Analysis
-
max time kernel
597s -
max time network
603s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
27-10-2022 05:32
Static task
static1
Behavioral task
behavioral1
Sample
4708bac148c1354efa086007eb4c5652851ad63f4490cb659b999957984925e9.exe
Resource
win7-20220812-en
General
-
Target
4708bac148c1354efa086007eb4c5652851ad63f4490cb659b999957984925e9.exe
-
Size
292KB
-
MD5
0bb8cd8c15d83ecf1691797cec23e5f0
-
SHA1
3166b77481b08d270bd8cb1c432bd67398f8a1e2
-
SHA256
4708bac148c1354efa086007eb4c5652851ad63f4490cb659b999957984925e9
-
SHA512
d7651e3d585e3c4766682576b7ee89c81a29f9e0adaa1aa97af9b1a7e778b629812d84a8ce2793f4d8622d1f728dcf505e65c55e63f514f9e395ff695f483e0b
-
SSDEEP
6144:RyBK8GMRovbL43fPf6jXdmFDYoCCcUrHX4OKCwEo6v:UDTovP43nfemFWUrHX4OXwd6v
Malware Config
Extracted
ramnit
��1
malesaqua.eu:442
-
campaign_timestamp
1.506273416e+09
-
compile_timestamp
1.505999145e+09
-
dga_seed
4.13789472e+09
-
listen_port
0
-
num_dga_domains
100
Signatures
-
Deletes itself 1 IoCs
Processes:
wmplayer.exepid process 568 wmplayer.exe -
Loads dropped DLL 1 IoCs
Processes:
wmplayer.exepid process 568 wmplayer.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
WScript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run WScript.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\bdhpwbmd = "C:\\Users\\Admin\\AppData\\Roaming\\bdhpwbmd\\qpgrfyko.vbs" WScript.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
4708bac148c1354efa086007eb4c5652851ad63f4490cb659b999957984925e9.exedescription pid process target process PID 1944 set thread context of 568 1944 4708bac148c1354efa086007eb4c5652851ad63f4490cb659b999957984925e9.exe wmplayer.exe PID 1944 set thread context of 568 1944 4708bac148c1354efa086007eb4c5652851ad63f4490cb659b999957984925e9.exe wmplayer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
wmplayer.exepid process 568 wmplayer.exe 568 wmplayer.exe 568 wmplayer.exe 568 wmplayer.exe 568 wmplayer.exe 568 wmplayer.exe 568 wmplayer.exe 568 wmplayer.exe 568 wmplayer.exe 568 wmplayer.exe 568 wmplayer.exe 568 wmplayer.exe 568 wmplayer.exe 568 wmplayer.exe 568 wmplayer.exe 568 wmplayer.exe 568 wmplayer.exe 568 wmplayer.exe 568 wmplayer.exe 568 wmplayer.exe 568 wmplayer.exe 568 wmplayer.exe 568 wmplayer.exe 568 wmplayer.exe 568 wmplayer.exe 568 wmplayer.exe 568 wmplayer.exe 568 wmplayer.exe 568 wmplayer.exe 568 wmplayer.exe 568 wmplayer.exe 568 wmplayer.exe 568 wmplayer.exe 568 wmplayer.exe 568 wmplayer.exe 568 wmplayer.exe 568 wmplayer.exe 568 wmplayer.exe 568 wmplayer.exe 568 wmplayer.exe 568 wmplayer.exe 568 wmplayer.exe 568 wmplayer.exe 568 wmplayer.exe 568 wmplayer.exe 568 wmplayer.exe 568 wmplayer.exe 568 wmplayer.exe 568 wmplayer.exe 568 wmplayer.exe 568 wmplayer.exe 568 wmplayer.exe 568 wmplayer.exe 568 wmplayer.exe 568 wmplayer.exe 568 wmplayer.exe 568 wmplayer.exe 568 wmplayer.exe 568 wmplayer.exe 568 wmplayer.exe 568 wmplayer.exe 568 wmplayer.exe 568 wmplayer.exe 568 wmplayer.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
4708bac148c1354efa086007eb4c5652851ad63f4490cb659b999957984925e9.exepid process 1944 4708bac148c1354efa086007eb4c5652851ad63f4490cb659b999957984925e9.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
