ramnit | 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca

General

Target

71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
Size

816KB
MD5

595bcf0e9eda86a1625dcd4bc61d3257
SHA1

f9aef65ee80a7837d7db6794c8285f99107e62fe
SHA256

71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca
SHA512

d9db455af3e4baf9d6c1760636fda674ccdedd14f2b014d66ff79bd5513db2f94f934f13ecb2563907bb187f02d3fe4a56be66c4c836209e7e6347a2bca9b889
SSDEEP

12288:Rs0AhHtn1bvzSP6iTn1UserksHkU5KrVclb6ajydnlJj/IiLmqU2zYHp7D0xBm:RsdhHLvmP6+19egRG10nlJjp/U20x+s

Score

10^/10

ramnit banker evasion spyware stealer trojan upx worm

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe:*:enabled:@shell32.dll,-1"	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

ACProtect 1.3x - 1.4x DLL software 3 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\ibi1165.tmp	acprotect
C:\Users\Admin\AppData\Local\Temp\ibi1165.tmp	acprotect
C:\Users\Admin\AppData\Local\Temp\ibi1165.tmp	acprotect

Executes dropped EXE 2 IoCs

Processes:

71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8caSrv.exesvchost.exe

pid process

4624 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8caSrv.exe
2288 svchost.exe

pid	process
4624	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8caSrv.exe
2288	svchost.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8caSrv.exe	upx
C:\Users\Admin\AppData\Local\Temp\71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8caSrv.exe	upx
behavioral2/memory/4624-139-0x0000000000400000-0x000000000042E000-memory.dmp	upx

Loads dropped DLL 3 IoCs

Processes:

71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exeWerFault.exe

pid	process
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
940	WerFault.exe

Drops file in Program Files directory 9 IoCs

Processes:

71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8caSrv.exe71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exesvchost.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8caSrv.exe
File opened for modification	C:\PROGRAM FILES\DBPROTECTSUPPORT\SVCHOST.EXE	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
File opened for modification	C:\Program Files\DbProtectSupport\svchost.exe	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
File created	C:\Program Files\DbProtectSupport\fake.cfg	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px13E6.tmp	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8caSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8caSrv.exe
File created	C:\Program Files\DbProtectSupport\svchost.exe.bak	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
File created	C:\Program Files\DbProtectSupport\svchost.exe	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
File opened for modification	C:\Program Files\DbProtectSupport\fake.cfg	svchost.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

940 4624 WerFault.exe 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8caSrv.exe

pid	pid_target	process	target process
940	4624	WerFault.exe	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8caSrv.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exesvchost.exe

pid	process
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
2288	svchost.exe
2288	svchost.exe

Suspicious behavior: MapViewOfSection 64 IoCs

Processes:

71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe

pid	process
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exesvchost.exe

description	pid	process
Token: SeDebugPrivilege	1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
Token: SeDebugPrivilege	2288	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe

pid process

1640 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe

description	pid	process	target process
PID 1640 wrote to memory of 4624	1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8caSrv.exe
PID 1640 wrote to memory of 4624	1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8caSrv.exe
PID 1640 wrote to memory of 4624	1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8caSrv.exe
PID 1640 wrote to memory of 600	1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe	winlogon.exe
PID 1640 wrote to memory of 600	1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe	winlogon.exe
PID 1640 wrote to memory of 600	1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe	winlogon.exe
PID 1640 wrote to memory of 600	1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe	winlogon.exe
PID 1640 wrote to memory of 600	1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe	winlogon.exe
PID 1640 wrote to memory of 600	1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe	winlogon.exe
PID 1640 wrote to memory of 660	1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe	lsass.exe
PID 1640 wrote to memory of 660	1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe	lsass.exe
PID 1640 wrote to memory of 660	1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe	lsass.exe
PID 1640 wrote to memory of 660	1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe	lsass.exe
PID 1640 wrote to memory of 660	1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe	lsass.exe
PID 1640 wrote to memory of 660	1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe	lsass.exe
PID 1640 wrote to memory of 768	1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe	fontdrvhost.exe
PID 1640 wrote to memory of 768	1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe	fontdrvhost.exe
PID 1640 wrote to memory of 768	1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe	fontdrvhost.exe
PID 1640 wrote to memory of 768	1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe	fontdrvhost.exe
PID 1640 wrote to memory of 768	1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe	fontdrvhost.exe
PID 1640 wrote to memory of 768	1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe	fontdrvhost.exe
PID 1640 wrote to memory of 776	1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe	fontdrvhost.exe
PID 1640 wrote to memory of 776	1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe	fontdrvhost.exe
PID 1640 wrote to memory of 776	1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe	fontdrvhost.exe
PID 1640 wrote to memory of 776	1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe	fontdrvhost.exe
PID 1640 wrote to memory of 776	1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe	fontdrvhost.exe
PID 1640 wrote to memory of 776	1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe	fontdrvhost.exe
PID 1640 wrote to memory of 784	1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe	svchost.exe
PID 1640 wrote to memory of 784	1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe	svchost.exe
PID 1640 wrote to memory of 784	1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe	svchost.exe
PID 1640 wrote to memory of 784	1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe	svchost.exe
PID 1640 wrote to memory of 784	1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe	svchost.exe
PID 1640 wrote to memory of 784	1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe	svchost.exe
PID 1640 wrote to memory of 884	1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe	svchost.exe
PID 1640 wrote to memory of 884	1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe	svchost.exe
PID 1640 wrote to memory of 884	1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe	svchost.exe
PID 1640 wrote to memory of 884	1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe	svchost.exe
PID 1640 wrote to memory of 884	1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe	svchost.exe
PID 1640 wrote to memory of 884	1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe	svchost.exe
PID 1640 wrote to memory of 944	1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe	svchost.exe
PID 1640 wrote to memory of 944	1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe	svchost.exe
PID 1640 wrote to memory of 944	1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe	svchost.exe
PID 1640 wrote to memory of 944	1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe	svchost.exe
PID 1640 wrote to memory of 944	1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe	svchost.exe
PID 1640 wrote to memory of 944	1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe	svchost.exe
PID 1640 wrote to memory of 1020	1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe	dwm.exe
PID 1640 wrote to memory of 1020	1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe	dwm.exe
PID 1640 wrote to memory of 1020	1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe	dwm.exe
PID 1640 wrote to memory of 1020	1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe	dwm.exe
PID 1640 wrote to memory of 1020	1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe	dwm.exe
PID 1640 wrote to memory of 1020	1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe	dwm.exe
PID 1640 wrote to memory of 440	1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe	svchost.exe
PID 1640 wrote to memory of 440	1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe	svchost.exe
PID 1640 wrote to memory of 440	1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe	svchost.exe
PID 1640 wrote to memory of 440	1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe	svchost.exe
PID 1640 wrote to memory of 440	1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe	svchost.exe
PID 1640 wrote to memory of 440	1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe	svchost.exe
PID 1640 wrote to memory of 740	1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe	svchost.exe
PID 1640 wrote to memory of 740	1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe	svchost.exe
PID 1640 wrote to memory of 740	1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe	svchost.exe
PID 1640 wrote to memory of 740	1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe	svchost.exe
PID 1640 wrote to memory of 740	1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe	svchost.exe
PID 1640 wrote to memory of 740	1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe	svchost.exe
PID 1640 wrote to memory of 432	1640	71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe	svchost.exe

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:660

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:600

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
2⤵
PID:768

C:\Windows\system32\dwm.exe
"dwm.exe"
2⤵
PID:1020

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:944

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:784

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
2⤵
PID:3452

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
2⤵
PID:3384

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
2⤵
PID:3276

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
2⤵
PID:3460

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
2⤵
PID:4276

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
2⤵
PID:2028

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
2⤵
PID:2388

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
2⤵
PID:4568

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
2⤵
PID:4000

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
2⤵
PID:3712

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
2⤵
PID:3548

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
2⤵
PID:1076

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:440

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1060

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
2⤵
PID:2896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1036

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1172

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2108

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2052

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1096

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1976

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1968

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2328

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2700

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2584

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2564

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2320

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2152

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1844

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1700

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1688

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3076

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2920

C:\Users\Admin\AppData\Local\Temp\71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
"C:\Users\Admin\AppData\Local\Temp\71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe"
2⤵
- Modifies firewall policy service
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1640

C:\Users\Admin\AppData\Local\Temp\71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8caSrv.exe
C:\Users\Admin\AppData\Local\Temp\71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8caSrv.exe
3⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 344
4⤵
- Loads dropped DLL
- Program crash
PID:940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:3400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:4464

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:3900

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:3004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:820

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:3632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4172

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1456

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1380

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1340

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1248

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1220

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:4860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4624 -ip 4624
2⤵
PID:1448

C:\Program Files\DbProtectSupport\svchost.exe
"C:\Program Files\DbProtectSupport\svchost.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2288

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\DbProtectSupport\svchost.exe

Filesize
308KB

MD5
0ab57be5391170a54c98f62c10499562

SHA1
5b0846fad95c2493b19dbbf2547acc32ad6bef6d

SHA256
7bfdfa21c842d4e4db872438e5d2e176aa14096d58b62df0188aca09ffb283bc

SHA512
53157cb57acbe3239821e2fa21c7eee76a49598a060de629518ce80c36507d1c7a2fc99fd9e831c8d33d69eee3a51ebed17d791844eaad3efcb27a8e2d366590

Download Submit
C:\Program Files\DbProtectSupport\svchost.exe

Filesize
308KB

MD5
0ab57be5391170a54c98f62c10499562

SHA1
5b0846fad95c2493b19dbbf2547acc32ad6bef6d

SHA256
7bfdfa21c842d4e4db872438e5d2e176aa14096d58b62df0188aca09ffb283bc

SHA512
53157cb57acbe3239821e2fa21c7eee76a49598a060de629518ce80c36507d1c7a2fc99fd9e831c8d33d69eee3a51ebed17d791844eaad3efcb27a8e2d366590

Download Submit
C:\Users\Admin\AppData\Local\Temp\71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8caSrv.exe

Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8caSrv.exe

Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\ibi1165.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\ibi1165.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\ibi1165.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
memory/940-150-0x000000007EEE0000-0x000000007EEEC000-memory.dmp

Filesize
48KB

Download
memory/940-153-0x000000007EEE0000-0x000000007EEEC000-memory.dmp

Filesize
48KB

Download
memory/1640-148-0x0000000000920000-0x0000000000993000-memory.dmp

Filesize
460KB

Download
memory/1640-132-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1640-138-0x0000000000920000-0x0000000000993000-memory.dmp

Filesize
460KB

Download
memory/1640-146-0x000000007FE30000-0x000000007FE3C000-memory.dmp

Filesize
48KB

Download
memory/1640-147-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1640-149-0x000000007FE30000-0x000000007FE3C000-memory.dmp

Filesize
48KB

Download
memory/2288-145-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4624-135-0x0000000000000000-mapping.dmp

Download
memory/4624-139-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4624-141-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/4624-151-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/4624-152-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/4624-140-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads