ramnit | 41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85f

General

Target

41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85f.exe
Size

313KB
MD5

e53fccd8979a713d50247bd9b715a8c8
SHA1

6d5c963ffd74b59b425ad2434db49e514073c353
SHA256

41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85f
SHA512

e6894a2f75ac004462875e0831b02d2dd77ae1d2d12404c61ca72f53b66ede7d10fbb9e9c28b80e0b47a40454b1225eed0eaeb589d75ea86259f978b60dff048

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Executes dropped EXE 4 IoCs

Processes:

41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exeDesktopLayer.exe41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exeDesktopLayer.exe

pid	process
548	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe
1020	DesktopLayer.exe
3740	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe
756	DesktopLayer.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe	upx
C:\Users\Admin\AppData\Local\Temp\41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
behavioral2/memory/548-134-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral2/memory/1020-138-0x0000000000400000-0x0000000000442000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe	upx
C:\Users\Admin\AppData\Local\Temp\41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx

Drops file in System32 directory 6 IoCs

Processes:

iexplore.exe

description	ioc	process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\Low	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\Low	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{59C50632-9F20-11EC-82D0-72CE14F6E1BC}.dat	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{61AAD1AF-9F20-11EC-82D0-72CE14F6E1BC}.dat	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\Favorites	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Low	iexplore.exe

Drops file in Program Files directory 5 IoCs

Processes:

41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxCEE6.tmp	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxD8E9.tmp	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe

Modifies Internet Explorer settings 1 TTPs 21 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30946093"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\Recovery\PendingDelete	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingDelete\C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{61AAF8BF-9F20-11EC-82D0-72CE14F6E1BC}.dat = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "801054788"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30946093"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "801209033"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{58ABB3CD-9F20-11EC-82D0-72CE14F6E1BC} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

iexplore.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\AppDataLow\Software\Microsoft\Internet Explorer	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Passport	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "234737826"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Zones	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\SecuritySafe = "1"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Recovery\PendingDelete\C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{61AAD1AF-9F20-11EC-82D0-72CE14F6E1BC}.dat = "0"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "30946177"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\IETld	iexplore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@ieframe.dll,-12512 = "Bing"	iexplore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Passport\LowDAMap	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Passport\LowDAMap	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Recovery	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main\SearchBandMigrationVersion = "1"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\AppDataLow\Software\Microsoft\RepService	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Recovery\PendingDelete	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\AppDataLow\Software\Microsoft	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Feeds	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{59C50632-9F20-11EC-82D0-72CE14F6E1BC} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\F12	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\AppDataLow\Software	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\AppDataLow	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\LowCache	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main\OperationalData = "12"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

DesktopLayer.exe41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85f.exeDesktopLayer.exe

pid	process
1020	DesktopLayer.exe
1020	DesktopLayer.exe
1020	DesktopLayer.exe
1020	DesktopLayer.exe
1020	DesktopLayer.exe
1020	DesktopLayer.exe
1020	DesktopLayer.exe
1020	DesktopLayer.exe
3716	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85f.exe
3716	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85f.exe
756	DesktopLayer.exe
756	DesktopLayer.exe
756	DesktopLayer.exe
756	DesktopLayer.exe
756	DesktopLayer.exe
756	DesktopLayer.exe
756	DesktopLayer.exe
756	DesktopLayer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85f.exe

pid process

3716 41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85f.exe

pid	process
3716	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85f.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85f.exe41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85f.exe

description	pid	process
Token: SeDebugPrivilege	3716	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85f.exe
Token: SeDebugPrivilege	2400	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85f.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

iexplore.exeiexplore.exe

pid process

3708 iexplore.exe
1404 iexplore.exe
3708 iexplore.exe
1404 iexplore.exe

pid	process
3708	iexplore.exe
1404	iexplore.exe
3708	iexplore.exe
1404	iexplore.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85f.exe41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exeDesktopLayer.exe41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85f.exe41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exeDesktopLayer.exeiexplore.exeiexplore.exe

description	pid	process	target process
PID 3716 wrote to memory of 548	3716	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85f.exe	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe
PID 3716 wrote to memory of 548	3716	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85f.exe	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe
PID 3716 wrote to memory of 548	3716	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85f.exe	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe
PID 548 wrote to memory of 1020	548	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe	DesktopLayer.exe
PID 548 wrote to memory of 1020	548	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe	DesktopLayer.exe
PID 548 wrote to memory of 1020	548	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe	DesktopLayer.exe
PID 1020 wrote to memory of 3708	1020	DesktopLayer.exe	iexplore.exe
PID 1020 wrote to memory of 3708	1020	DesktopLayer.exe	iexplore.exe
PID 2400 wrote to memory of 3740	2400	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85f.exe	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe
PID 2400 wrote to memory of 3740	2400	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85f.exe	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe
PID 2400 wrote to memory of 3740	2400	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85f.exe	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe
PID 3740 wrote to memory of 756	3740	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe	DesktopLayer.exe
PID 3740 wrote to memory of 756	3740	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe	DesktopLayer.exe
PID 3740 wrote to memory of 756	3740	41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe	DesktopLayer.exe
PID 756 wrote to memory of 1404	756	DesktopLayer.exe	iexplore.exe
PID 756 wrote to memory of 1404	756	DesktopLayer.exe	iexplore.exe
PID 3708 wrote to memory of 536	3708	iexplore.exe	IEXPLORE.EXE
PID 3708 wrote to memory of 536	3708	iexplore.exe	IEXPLORE.EXE
PID 3708 wrote to memory of 536	3708	iexplore.exe	IEXPLORE.EXE
PID 1404 wrote to memory of 364	1404	iexplore.exe	IEXPLORE.EXE
PID 1404 wrote to memory of 364	1404	iexplore.exe	IEXPLORE.EXE
PID 1404 wrote to memory of 364	1404	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85f.exe
"C:\Users\Admin\AppData\Local\Temp\41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85f.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3716

