Overview

overview

10

Static

static

522fd3443f...6d.dll

windows7-x64

10

522fd3443f...6d.dll

windows10-2004-x64

10

Analysis

  • max time kernel
    135s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/10/2022, 17:51

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    522fd3443f9ccfd96efd25ca5d8a394203bd279fe5c5959ed47239a92a063a6d.dll
  • Size 144KB
  • Sample221001-wfktvshda2
  • SHA256 522fd3443f9ccfd96efd25ca5d8a394203bd279fe5c5959ed47239a92a063a6d
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
ramnitbankerspywarestealertrojanupxworm

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

    trojanspywarestealerwormbankerramnit
  • Executes dropped EXE 2 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 30 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\522fd3443f9ccfd96efd25ca5d8a394203bd279fe5c5959ed47239a92a063a6d.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3236
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\522fd3443f9ccfd96efd25ca5d8a394203bd279fe5c5959ed47239a92a063a6d.dll
      2⤵
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:1684
      • C:\Windows\SysWOW64\regsvr32Srv.exe
        C:\Windows\SysWOW64\regsvr32Srv.exe
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:1576
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4320
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2084
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2084 CREDAT:17410 /prefetch:2
              6⤵
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:968

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        DesktopLayer.exe
        • Path C:\Program Files (x86)\Microsoft\DesktopLayer.exe
        • Size 55KB
        • SHA256 fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        DesktopLayer.exe
        • Path C:\Program Files (x86)\Microsoft\DesktopLayer.exe
        • Size 55KB
        • SHA256 fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
        • Size 471B
        • SHA256 61597f5f937da250a5ed7b4b82867bebc546a5a35c0029982a003b1e9cbd2e7e
        • MD5 SHA1 SHA512
        Submit Download

        7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
        • Size 404B
        • SHA256 dfce2963057e18f9a71552b23d1cca5e7a1a84f017059d26fea71c35b97fa32c
        • MD5 SHA1 SHA512
        Submit Download

        regsvr32Srv.exe
        • Path C:\Windows\SysWOW64\regsvr32Srv.exe
        • Size 55KB
        • SHA256 fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        regsvr32Srv.exe
        • Path C:\Windows\SysWOW64\regsvr32Srv.exe
        • Size 55KB
        • SHA256 fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/1576-138-0x0000000000400000-0x000000000042E000-memory.dmp
        Download

        memory/4320-140-0x0000000000400000-0x000000000042E000-memory.dmp
        Download