Analysis
-
max time kernel
165s -
max time network
205s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
23-11-2022 21:13
General
-
Target
f0b8318420898e666080e267f27b6b423a979f9694a9bfc7089a272efe11f82c.exe
-
Size
104KB
-
MD5
444b59456cd83c02ccbf5eb551b73180
-
SHA1
9af3be7640c0156ac71bbbbcb74003af6b5a33ca
-
SHA256
f0b8318420898e666080e267f27b6b423a979f9694a9bfc7089a272efe11f82c
-
SHA512
c7057e71a50c23bb8de680930e679d33902618fd0e3a2b33fafef58057f4732edec31fca28a197efab949b01c2a02b207c3705cb7b4ca81c1b39430b9b9220ce
-
SSDEEP
3072:BaQo03tPdZeVXq8xNR6tgR07WtU/Wbf8m:90BXR0SUS8m
Malware Config
Signatures
-
Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Loads dropped DLL 1 IoCs
-
Program crash 1 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f0b8318420898e666080e267f27b6b423a979f9694a9bfc7089a272efe11f82c.exe"C:\Users\Admin\AppData\Local\Temp\f0b8318420898e666080e267f27b6b423a979f9694a9bfc7089a272efe11f82c.exe"1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 212 -s 5082⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 212 -ip 2121⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD54f3387277ccbd6d1f21ac5c07fe4ca68
SHA1e16506f662dc92023bf82def1d621497c8ab5890
SHA256767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
SHA5129da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
-
Filesize
180KB
-
Filesize
148KB
-
Filesize
148KB
-
Filesize
180KB
-
Filesize
180KB
-
Filesize
180KB
-
Filesize
1.6MB
-
Filesize
148KB