Analysis

  • max time kernel
    136s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-11-2022 19:40

General

  • Target

    389f063995cc9bb52d421746c6cf55586917efdd361309064894c512b82d8a04.dll

  • Size

    444KB

  • MD5

    ce4526b5e0560ed85355d5eef9e2a9b6

  • SHA1

    c749bf4a91483b174c3597723f6f45b04f16433c

  • SHA256

    389f063995cc9bb52d421746c6cf55586917efdd361309064894c512b82d8a04

  • SHA512

    594851da40de36daf54ad828907b59692a339e09fc20a132331f6202d9f36c7998171068b2585fb8ceba0a57dad649ebcf8959debdfc8afaccd3ae4fe71938af

  • SSDEEP

    12288:/ehnaNPpSVZmNxRCwnwm3W3OHIIf5lOkSDZy:/eh0PpS6NxNnwYeOHXH+DZy

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Program crash 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\389f063995cc9bb52d421746c6cf55586917efdd361309064894c512b82d8a04.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4800
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\389f063995cc9bb52d421746c6cf55586917efdd361309064894c512b82d8a04.dll,#1
      2⤵
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:4792
      • C:\Windows\SysWOW64\rundll32Srv.exe
        C:\Windows\SysWOW64\rundll32Srv.exe
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:4100
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2320
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2020
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2020 CREDAT:17410 /prefetch:2
              6⤵
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:2916
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 608
        3⤵
        • Program crash
        PID:316
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4792 -ip 4792
    1⤵
      PID:4288

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Defense Evasion

    Modify Registry

    1
    T1112

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
      Filesize

      61KB

      MD5

      1e28b93df4dc13ba183d7cac665bc45e

      SHA1

      9f91ec079b5033516398e65970431602ba51647c

      SHA256

      e6db1aa577d981ff37dffc63cf7496a94db52e27c035f59983236cf1117becaf

      SHA512

      f133fd3ce7ddc48f090f3f94c98ea8b3b6ad017fc774c43d691176fe3f18a499de890be3aaaadd36299df41ea0f705a7375a6772409efccd11991bc49e4d7331

    • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
      Filesize

      61KB

      MD5

      1e28b93df4dc13ba183d7cac665bc45e

      SHA1

      9f91ec079b5033516398e65970431602ba51647c

      SHA256

      e6db1aa577d981ff37dffc63cf7496a94db52e27c035f59983236cf1117becaf

      SHA512

      f133fd3ce7ddc48f090f3f94c98ea8b3b6ad017fc774c43d691176fe3f18a499de890be3aaaadd36299df41ea0f705a7375a6772409efccd11991bc49e4d7331

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
      Filesize

      471B

      MD5

      dedb504b3469b24ec0df79c68f5772e2

      SHA1

      177a8b1045b456316ca32d90aba942bf34774c64

      SHA256

      e18111fd56db31f02eb16990f0bbc7991a0c80571703281ee66010e229c9f8b0

      SHA512

      101312fa01991caeaef010d0d21e740244cb3768490a1b82ae12e7524e50b6e7f2e23c08978ac4c373e9013baa0a8f50de8e1994341556b78ecd88ce13df5680

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
      Filesize

      434B

      MD5

      d8826cb9cf6c9d32377b73a5cdf01fec

      SHA1

      30047ada5872307bb684c3d3b87dbb8eaa82efb7

      SHA256

      057825ec27546ee57abcac992e7bd29c4b636b761eda4d520301c0c0ad6a99bd

      SHA512

      36c9f1da1b35e4221874d62d2b190b9a074939db0b9a976b8bf2b9489e398d35f10ce89129d5c620fa3b53785690d1b837112df0a806262a18bd313b21c30a2d

    • C:\Windows\SysWOW64\rundll32Srv.exe
      Filesize

      61KB

      MD5

      1e28b93df4dc13ba183d7cac665bc45e

      SHA1

      9f91ec079b5033516398e65970431602ba51647c

      SHA256

      e6db1aa577d981ff37dffc63cf7496a94db52e27c035f59983236cf1117becaf

      SHA512

      f133fd3ce7ddc48f090f3f94c98ea8b3b6ad017fc774c43d691176fe3f18a499de890be3aaaadd36299df41ea0f705a7375a6772409efccd11991bc49e4d7331

    • C:\Windows\SysWOW64\rundll32Srv.exe
      Filesize

      61KB

      MD5

      1e28b93df4dc13ba183d7cac665bc45e

      SHA1

      9f91ec079b5033516398e65970431602ba51647c

      SHA256

      e6db1aa577d981ff37dffc63cf7496a94db52e27c035f59983236cf1117becaf

      SHA512

      f133fd3ce7ddc48f090f3f94c98ea8b3b6ad017fc774c43d691176fe3f18a499de890be3aaaadd36299df41ea0f705a7375a6772409efccd11991bc49e4d7331

    • memory/2320-138-0x0000000000000000-mapping.dmp
    • memory/2320-142-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/4100-137-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/4100-141-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/4100-133-0x0000000000000000-mapping.dmp
    • memory/4792-136-0x0000000010000000-0x0000000010071000-memory.dmp
      Filesize

      452KB

    • memory/4792-132-0x0000000000000000-mapping.dmp