4708bac148c1354efa086007eb4c5652851ad63f4490cb659b999957984925e9.exewmplayer.exedescription pid process Token: SeDebugPrivilege 1944 4708bac148c1354efa086007eb4c5652851ad63f4490cb659b999957984925e9.exe Token: SeSecurityPrivilege 568 wmplayer.exe Token: SeDebugPrivilege 568 wmplayer.exe Token: SeRestorePrivilege 568 wmplayer.exe Token: SeBackupPrivilege 568 wmplayer.exe Token: SeDebugPrivilege 568 wmplayer.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
4708bac148c1354efa086007eb4c5652851ad63f4490cb659b999957984925e9.exewmplayer.exedescription pid process target process PID 1944 wrote to memory of 568 1944 4708bac148c1354efa086007eb4c5652851ad63f4490cb659b999957984925e9.exe wmplayer.exe PID 1944 wrote to memory of 568 1944 4708bac148c1354efa086007eb4c5652851ad63f4490cb659b999957984925e9.exe wmplayer.exe PID 1944 wrote to memory of 568 1944 4708bac148c1354efa086007eb4c5652851ad63f4490cb659b999957984925e9.exe wmplayer.exe PID 1944 wrote to memory of 568 1944 4708bac148c1354efa086007eb4c5652851ad63f4490cb659b999957984925e9.exe wmplayer.exe PID 1944 wrote to memory of 568 1944 4708bac148c1354efa086007eb4c5652851ad63f4490cb659b999957984925e9.exe wmplayer.exe PID 1944 wrote to memory of 568 1944 4708bac148c1354efa086007eb4c5652851ad63f4490cb659b999957984925e9.exe wmplayer.exe PID 1944 wrote to memory of 568 1944 4708bac148c1354efa086007eb4c5652851ad63f4490cb659b999957984925e9.exe wmplayer.exe PID 1944 wrote to memory of 568 1944 4708bac148c1354efa086007eb4c5652851ad63f4490cb659b999957984925e9.exe wmplayer.exe PID 568 wrote to memory of 268 568 wmplayer.exe WScript.exe PID 568 wrote to memory of 268 568 wmplayer.exe WScript.exe PID 568 wrote to memory of 268 568 wmplayer.exe WScript.exe PID 568 wrote to memory of 268 568 wmplayer.exe WScript.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4708bac148c1354efa086007eb4c5652851ad63f4490cb659b999957984925e9.exe"C:\Users\Admin\AppData\Local\Temp\4708bac148c1354efa086007eb4c5652851ad63f4490cb659b999957984925e9.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe"2⤵
- Deletes itself
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:568 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\bdhpwbmd\xvnhatyg.vbs"3⤵
- Adds Run key to start application
PID:268
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\bdhpwbmd\xvnhatyg.vbsFilesize
193B
MD516fb2a0022cdefa8194227d5570db0c0
SHA13637130f1847ec62074b946f8a754ca56890f2c8
SHA256b8a6298e3419a0379d37a5dc9f7b1284e5fd6f661d4deb81ca59a766f182493a
SHA512a1b5d9d4598b29252eccdc87f897fa058fe298724d4c7c94b655211f25f92e6ba28a5199451e45ea9bf450566b5325d3457626b4db942a3e6323201b98d87cce
-
\Users\Admin\AppData\Local\Temp\~TM9252.tmpFilesize
1.1MB
MD59b98d47916ead4f69ef51b56b0c2323c
SHA1290a80b4ded0efc0fd00816f373fcea81a521330
SHA25696e0ae104c9662d0d20fdf59844c2d18334e5847b6c4fc7f8ce4b3b87f39887b
SHA51268b67021f228d8d71df4deb0b6388558b2f935a6aa466a12199cd37ada47ee588ea407b278d190d3a498b0ef3f5f1a2573a469b7ea5561ab2e7055c45565fe94
-
memory/268-61-0x0000000000000000-mapping.dmp
-
memory/568-55-0x000000000044176D-mapping.dmp
-
memory/568-56-0x00000000000E0000-0x00000000000E0318-memory.dmpFilesize
792B
-
memory/568-57-0x0000000075CF1000-0x0000000075CF3000-memory.dmpFilesize
8KB
-
memory/568-60-0x0000000000220000-0x0000000000261000-memory.dmpFilesize
260KB
-
memory/1944-54-0x0000000000400000-0x0000000000449000-memory.dmpFilesize
292KB
-
memory/1944-58-0x0000000000400000-0x0000000000449000-memory.dmpFilesize
292KB