"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{02F64E87-22D1-11EC-B2DB-F634F559A0EA} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "339917726"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30914269"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3645883657"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30914269"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30914269"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

759e5f4dbc7432a87a19bcff1ae50ab7.exeDesktopLayer.exe

pid	process
4060	759e5f4dbc7432a87a19bcff1ae50ab7.exe
4060	759e5f4dbc7432a87a19bcff1ae50ab7.exe
4060	759e5f4dbc7432a87a19bcff1ae50ab7.exe
4060	759e5f4dbc7432a87a19bcff1ae50ab7.exe
3956	DesktopLayer.exe
3956	DesktopLayer.exe
3956	DesktopLayer.exe
3956	DesktopLayer.exe
3956	DesktopLayer.exe
3956	DesktopLayer.exe
3956	DesktopLayer.exe
3956	DesktopLayer.exe
4060	759e5f4dbc7432a87a19bcff1ae50ab7.exe
4060	759e5f4dbc7432a87a19bcff1ae50ab7.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

3292 iexplore.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

3292 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

3292 iexplore.exe
3292 iexplore.exe
3000 IEXPLORE.EXE
3000 IEXPLORE.EXE
3000 IEXPLORE.EXE
3000 IEXPLORE.EXE

pid	process
3292	iexplore.exe

pid	process
3292	iexplore.exe

pid	process
3292	iexplore.exe
3292	iexplore.exe
3000	IEXPLORE.EXE
3000	IEXPLORE.EXE
3000	IEXPLORE.EXE
3000	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

759e5f4dbc7432a87a19bcff1ae50ab7.exe759e5f4dbc7432a87a19bcff1ae50ab7Srv.exeDesktopLayer.exeiexplore.exe

description	pid	process	target process
PID 4060 wrote to memory of 580	4060	759e5f4dbc7432a87a19bcff1ae50ab7.exe	759e5f4dbc7432a87a19bcff1ae50ab7Srv.exe
PID 4060 wrote to memory of 580	4060	759e5f4dbc7432a87a19bcff1ae50ab7.exe	759e5f4dbc7432a87a19bcff1ae50ab7Srv.exe
PID 4060 wrote to memory of 580	4060	759e5f4dbc7432a87a19bcff1ae50ab7.exe	759e5f4dbc7432a87a19bcff1ae50ab7Srv.exe
PID 580 wrote to memory of 3956	580	759e5f4dbc7432a87a19bcff1ae50ab7Srv.exe	DesktopLayer.exe
PID 580 wrote to memory of 3956	580	759e5f4dbc7432a87a19bcff1ae50ab7Srv.exe	DesktopLayer.exe
PID 580 wrote to memory of 3956	580	759e5f4dbc7432a87a19bcff1ae50ab7Srv.exe	DesktopLayer.exe
PID 3956 wrote to memory of 3292	3956	DesktopLayer.exe	iexplore.exe
PID 3956 wrote to memory of 3292	3956	DesktopLayer.exe	iexplore.exe
PID 3292 wrote to memory of 3000	3292	iexplore.exe	IEXPLORE.EXE
PID 3292 wrote to memory of 3000	3292	iexplore.exe	IEXPLORE.EXE
PID 3292 wrote to memory of 3000	3292	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\759e5f4dbc7432a87a19bcff1ae50ab7.exe
"C:\Users\Admin\AppData\Local\Temp\759e5f4dbc7432a87a19bcff1ae50ab7.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4060

C:\Users\Admin\AppData\Local\Temp\759e5f4dbc7432a87a19bcff1ae50ab7Srv.exe
C:\Users\Admin\AppData\Local\Temp\759e5f4dbc7432a87a19bcff1ae50ab7Srv.exe
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:580

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3956

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3292

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3292 CREDAT:82945 /prefetch:2
5⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3000

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

2

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe
MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
MD5
3f3551c43887e7b5c182de5cafb20bda

SHA1
42ce339d805c81a81f2562bc99c302e6fbba0968

SHA256
071d4d8c4eab632e8b1dc87b811bf558bb37ba5aa0ade0c380254897bfac6c08

SHA512
c98832059737978197b256b2e7578145a9fe1e0a5f8731431eefdc0f7d331010b5fc947afb8eb54adf3728acd16bfff18d6b5eff1c75831e6d347e8f1b55afe1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
MD5
04fa0450e622f3d28dfb258ca7b57b74

SHA1
a83192874c867aa48f18b8b9d10e6c3782530de0

SHA256
7cff79a190ed83973ae21eff5fcab18f6114cd7fe6028ff6a61ad9614abffdfe

SHA512
e87119a245e9f2ba363427de771c84a701e3b1613a1629d037239f165564035edb8a6b9ddbb302a13477badf617cc3dfa723b5de425edefeddade6ec45445eeb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\02WMY1WP.cookie
MD5
932a18391a3fd75a19ede55ed86bfb37

SHA1
32ffb3fc8ad4a4cb328342f172c05c874cde800f

SHA256
fa32b3a06d94fa0a690ebc6e42a9dbd603e45dae277d8c1c8109b35f64ed4cb7

SHA512
b16c9cdd37e2f8a6ff26b6fb302a655b78b210384e7bc49c2b8a8ffc13dd5b3e2a643caf464c7feda15f4dd0cc4b5edf283ba1cde692bc4d37a2b9454b3e9550

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\7K0RLQXY.cookie
MD5
0f9ad2a15f8dec5c1ae4851d2e86466f

SHA1
f2d5fd54481428c674657ed9d3ff4a94d370e4f6

SHA256
6ebe48921e27c59f2d401724bf119a0cde3caea08b9fc78d65bb926e32ad8e30

SHA512
bd1cdafd3d06b6c2191211545dc2c2743b124ffd86e5015060dedb25d5d4a67ac9fd04669600233c8079d8dcdbb0a121dfbcff15ea235b9153f91ff3e9196875

Download Submit
C:\Users\Admin\AppData\Local\Temp\759e5f4dbc7432a87a19bcff1ae50ab7Srv.exe
MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\759e5f4dbc7432a87a19bcff1ae50ab7Srv.exe
MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
memory/580-117-0x0000000000000000-mapping.dmp

Download
memory/580-126-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/580-125-0x00000000001E0000-0x00000000001EF000-memory.dmp

Filesize
60KB

Download
memory/3000-128-0x0000000000000000-mapping.dmp

Download
memory/3292-127-0x00007FFAA8050000-0x00007FFAA80BB000-memory.dmp

Filesize
428KB

Download
memory/3292-124-0x0000000000000000-mapping.dmp

Download
memory/3956-123-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/3956-120-0x0000000000000000-mapping.dmp

Download
memory/4060-114-0x0000000010000000-0x0000000010024000-memory.dmp

Filesize
144KB

Download
memory/4060-116-0x0000000010015000-0x0000000010024000-memory.dmp

Filesize
60KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads