ramnit | 9ffc67b3f0b49e35357ee68dc59d074e38035c4d34476170c4610c131d4a7e22

Analysis

max time kernel
105s
max time network
146s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
21-11-2022 10:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9ffc67b3f0b49e35357ee68dc59d074e38035c4d34476170c4610c131d4a7e22.dll
Size

231KB
MD5

00d354ce7ce7e61c0288f0970f5bf2d0
SHA1

fc05475d7f0e20dbefbdf3c7637004fb66b9e63d
SHA256

9ffc67b3f0b49e35357ee68dc59d074e38035c4d34476170c4610c131d4a7e22
SHA512

7be7233bb2660bfb22460eef2ec72c59cafff6a326c6d0122fc6b2ff8b751f69d5f5b068e4dcd6d23f67d2e30ff00c078353e022e0afa38b01fcdda3ba6209d8
SSDEEP

3072:+sGwxP7Ghb+GgJ2r1fHZF8+T7+B84TZpxGAtl5a6YsbGHWSlE5t6ZoiLCmGK9cO:pBQ+aVXMB84TZhtusbA3OEIK9

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Executes dropped EXE 7 IoCs

pid	Process
1288	rundll32Srv.exe
1408	rundll32SrvSrv.exe
1336	DesktopLayer.exe
756	rundll32SrvSrvSrv.exe
676	DesktopLayerSrv.exe
1212	DesktopLayerSrvSrv.exe
1456	DesktopLayer.exe

UPX packed file 27 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0008000000005c51-56.dat	upx
behavioral1/files/0x0008000000005c51-58.dat	upx
behavioral1/files/0x000a0000000122f9-60.dat	upx
behavioral1/files/0x000a0000000122f9-63.dat	upx
behavioral1/files/0x0008000000005c51-62.dat	upx
behavioral1/files/0x0008000000012318-74.dat	upx
behavioral1/memory/1408-73-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/files/0x000900000001231c-76.dat	upx
behavioral1/files/0x000a0000000122f9-72.dat	upx
behavioral1/files/0x0009000000012313-70.dat	upx
behavioral1/files/0x0009000000012313-65.dat	upx
behavioral1/memory/1288-68-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/files/0x0008000000012318-78.dat	upx
behavioral1/memory/1336-82-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/files/0x0009000000012313-79.dat	upx
behavioral1/files/0x0008000000012318-67.dat	upx
behavioral1/files/0x0009000000012324-91.dat	upx
behavioral1/files/0x0009000000012313-89.dat	upx
behavioral1/memory/756-83-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/files/0x0009000000012324-87.dat	upx
behavioral1/files/0x000900000001231c-86.dat	upx
behavioral1/files/0x0009000000012313-94.dat	upx
behavioral1/memory/1212-92-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/676-93-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/files/0x000900000001231c-80.dat	upx
behavioral1/files/0x0009000000012324-84.dat	upx
behavioral1/memory/1456-96-0x0000000000400000-0x000000000043D000-memory.dmp	upx

Loads dropped DLL 7 IoCs

pid	Process
1304	rundll32.exe
1288	rundll32Srv.exe
1288	rundll32Srv.exe
1408	rundll32SrvSrv.exe
1336	DesktopLayer.exe
676	DesktopLayerSrv.exe
676	DesktopLayerSrv.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32Srv.exe	rundll32.exe
File created	C:\Windows\SysWOW64\rundll32SrvSrv.exe	rundll32Srv.exe
File created	C:\Windows\SysWOW64\rundll32SrvSrvSrv.exe	rundll32SrvSrv.exe

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	rundll32Srv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	rundll32Srv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	rundll32SrvSrvSrv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayerSrvSrv.exe	DesktopLayerSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px1D71.tmp	DesktopLayerSrvSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px1BCB.tmp	rundll32Srv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	rundll32SrvSrv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe	DesktopLayer.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px1C96.tmp	rundll32SrvSrvSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px1D51.tmp	DesktopLayerSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	DesktopLayerSrv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	DesktopLayerSrvSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px1C29.tmp	rundll32SrvSrv.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{57EECD11-6988-11ED-9201-42465D836E7B} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "375791966"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff5600000000000000dc04000065020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1408	rundll32SrvSrv.exe
1408	rundll32SrvSrv.exe
1408	rundll32SrvSrv.exe
1408	rundll32SrvSrv.exe
1336	DesktopLayer.exe
1336	DesktopLayer.exe
1336	DesktopLayer.exe
1336	DesktopLayer.exe
756	rundll32SrvSrvSrv.exe
756	rundll32SrvSrvSrv.exe
756	rundll32SrvSrvSrv.exe
756	rundll32SrvSrvSrv.exe
1212	DesktopLayerSrvSrv.exe
1212	DesktopLayerSrvSrv.exe
1212	DesktopLayerSrvSrv.exe
1212	DesktopLayerSrvSrv.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1932	iexplore.exe
1564	iexplore.exe
360	iexplore.exe
1512	iexplore.exe

Suspicious use of SetWindowsHookEx 18 IoCs

pid	Process
1932	iexplore.exe
1932	iexplore.exe
360	iexplore.exe
360	iexplore.exe
1512	iexplore.exe
1512	iexplore.exe
1564	iexplore.exe
1564	iexplore.exe
432	IEXPLORE.EXE
432	IEXPLORE.EXE
740	IEXPLORE.EXE
740	IEXPLORE.EXE
1388	IEXPLORE.EXE
1388	IEXPLORE.EXE
1352	IEXPLORE.EXE
1352	IEXPLORE.EXE
1352	IEXPLORE.EXE
1352	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 1304	1128	rundll32.exe	27
PID 1128 wrote to memory of 1304	1128	rundll32.exe	27
PID 1128 wrote to memory of 1304	1128	rundll32.exe	27
PID 1128 wrote to memory of 1304	1128	rundll32.exe	27
PID 1128 wrote to memory of 1304	1128	rundll32.exe	27
PID 1128 wrote to memory of 1304	1128	rundll32.exe	27
PID 1128 wrote to memory of 1304	1128	rundll32.exe	27
PID 1304 wrote to memory of 1288	1304	rundll32.exe	28
PID 1304 wrote to memory of 1288	1304	rundll32.exe	28
PID 1304 wrote to memory of 1288	1304	rundll32.exe	28
PID 1304 wrote to memory of 1288	1304	rundll32.exe	28
PID 1288 wrote to memory of 1408	1288	rundll32Srv.exe	29
PID 1288 wrote to memory of 1408	1288	rundll32Srv.exe	29
PID 1288 wrote to memory of 1408	1288	rundll32Srv.exe	29
PID 1288 wrote to memory of 1408	1288	rundll32Srv.exe	29
PID 1288 wrote to memory of 1336	1288	rundll32Srv.exe	30
PID 1288 wrote to memory of 1336	1288	rundll32Srv.exe	30
PID 1288 wrote to memory of 1336	1288	rundll32Srv.exe	30
PID 1288 wrote to memory of 1336	1288	rundll32Srv.exe	30
PID 1408 wrote to memory of 756	1408	rundll32SrvSrv.exe	35
PID 1408 wrote to memory of 756	1408	rundll32SrvSrv.exe	35
PID 1408 wrote to memory of 756	1408	rundll32SrvSrv.exe	35
PID 1408 wrote to memory of 756	1408	rundll32SrvSrv.exe	35
PID 1408 wrote to memory of 1932	1408	rundll32SrvSrv.exe	32
PID 1408 wrote to memory of 1932	1408	rundll32SrvSrv.exe	32
PID 1408 wrote to memory of 1932	1408	rundll32SrvSrv.exe	32
PID 1408 wrote to memory of 1932	1408	rundll32SrvSrv.exe	32
PID 1336 wrote to memory of 676	1336	DesktopLayer.exe	31
PID 1336 wrote to memory of 676	1336	DesktopLayer.exe	31
PID 1336 wrote to memory of 676	1336	DesktopLayer.exe	31
PID 1336 wrote to memory of 676	1336	DesktopLayer.exe	31
PID 1336 wrote to memory of 1512	1336	DesktopLayer.exe	34
PID 1336 wrote to memory of 1512	1336	DesktopLayer.exe	34
PID 1336 wrote to memory of 1512	1336	DesktopLayer.exe	34
PID 1336 wrote to memory of 1512	1336	DesktopLayer.exe	34
PID 756 wrote to memory of 1564	756	rundll32SrvSrvSrv.exe	33
PID 756 wrote to memory of 1564	756	rundll32SrvSrvSrv.exe	33
PID 756 wrote to memory of 1564	756	rundll32SrvSrvSrv.exe	33
PID 756 wrote to memory of 1564	756	rundll32SrvSrvSrv.exe	33
PID 676 wrote to memory of 1212	676	DesktopLayerSrv.exe	38
PID 676 wrote to memory of 1212	676	DesktopLayerSrv.exe	38
PID 676 wrote to memory of 1212	676	DesktopLayerSrv.exe	38
PID 676 wrote to memory of 1212	676	DesktopLayerSrv.exe	38
PID 676 wrote to memory of 1456	676	DesktopLayerSrv.exe	37
PID 676 wrote to memory of 1456	676	DesktopLayerSrv.exe	37
PID 676 wrote to memory of 1456	676	DesktopLayerSrv.exe	37
PID 676 wrote to memory of 1456	676	DesktopLayerSrv.exe	37
PID 1212 wrote to memory of 360	1212	DesktopLayerSrvSrv.exe	36
PID 1212 wrote to memory of 360	1212	DesktopLayerSrvSrv.exe	36
PID 1212 wrote to memory of 360	1212	DesktopLayerSrvSrv.exe	36
PID 1212 wrote to memory of 360	1212	DesktopLayerSrvSrv.exe	36
PID 1932 wrote to memory of 432	1932	iexplore.exe	40
PID 1932 wrote to memory of 432	1932	iexplore.exe	40
PID 1932 wrote to memory of 432	1932	iexplore.exe	40
PID 1932 wrote to memory of 432	1932	iexplore.exe	40
PID 360 wrote to memory of 1388	360	iexplore.exe	41
PID 360 wrote to memory of 1388	360	iexplore.exe	41
PID 360 wrote to memory of 1388	360	iexplore.exe	41
PID 360 wrote to memory of 1388	360	iexplore.exe	41
PID 1512 wrote to memory of 1352	1512	iexplore.exe	42
PID 1512 wrote to memory of 1352	1512	iexplore.exe	42
PID 1512 wrote to memory of 1352	1512	iexplore.exe	42
PID 1512 wrote to memory of 1352	1512	iexplore.exe	42
PID 1564 wrote to memory of 740	1564	iexplore.exe	43

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9ffc67b3f0b49e35357ee68dc59d074e38035c4d34476170c4610c131d4a7e22.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9ffc67b3f0b49e35357ee68dc59d074e38035c4d34476170c4610c131d4a7e22.dll,#1
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1304
- - C:\Windows\SysWOW64\rundll32Srv.exe
    C:\Windows\SysWOW64\rundll32Srv.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:1288
  - - C:\Windows\SysWOW64\rundll32SrvSrv.exe
      C:\Windows\SysWOW64\rundll32SrvSrv.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1408
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1932
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1932 CREDAT:275457 /prefetch:2
        6⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:432
    - - C:\Windows\SysWOW64\rundll32SrvSrvSrv.exe
        
        C:\Windows\SysWOW64\rundll32SrvSrvSrv.exe
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:756
  - - C:\Program Files (x86)\Microsoft\DesktopLayer.exe
      "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1336
    - - C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe
        
        "C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:676
      - C:\Program Files (x86)\Microsoft\DesktopLayer.exe
        
        "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
        6⤵
        Executes dropped EXE
        
        PID:1456
      - C:\Program Files (x86)\Microsoft\DesktopLayerSrvSrv.exe
        
        "C:\Program Files (x86)\Microsoft\DesktopLayerSrvSrv.exe"
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1212
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1512
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1512 CREDAT:275457 /prefetch:2
        6⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1352

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1564
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1564 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:740

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:360
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:360 CREDAT:275457 /prefetch:2
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1388

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\DesktopLayer.exe

Filesize
168KB

MD5
c64813adfc336147b0e6230f949236bd

SHA1
cd3b7088c1e071ea93952673a4c59edbfbd619cd

SHA256
38f3ffec87edfe3ff6da75cc8604651b8170581d780ee5b258bc591fe72e6c6f

SHA512
8a2cf2459f810c33caf1ad4adcc241ed4b63c865703e4ff36b198f7f994a28be8abb9fbddde939931f0daa214522ce7b56696cea088068f127827cf1a2a9a628

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe

Filesize
168KB

MD5
c64813adfc336147b0e6230f949236bd

SHA1
cd3b7088c1e071ea93952673a4c59edbfbd619cd

SHA256
38f3ffec87edfe3ff6da75cc8604651b8170581d780ee5b258bc591fe72e6c6f

SHA512
8a2cf2459f810c33caf1ad4adcc241ed4b63c865703e4ff36b198f7f994a28be8abb9fbddde939931f0daa214522ce7b56696cea088068f127827cf1a2a9a628

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe

Filesize
111KB

MD5
1e58c74d262752a2060fbd8010d75169

SHA1
9adb4d47fb327e7f7293130c424c64e27ce6da2f

SHA256
05a0c977d25de24bc7778ff6b83f81a94f555a181f48dac40fab303c69b43d98

SHA512
22185e4742b69d1167b1edfc7025014794cee91b52573245a969c1d416def993b4a284679ed54577d4db1dbb7931763abb7a3d777e7c57492f52bf970ee42090

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe

Filesize
111KB

MD5
1e58c74d262752a2060fbd8010d75169

SHA1
9adb4d47fb327e7f7293130c424c64e27ce6da2f

SHA256
05a0c977d25de24bc7778ff6b83f81a94f555a181f48dac40fab303c69b43d98

SHA512
22185e4742b69d1167b1edfc7025014794cee91b52573245a969c1d416def993b4a284679ed54577d4db1dbb7931763abb7a3d777e7c57492f52bf970ee42090

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe

Filesize
111KB

MD5
1e58c74d262752a2060fbd8010d75169

SHA1
9adb4d47fb327e7f7293130c424c64e27ce6da2f

SHA256
05a0c977d25de24bc7778ff6b83f81a94f555a181f48dac40fab303c69b43d98

SHA512
22185e4742b69d1167b1edfc7025014794cee91b52573245a969c1d416def993b4a284679ed54577d4db1dbb7931763abb7a3d777e7c57492f52bf970ee42090

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayerSrvSrv.exe

Filesize
55KB

MD5
42bacbdf56184c2fa5fe6770857e2c2d

SHA1
521a63ee9ce2f615eda692c382b16fc1b1d57cac

SHA256
d1a57e19ddb9892e423248cc8ff0c4b1211d22e1ccad6111fcac218290f246f0

SHA512
0ab916dd15278e51bccfd2ccedd80d942b0bddb9544cec3f73120780d4f7234ff7456530e1465caf3846616821d1b385b6ae58a5dff9ffe4d622902c24fd4b71

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayerSrvSrv.exe

Filesize
55KB

MD5
42bacbdf56184c2fa5fe6770857e2c2d

SHA1
521a63ee9ce2f615eda692c382b16fc1b1d57cac

SHA256
d1a57e19ddb9892e423248cc8ff0c4b1211d22e1ccad6111fcac218290f246f0

SHA512
0ab916dd15278e51bccfd2ccedd80d942b0bddb9544cec3f73120780d4f7234ff7456530e1465caf3846616821d1b385b6ae58a5dff9ffe4d622902c24fd4b71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{57EECD11-6988-11ED-9201-42465D836E7B}.dat

Filesize
3KB

MD5
a52d65683ccb2121d5656b73e4ad9452

SHA1
41ec0bee1d7ade4732908c2462f31c74a033728e

SHA256
3280ee0a88644f33f682b5567bccfb966e831e8b70fa178e33d8be2e58cad0ef

SHA512
5ffca52d39a97f24ffb662ac99139a5995970fce9e90997158e16ed8afa78b05dc9491dd65e8bc54314dc02ba0acaca25020c358ac7eeca51dd4077550c2e6ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{581010B1-6988-11ED-9201-42465D836E7B}.dat

Filesize
3KB

MD5
54676960f62c36771a75d360cecc6973

SHA1
fc101be22681f2b754309a9234064064209efaf9

SHA256
e32ca4200906e5fff3f143f9ace39e37ac7d5bc7a79041c9b600dc5946b8408a

SHA512
1eb8e7b84d46936b30379b32551d8d06d055efab4d931d3f898151ee7beba36a02f3587b5ea8d6d97099b2f11156e268ab76d2d77a85af6c296b3a7e0e60ef5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{581010B1-6988-11ED-9201-42465D836E7B}.dat

Filesize
5KB

MD5
f8f9e08d138a43d6a55dc233290b1b0d

SHA1
d21766cbe9fd8393aa12bbb13bbb420a64cccc74

SHA256
34b2b3850de2890c91b56f1c26c3a7aa0871e726cbf2f430a70247cab81c1512

SHA512
6906f94eecbe72a6dacf3198841c0cf9d5411251ecb022302fc6be2934c1428d9d2d617cda08d985d1a38863b846e023006a7731868f00ef7d1b315c51f00d68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{582127B1-6988-11ED-9201-42465D836E7B}.dat

Filesize
5KB

MD5
2fa19ef55f33cbab742ca4a4f2df19d5

SHA1
0b2fa1da63a4a8d16afb47e8ec0a9393a0cf35de

SHA256
f7437365e990cc146ac4e111de4884005013cd066a83f9aec922d75991598ede

SHA512
2f5613fc0452a36dce971e8c15f699c1fa5238d02894a475e7a1fb952db4df515fb7be4c92a9533bcd24b8b95e0f871779693a5eeb14e3cd2c2f6d8b5316fe17

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\5BLIAZFD.txt

Filesize
608B

MD5
8862fe316658db07a69ab77264c6e288

SHA1
9b2359e917aab99a7364b1bd572b1c5f6dbd397c

SHA256
988c12708cc2ac0ae95bfad1245002331f73e5cbf03009a4c23394dca557c078

SHA512
d9766287476b73798f98d0d828589597bf36fe3ad690c7958afd22f000e75ebea928dfa87abd79dfa15e32d46e0b6e6cb34fda15e7420870d173c00a027f39d8

Download Submit
C:\Windows\SysWOW64\rundll32Srv.exe

Filesize
168KB

MD5
c64813adfc336147b0e6230f949236bd

SHA1
cd3b7088c1e071ea93952673a4c59edbfbd619cd

SHA256
38f3ffec87edfe3ff6da75cc8604651b8170581d780ee5b258bc591fe72e6c6f

SHA512
8a2cf2459f810c33caf1ad4adcc241ed4b63c865703e4ff36b198f7f994a28be8abb9fbddde939931f0daa214522ce7b56696cea088068f127827cf1a2a9a628

Download Submit
C:\Windows\SysWOW64\rundll32Srv.exe

Filesize
168KB

MD5
c64813adfc336147b0e6230f949236bd

SHA1
cd3b7088c1e071ea93952673a4c59edbfbd619cd

SHA256
38f3ffec87edfe3ff6da75cc8604651b8170581d780ee5b258bc591fe72e6c6f

SHA512
8a2cf2459f810c33caf1ad4adcc241ed4b63c865703e4ff36b198f7f994a28be8abb9fbddde939931f0daa214522ce7b56696cea088068f127827cf1a2a9a628

Download Submit
C:\Windows\SysWOW64\rundll32SrvSrv.exe

Filesize
111KB

MD5
1e58c74d262752a2060fbd8010d75169

SHA1
9adb4d47fb327e7f7293130c424c64e27ce6da2f

SHA256
05a0c977d25de24bc7778ff6b83f81a94f555a181f48dac40fab303c69b43d98

SHA512
22185e4742b69d1167b1edfc7025014794cee91b52573245a969c1d416def993b4a284679ed54577d4db1dbb7931763abb7a3d777e7c57492f52bf970ee42090

Download Submit
C:\Windows\SysWOW64\rundll32SrvSrv.exe

Filesize
111KB

MD5
1e58c74d262752a2060fbd8010d75169

SHA1
9adb4d47fb327e7f7293130c424c64e27ce6da2f

SHA256
05a0c977d25de24bc7778ff6b83f81a94f555a181f48dac40fab303c69b43d98

SHA512
22185e4742b69d1167b1edfc7025014794cee91b52573245a969c1d416def993b4a284679ed54577d4db1dbb7931763abb7a3d777e7c57492f52bf970ee42090

Download Submit
C:\Windows\SysWOW64\rundll32SrvSrvSrv.exe

Filesize
55KB

MD5
42bacbdf56184c2fa5fe6770857e2c2d

SHA1
521a63ee9ce2f615eda692c382b16fc1b1d57cac

SHA256
d1a57e19ddb9892e423248cc8ff0c4b1211d22e1ccad6111fcac218290f246f0

SHA512
0ab916dd15278e51bccfd2ccedd80d942b0bddb9544cec3f73120780d4f7234ff7456530e1465caf3846616821d1b385b6ae58a5dff9ffe4d622902c24fd4b71

Download Submit
C:\Windows\SysWOW64\rundll32SrvSrvSrv.exe

Filesize
55KB

MD5
42bacbdf56184c2fa5fe6770857e2c2d

SHA1
521a63ee9ce2f615eda692c382b16fc1b1d57cac

SHA256
d1a57e19ddb9892e423248cc8ff0c4b1211d22e1ccad6111fcac218290f246f0

SHA512
0ab916dd15278e51bccfd2ccedd80d942b0bddb9544cec3f73120780d4f7234ff7456530e1465caf3846616821d1b385b6ae58a5dff9ffe4d622902c24fd4b71

Download Submit
\Program Files (x86)\Microsoft\DesktopLayer.exe

Filesize
168KB

MD5
c64813adfc336147b0e6230f949236bd

SHA1
cd3b7088c1e071ea93952673a4c59edbfbd619cd

SHA256
38f3ffec87edfe3ff6da75cc8604651b8170581d780ee5b258bc591fe72e6c6f

SHA512
8a2cf2459f810c33caf1ad4adcc241ed4b63c865703e4ff36b198f7f994a28be8abb9fbddde939931f0daa214522ce7b56696cea088068f127827cf1a2a9a628

Download Submit
\Program Files (x86)\Microsoft\DesktopLayer.exe

Filesize
111KB

MD5
1e58c74d262752a2060fbd8010d75169

SHA1
9adb4d47fb327e7f7293130c424c64e27ce6da2f

SHA256
05a0c977d25de24bc7778ff6b83f81a94f555a181f48dac40fab303c69b43d98

SHA512
22185e4742b69d1167b1edfc7025014794cee91b52573245a969c1d416def993b4a284679ed54577d4db1dbb7931763abb7a3d777e7c57492f52bf970ee42090

Download Submit
\Program Files (x86)\Microsoft\DesktopLayerSrv.exe

Filesize
111KB

MD5
1e58c74d262752a2060fbd8010d75169

SHA1
9adb4d47fb327e7f7293130c424c64e27ce6da2f

SHA256
05a0c977d25de24bc7778ff6b83f81a94f555a181f48dac40fab303c69b43d98

SHA512
22185e4742b69d1167b1edfc7025014794cee91b52573245a969c1d416def993b4a284679ed54577d4db1dbb7931763abb7a3d777e7c57492f52bf970ee42090

Download Submit
\Program Files (x86)\Microsoft\DesktopLayerSrvSrv.exe

Filesize
55KB

MD5
42bacbdf56184c2fa5fe6770857e2c2d

SHA1
521a63ee9ce2f615eda692c382b16fc1b1d57cac

SHA256
d1a57e19ddb9892e423248cc8ff0c4b1211d22e1ccad6111fcac218290f246f0

SHA512
0ab916dd15278e51bccfd2ccedd80d942b0bddb9544cec3f73120780d4f7234ff7456530e1465caf3846616821d1b385b6ae58a5dff9ffe4d622902c24fd4b71

Download Submit
\Windows\SysWOW64\rundll32Srv.exe

Filesize
168KB

MD5
c64813adfc336147b0e6230f949236bd

SHA1
cd3b7088c1e071ea93952673a4c59edbfbd619cd

SHA256
38f3ffec87edfe3ff6da75cc8604651b8170581d780ee5b258bc591fe72e6c6f

SHA512
8a2cf2459f810c33caf1ad4adcc241ed4b63c865703e4ff36b198f7f994a28be8abb9fbddde939931f0daa214522ce7b56696cea088068f127827cf1a2a9a628

Download Submit
\Windows\SysWOW64\rundll32SrvSrv.exe

Filesize
111KB

MD5
1e58c74d262752a2060fbd8010d75169

SHA1
9adb4d47fb327e7f7293130c424c64e27ce6da2f

SHA256
05a0c977d25de24bc7778ff6b83f81a94f555a181f48dac40fab303c69b43d98

SHA512
22185e4742b69d1167b1edfc7025014794cee91b52573245a969c1d416def993b4a284679ed54577d4db1dbb7931763abb7a3d777e7c57492f52bf970ee42090

Download Submit
\Windows\SysWOW64\rundll32SrvSrvSrv.exe

Filesize
55KB

MD5
42bacbdf56184c2fa5fe6770857e2c2d

SHA1
521a63ee9ce2f615eda692c382b16fc1b1d57cac

SHA256
d1a57e19ddb9892e423248cc8ff0c4b1211d22e1ccad6111fcac218290f246f0

SHA512
0ab916dd15278e51bccfd2ccedd80d942b0bddb9544cec3f73120780d4f7234ff7456530e1465caf3846616821d1b385b6ae58a5dff9ffe4d622902c24fd4b71

Download Submit
memory/676-77-0x0000000000000000-mapping.dmp

Download
memory/676-93-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/756-69-0x0000000000000000-mapping.dmp

Download
memory/756-83-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1212-85-0x0000000000000000-mapping.dmp

Download
memory/1212-92-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1288-68-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1288-57-0x0000000000000000-mapping.dmp

Download
memory/1304-54-0x0000000000000000-mapping.dmp

Download
memory/1304-55-0x00000000762E1000-0x00000000762E3000-memory.dmp

Filesize
8KB

Download
memory/1336-82-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1336-66-0x0000000000000000-mapping.dmp

Download
memory/1408-73-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1408-61-0x0000000000000000-mapping.dmp

Download
memory/1456-90-0x0000000000000000-mapping.dmp

Download
memory/1456-96-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download