Analysis

  • max time kernel
    130s
  • max time network
    192s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    27-11-2022 19:40

General

  • Target

    389f063995cc9bb52d421746c6cf55586917efdd361309064894c512b82d8a04.dll

  • Size

    444KB

  • MD5

    ce4526b5e0560ed85355d5eef9e2a9b6

  • SHA1

    c749bf4a91483b174c3597723f6f45b04f16433c

  • SHA256

    389f063995cc9bb52d421746c6cf55586917efdd361309064894c512b82d8a04

  • SHA512

    594851da40de36daf54ad828907b59692a339e09fc20a132331f6202d9f36c7998171068b2585fb8ceba0a57dad649ebcf8959debdfc8afaccd3ae4fe71938af

  • SSDEEP

    12288:/ehnaNPpSVZmNxRCwnwm3W3OHIIf5lOkSDZy:/eh0PpS6NxNnwYeOHXH+DZy

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 12 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 4 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 27 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\389f063995cc9bb52d421746c6cf55586917efdd361309064894c512b82d8a04.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:908
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\389f063995cc9bb52d421746c6cf55586917efdd361309064894c512b82d8a04.dll,#1
      2⤵
      • Loads dropped DLL
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:308
      • C:\Windows\SysWOW64\rundll32Srv.exe
        C:\Windows\SysWOW64\rundll32Srv.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:1216
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1716
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1864
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1864 CREDAT:275457 /prefetch:2
              6⤵
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:1976

Network

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

1
T1112

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
    Filesize

    61KB

    MD5

    1e28b93df4dc13ba183d7cac665bc45e

    SHA1

    9f91ec079b5033516398e65970431602ba51647c

    SHA256

    e6db1aa577d981ff37dffc63cf7496a94db52e27c035f59983236cf1117becaf

    SHA512

    f133fd3ce7ddc48f090f3f94c98ea8b3b6ad017fc774c43d691176fe3f18a499de890be3aaaadd36299df41ea0f705a7375a6772409efccd11991bc49e4d7331

  • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
    Filesize

    61KB

    MD5

    1e28b93df4dc13ba183d7cac665bc45e

    SHA1

    9f91ec079b5033516398e65970431602ba51647c

    SHA256

    e6db1aa577d981ff37dffc63cf7496a94db52e27c035f59983236cf1117becaf

    SHA512

    f133fd3ce7ddc48f090f3f94c98ea8b3b6ad017fc774c43d691176fe3f18a499de890be3aaaadd36299df41ea0f705a7375a6772409efccd11991bc49e4d7331

  • C:\Windows\SysWOW64\rundll32Srv.exe
    Filesize

    61KB

    MD5

    1e28b93df4dc13ba183d7cac665bc45e

    SHA1

    9f91ec079b5033516398e65970431602ba51647c

    SHA256

    e6db1aa577d981ff37dffc63cf7496a94db52e27c035f59983236cf1117becaf

    SHA512

    f133fd3ce7ddc48f090f3f94c98ea8b3b6ad017fc774c43d691176fe3f18a499de890be3aaaadd36299df41ea0f705a7375a6772409efccd11991bc49e4d7331

  • C:\Windows\SysWOW64\rundll32Srv.exe
    Filesize

    61KB

    MD5

    1e28b93df4dc13ba183d7cac665bc45e

    SHA1

    9f91ec079b5033516398e65970431602ba51647c

    SHA256

    e6db1aa577d981ff37dffc63cf7496a94db52e27c035f59983236cf1117becaf

    SHA512

    f133fd3ce7ddc48f090f3f94c98ea8b3b6ad017fc774c43d691176fe3f18a499de890be3aaaadd36299df41ea0f705a7375a6772409efccd11991bc49e4d7331

  • \Program Files (x86)\Microsoft\DesktopLayer.exe
    Filesize

    61KB

    MD5

    1e28b93df4dc13ba183d7cac665bc45e

    SHA1

    9f91ec079b5033516398e65970431602ba51647c

    SHA256

    e6db1aa577d981ff37dffc63cf7496a94db52e27c035f59983236cf1117becaf

    SHA512

    f133fd3ce7ddc48f090f3f94c98ea8b3b6ad017fc774c43d691176fe3f18a499de890be3aaaadd36299df41ea0f705a7375a6772409efccd11991bc49e4d7331

  • \Program Files (x86)\Microsoft\DesktopLayer.exe
    Filesize

    61KB

    MD5

    1e28b93df4dc13ba183d7cac665bc45e

    SHA1

    9f91ec079b5033516398e65970431602ba51647c

    SHA256

    e6db1aa577d981ff37dffc63cf7496a94db52e27c035f59983236cf1117becaf

    SHA512

    f133fd3ce7ddc48f090f3f94c98ea8b3b6ad017fc774c43d691176fe3f18a499de890be3aaaadd36299df41ea0f705a7375a6772409efccd11991bc49e4d7331

  • \Windows\SysWOW64\rundll32Srv.exe
    Filesize

    61KB

    MD5

    1e28b93df4dc13ba183d7cac665bc45e

    SHA1

    9f91ec079b5033516398e65970431602ba51647c

    SHA256

    e6db1aa577d981ff37dffc63cf7496a94db52e27c035f59983236cf1117becaf

    SHA512

    f133fd3ce7ddc48f090f3f94c98ea8b3b6ad017fc774c43d691176fe3f18a499de890be3aaaadd36299df41ea0f705a7375a6772409efccd11991bc49e4d7331

  • \Windows\SysWOW64\rundll32Srv.exe
    Filesize

    61KB

    MD5

    1e28b93df4dc13ba183d7cac665bc45e

    SHA1

    9f91ec079b5033516398e65970431602ba51647c

    SHA256

    e6db1aa577d981ff37dffc63cf7496a94db52e27c035f59983236cf1117becaf

    SHA512

    f133fd3ce7ddc48f090f3f94c98ea8b3b6ad017fc774c43d691176fe3f18a499de890be3aaaadd36299df41ea0f705a7375a6772409efccd11991bc49e4d7331

  • memory/308-58-0x0000000000400000-0x000000000042F000-memory.dmp
    Filesize

    188KB

  • memory/308-62-0x0000000000400000-0x000000000042F000-memory.dmp
    Filesize

    188KB

  • memory/308-54-0x0000000000000000-mapping.dmp
  • memory/308-57-0x0000000010000000-0x0000000010071000-memory.dmp
    Filesize

    452KB

  • memory/308-55-0x0000000075C81000-0x0000000075C83000-memory.dmp
    Filesize

    8KB

  • memory/1216-65-0x0000000000220000-0x0000000000230000-memory.dmp
    Filesize

    64KB

  • memory/1216-66-0x0000000000400000-0x000000000042F000-memory.dmp
    Filesize

    188KB

  • memory/1216-60-0x0000000000000000-mapping.dmp
  • memory/1716-69-0x0000000000000000-mapping.dmp
  • memory/1716-73-0x0000000000400000-0x000000000042F000-memory.dmp
    Filesize

    188KB