C:\Users\Admin\AppData\Local\Temp\41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe
C:\Users\Admin\AppData\Local\Temp\41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:548

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1020

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3708

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3708 CREDAT:17410 /prefetch:2
5⤵
PID:536

C:\Users\Admin\AppData\Local\Temp\41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85f.exe
"C:\Users\Admin\AppData\Local\Temp\41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85f.exe" /GetKeys WirelessKeyView01CDCF25
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2400

C:\Users\Admin\AppData\Local\Temp\41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe
C:\Users\Admin\AppData\Local\Temp\41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe
3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3740

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:756

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1404

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1404 CREDAT:17410 /prefetch:2
6⤵
PID:364

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
MD5
5b97603af0fc8f1dd40fc69bd6ca89cf

SHA1
18d63dbde43a5bc700ae55b9a013c596021ccd13

SHA256
33d3f697332b0fc4e09540cb9dc622ac0675fb8b2733554d4c0199307774ab52

SHA512
2064f951456fe29693f2653c88d44c2e6644af1087abc0d0d87ee5b81aae4c68cb7b459672741fe2cf635feda7994695741ca066493d80b90c470289bacd8acd

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe
MD5
5b97603af0fc8f1dd40fc69bd6ca89cf

SHA1
18d63dbde43a5bc700ae55b9a013c596021ccd13

SHA256
33d3f697332b0fc4e09540cb9dc622ac0675fb8b2733554d4c0199307774ab52

SHA512
2064f951456fe29693f2653c88d44c2e6644af1087abc0d0d87ee5b81aae4c68cb7b459672741fe2cf635feda7994695741ca066493d80b90c470289bacd8acd

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe
MD5
5b97603af0fc8f1dd40fc69bd6ca89cf

SHA1
18d63dbde43a5bc700ae55b9a013c596021ccd13

SHA256
33d3f697332b0fc4e09540cb9dc622ac0675fb8b2733554d4c0199307774ab52

SHA512
2064f951456fe29693f2653c88d44c2e6644af1087abc0d0d87ee5b81aae4c68cb7b459672741fe2cf635feda7994695741ca066493d80b90c470289bacd8acd

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe
MD5
5b97603af0fc8f1dd40fc69bd6ca89cf

SHA1
18d63dbde43a5bc700ae55b9a013c596021ccd13

SHA256
33d3f697332b0fc4e09540cb9dc622ac0675fb8b2733554d4c0199307774ab52

SHA512
2064f951456fe29693f2653c88d44c2e6644af1087abc0d0d87ee5b81aae4c68cb7b459672741fe2cf635feda7994695741ca066493d80b90c470289bacd8acd

Download Submit
C:\Users\Admin\AppData\Local\Temp\41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe
MD5
5b97603af0fc8f1dd40fc69bd6ca89cf

SHA1
18d63dbde43a5bc700ae55b9a013c596021ccd13

SHA256
33d3f697332b0fc4e09540cb9dc622ac0675fb8b2733554d4c0199307774ab52

SHA512
2064f951456fe29693f2653c88d44c2e6644af1087abc0d0d87ee5b81aae4c68cb7b459672741fe2cf635feda7994695741ca066493d80b90c470289bacd8acd

Download Submit
C:\Users\Admin\AppData\Local\Temp\41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe
MD5
5b97603af0fc8f1dd40fc69bd6ca89cf

SHA1
18d63dbde43a5bc700ae55b9a013c596021ccd13

SHA256
33d3f697332b0fc4e09540cb9dc622ac0675fb8b2733554d4c0199307774ab52

SHA512
2064f951456fe29693f2653c88d44c2e6644af1087abc0d0d87ee5b81aae4c68cb7b459672741fe2cf635feda7994695741ca066493d80b90c470289bacd8acd

Download Submit
C:\Users\Admin\AppData\Local\Temp\41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe
MD5
5b97603af0fc8f1dd40fc69bd6ca89cf

SHA1
18d63dbde43a5bc700ae55b9a013c596021ccd13

SHA256
33d3f697332b0fc4e09540cb9dc622ac0675fb8b2733554d4c0199307774ab52

SHA512
2064f951456fe29693f2653c88d44c2e6644af1087abc0d0d87ee5b81aae4c68cb7b459672741fe2cf635feda7994695741ca066493d80b90c470289bacd8acd

Download Submit
C:\Users\Admin\AppData\Local\Temp\41924ff751f099b4d1dcf12999bf58e6ede7854f5a64a8c2873c9807be1ca85fSrv.exe
MD5
5b97603af0fc8f1dd40fc69bd6ca89cf

SHA1
18d63dbde43a5bc700ae55b9a013c596021ccd13

SHA256
33d3f697332b0fc4e09540cb9dc622ac0675fb8b2733554d4c0199307774ab52

SHA512
2064f951456fe29693f2653c88d44c2e6644af1087abc0d0d87ee5b81aae4c68cb7b459672741fe2cf635feda7994695741ca066493d80b90c470289bacd8acd

Download Submit
memory/548-134-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/756-143-0x0000000000580000-0x0000000000581000-memory.dmp

Filesize
4KB

Download
memory/756-144-0x0000000077BE0000-0x0000000077D83000-memory.dmp

Filesize
1.6MB

Download
memory/1020-136-0x0000000077BE0000-0x0000000077D83000-memory.dmp

Filesize
1.6MB

Download
memory/1020-138-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1020-137-0x0000000000560000-0x000000000056F000-memory.dmp

Filesize
60KB

Download
memory/1020-135-0x0000000000570000-0x0000000000571000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads