Analysis

  • max time kernel
    600s
  • max time network
    603s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-10-2022 05:32

General

  • Target

    4708bac148c1354efa086007eb4c5652851ad63f4490cb659b999957984925e9.exe

  • Size

    292KB

  • MD5

    0bb8cd8c15d83ecf1691797cec23e5f0

  • SHA1

    3166b77481b08d270bd8cb1c432bd67398f8a1e2

  • SHA256

    4708bac148c1354efa086007eb4c5652851ad63f4490cb659b999957984925e9

  • SHA512

    d7651e3d585e3c4766682576b7ee89c81a29f9e0adaa1aa97af9b1a7e778b629812d84a8ce2793f4d8622d1f728dcf505e65c55e63f514f9e395ff695f483e0b

  • SSDEEP

    6144:RyBK8GMRovbL43fPf6jXdmFDYoCCcUrHX4OKCwEo6v:UDTovP43nfemFWUrHX4OXwd6v

Malware Config

Extracted

Family

ramnit

Botnet

28

C2

malesaqua.eu:442

Attributes
  • campaign_timestamp

    1.506273416e+09

  • compile_timestamp

    1.505999145e+09

  • dga_seed

    4.13789472e+09

  • listen_port

    0

  • num_dga_domains

    100

xor.base64
rc4.plain
rsa_pubkey.base64

Extracted

Family

ramnit

Botnet

��1

C2

malesaqua.eu:442

Attributes
  • campaign_timestamp

    1.506273416e+09

  • compile_timestamp

    1.505999145e+09

  • dga_seed

    4.13789472e+09

  • listen_port

    0

  • num_dga_domains

    100

xor.base64
rc4.plain
rsa_pubkey.base64

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4708bac148c1354efa086007eb4c5652851ad63f4490cb659b999957984925e9.exe
    "C:\Users\Admin\AppData\Local\Temp\4708bac148c1354efa086007eb4c5652851ad63f4490cb659b999957984925e9.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3080
    • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
      "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
      2⤵
      • Loads dropped DLL
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3300
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\qohmjlgr\nhnhpbsu.vbs"
        3⤵
        • Adds Run key to start application
        PID:4392

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\~TM2B17.tmp
    Filesize

    625KB

    MD5

    eccf28d7e5ccec24119b88edd160f8f4

    SHA1

    98509587a3d37a20b56b50fd57f823a1691a034c

    SHA256

    820c83c0533cfce2928e29edeaf6c255bc19ac9718b25a5656d99ffac30a03d6

    SHA512

    c1c94bbb781625b2317f0a8178d3a10d891fb71bca8f82cd831c484e8ab125301b82a14fe2ff070dc99a496cc00234300fa5536401018c40d49d44ae89409670

  • C:\Users\Admin\AppData\Roaming\qohmjlgr\nhnhpbsu.vbs
    Filesize

    193B

    MD5

    4ccb92ac4c5f6063ade6a9808efd01fb

    SHA1

    2c7ee1d8f13e8886cdc5676e74c244df3294005e

    SHA256

    efb0241e07e165b7627c4d3832fc761fd941bcb871d689bdbd9b3db0eb28266d

    SHA512

    8f89d8663c8293e1805e59e28f950152decfb773d5f9a1a2db54232f45339e2f26795f112deec2a2ace72a1818a6e85a5154db6146724bf4a4c67028e4f83b65

  • memory/3080-132-0x0000000000400000-0x0000000000449000-memory.dmp
    Filesize

    292KB

  • memory/3080-136-0x0000000000400000-0x0000000000449000-memory.dmp
    Filesize

    292KB

  • memory/3300-133-0x0000000000000000-mapping.dmp
  • memory/3300-134-0x00000000013A0000-0x00000000013A0318-memory.dmp
    Filesize

    792B

  • memory/3300-135-0x0000000002EB0000-0x0000000002EF1000-memory.dmp
    Filesize

    260KB

  • memory/3300-138-0x0000000002EB0000-0x0000000002EF1000-memory.dmp
    Filesize

    260KB

  • memory/4392-139-0x0000000000000000-mapping.dmp