ramnit | 1ae9742db982a6d8006e7d1287ed0056f7b8054182a9cbc8ffa0669d8725946f

Analysis

max time kernel
136s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 19:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1ae9742db982a6d8006e7d1287ed0056f7b8054182a9cbc8ffa0669d8725946f.dll
Size

312KB
MD5

c6a1198900920bb2fa34157dee6d393f
SHA1

9f91580225326331d32248a0538b809c11807e1d
SHA256

1ae9742db982a6d8006e7d1287ed0056f7b8054182a9cbc8ffa0669d8725946f
SHA512

aeef2b35817dbc393874a5b14fb02743a1b9e2769f2b35d4f10d3fc819a97e46ee732103ff2199eb4d03768b4190a04d1b52336d499903fdb57a0cda110b8b6b
SSDEEP

6144:3KZp3KNjVGv7svft+2dx3tZerMz39JLSqeol:3CxKNjcjqfh4rq3Htll

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Executes dropped EXE 4 IoCs

pid	Process
1740	rundll32mgr.exe
1180	rundll32mgrmgr.exe
1780	WaterMark.exe
1420	WaterMark.exe

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1180-144-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1740-146-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1180-156-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1740-151-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1780-168-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1420-167-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1780-170-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1780-169-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1780-171-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1420-172-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1420-173-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1420-178-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1780-179-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1780-180-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1780-181-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1780-182-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1420-183-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1420-184-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1420-185-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1780-186-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe
File created	C:\Windows\SysWOW64\rundll32mgrmgr.exe	rundll32mgr.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\WaterMark.exe	rundll32mgrmgr.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxDF2A.tmp	rundll32mgr.exe
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	rundll32mgr.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxDF2A.tmp	rundll32mgrmgr.exe
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	rundll32mgrmgr.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1772	4676	WerFault.exe	86
3908	4460	WerFault.exe	87

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1833692468"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1854787590"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{989D3DC3-6F4E-11ED-A0EE-DE60447A8195} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1982755981"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30999387"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30999387"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1833692468"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1834004803"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30999387"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30999387"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30999387"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30999387"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{9893B545-6F4E-11ED-A0EE-DE60447A8195} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30999387"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30999387"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1834004803"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1854787590"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff5800000000000000de04000065020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30999387"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{98A463ED-6F4E-11ED-A0EE-DE60447A8195} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
1420	WaterMark.exe
1780	WaterMark.exe
1420	WaterMark.exe
1780	WaterMark.exe
1780	WaterMark.exe
1420	WaterMark.exe
1780	WaterMark.exe
1420	WaterMark.exe
1780	WaterMark.exe
1420	WaterMark.exe
1780	WaterMark.exe
1420	WaterMark.exe
1420	WaterMark.exe
1420	WaterMark.exe
1780	WaterMark.exe
1780	WaterMark.exe
1420	WaterMark.exe
1420	WaterMark.exe
1780	WaterMark.exe
1780	WaterMark.exe
1780	WaterMark.exe
1780	WaterMark.exe
1420	WaterMark.exe
1420	WaterMark.exe
1780	WaterMark.exe
1780	WaterMark.exe
1780	WaterMark.exe
1780	WaterMark.exe
1420	WaterMark.exe
1420	WaterMark.exe
1420	WaterMark.exe
1420	WaterMark.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3520	iexplore.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1420	WaterMark.exe
Token: SeDebugPrivilege	1780	WaterMark.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3520	iexplore.exe
3836	iexplore.exe
4092	iexplore.exe
780	iexplore.exe

Suspicious use of SetWindowsHookEx 18 IoCs

pid	Process
4092	iexplore.exe
780	iexplore.exe
3520	iexplore.exe
4092	iexplore.exe
780	iexplore.exe
3520	iexplore.exe
3836	iexplore.exe
3836	iexplore.exe
4324	IEXPLORE.EXE
4324	IEXPLORE.EXE
3628	IEXPLORE.EXE
3628	IEXPLORE.EXE
2484	IEXPLORE.EXE
2484	IEXPLORE.EXE
2112	IEXPLORE.EXE
2112	IEXPLORE.EXE
3628	IEXPLORE.EXE
3628	IEXPLORE.EXE

Suspicious use of UnmapMainImage 4 IoCs

pid	Process
1180	rundll32mgrmgr.exe
1740	rundll32mgr.exe
1780	WaterMark.exe
1420	WaterMark.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 4996 wrote to memory of 2836	4996	rundll32.exe	81
PID 4996 wrote to memory of 2836	4996	rundll32.exe	81
PID 4996 wrote to memory of 2836	4996	rundll32.exe	81
PID 2836 wrote to memory of 1740	2836	rundll32.exe	82
PID 2836 wrote to memory of 1740	2836	rundll32.exe	82
PID 2836 wrote to memory of 1740	2836	rundll32.exe	82
PID 1740 wrote to memory of 1180	1740	rundll32mgr.exe	83
PID 1740 wrote to memory of 1180	1740	rundll32mgr.exe	83
PID 1740 wrote to memory of 1180	1740	rundll32mgr.exe	83
PID 1180 wrote to memory of 1420	1180	rundll32mgrmgr.exe	84
PID 1180 wrote to memory of 1420	1180	rundll32mgrmgr.exe	84
PID 1180 wrote to memory of 1420	1180	rundll32mgrmgr.exe	84
PID 1740 wrote to memory of 1780	1740	rundll32mgr.exe	85
PID 1740 wrote to memory of 1780	1740	rundll32mgr.exe	85
PID 1740 wrote to memory of 1780	1740	rundll32mgr.exe	85
PID 1780 wrote to memory of 4460	1780	WaterMark.exe	87
PID 1780 wrote to memory of 4460	1780	WaterMark.exe	87
PID 1780 wrote to memory of 4460	1780	WaterMark.exe	87
PID 1780 wrote to memory of 4460	1780	WaterMark.exe	87
PID 1780 wrote to memory of 4460	1780	WaterMark.exe	87
PID 1780 wrote to memory of 4460	1780	WaterMark.exe	87
PID 1780 wrote to memory of 4460	1780	WaterMark.exe	87
PID 1780 wrote to memory of 4460	1780	WaterMark.exe	87
PID 1780 wrote to memory of 4460	1780	WaterMark.exe	87
PID 1420 wrote to memory of 4676	1420	WaterMark.exe	86
PID 1420 wrote to memory of 4676	1420	WaterMark.exe	86
PID 1420 wrote to memory of 4676	1420	WaterMark.exe	86
PID 1420 wrote to memory of 4676	1420	WaterMark.exe	86
PID 1420 wrote to memory of 4676	1420	WaterMark.exe	86
PID 1420 wrote to memory of 4676	1420	WaterMark.exe	86
PID 1420 wrote to memory of 4676	1420	WaterMark.exe	86
PID 1420 wrote to memory of 4676	1420	WaterMark.exe	86
PID 1420 wrote to memory of 4676	1420	WaterMark.exe	86
PID 1780 wrote to memory of 780	1780	WaterMark.exe	92
PID 1780 wrote to memory of 780	1780	WaterMark.exe	92
PID 1420 wrote to memory of 3836	1420	WaterMark.exe	93
PID 1420 wrote to memory of 3836	1420	WaterMark.exe	93
PID 1780 wrote to memory of 3520	1780	WaterMark.exe	94
PID 1780 wrote to memory of 3520	1780	WaterMark.exe	94
PID 1420 wrote to memory of 4092	1420	WaterMark.exe	95
PID 1420 wrote to memory of 4092	1420	WaterMark.exe	95
PID 3836 wrote to memory of 2484	3836	iexplore.exe	98
PID 3836 wrote to memory of 2484	3836	iexplore.exe	98
PID 3836 wrote to memory of 2484	3836	iexplore.exe	98
PID 3520 wrote to memory of 3628	3520	iexplore.exe	99
PID 3520 wrote to memory of 3628	3520	iexplore.exe	99
PID 3520 wrote to memory of 3628	3520	iexplore.exe	99
PID 780 wrote to memory of 4324	780	iexplore.exe	97
PID 780 wrote to memory of 4324	780	iexplore.exe	97
PID 780 wrote to memory of 4324	780	iexplore.exe	97
PID 4092 wrote to memory of 2112	4092	iexplore.exe	96
PID 4092 wrote to memory of 2112	4092	iexplore.exe	96
PID 4092 wrote to memory of 2112	4092	iexplore.exe	96

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1ae9742db982a6d8006e7d1287ed0056f7b8054182a9cbc8ffa0669d8725946f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1ae9742db982a6d8006e7d1287ed0056f7b8054182a9cbc8ffa0669d8725946f.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Windows\SysWOW64\rundll32mgr.exe
    C:\Windows\SysWOW64\rundll32mgr.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Suspicious use of UnmapMainImage
    - Suspicious use of WriteProcessMemory
    PID:1740
  - - C:\Windows\SysWOW64\rundll32mgrmgr.exe
      C:\Windows\SysWOW64\rundll32mgrmgr.exe
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious use of UnmapMainImage
      Suspicious use of WriteProcessMemory
      PID:1180
    - - C:\Program Files (x86)\Microsoft\WaterMark.exe
        
        "C:\Program Files (x86)\Microsoft\WaterMark.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of UnmapMainImage
        Suspicious use of WriteProcessMemory
        
        PID:1420
      - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        6⤵
        
        PID:4676
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 204
        7⤵
        Program crash
        
        PID:1772
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3836
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3836 CREDAT:17410 /prefetch:2
        7⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2484
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4092
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4092 CREDAT:17410 /prefetch:2
        7⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2112
  - - C:\Program Files (x86)\Microsoft\WaterMark.exe
      "C:\Program Files (x86)\Microsoft\WaterMark.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of UnmapMainImage
      Suspicious use of WriteProcessMemory
      PID:1780
    - - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        5⤵
        
        PID:4460
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4460 -s 204
        6⤵
        Program crash
        
        PID:3908
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:780
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:780 CREDAT:17410 /prefetch:2
        6⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:4324
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        Modifies Internet Explorer settings
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3520
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3520 CREDAT:17410 /prefetch:2
        6⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:3628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4676 -ip 4676
1⤵
PID:3588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4460 -ip 4460
1⤵
PID:3368

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\WaterMark.exe

Filesize
95KB

MD5
5e58db00b2e0a1a44777f0e196d0cd1f

SHA1
2eb444a5a498e4ef629dffe3b3799feb13b9e90a

SHA256
7c980c578f5b9f21da1db75d5ecff469f3cee543162d56338464ecb9b4d3c616

SHA512
8c85ca67d5cb4efb437e3d44510b8b77f42da23664b992f9b804b65837ed2eeddf4ee7b86ff9f33189a9d71bb099f1d097a80dbf7a21cc65443fc51c5af199be

Download Submit
C:\Program Files (x86)\Microsoft\WaterMark.exe

Filesize
95KB

MD5
5e58db00b2e0a1a44777f0e196d0cd1f

SHA1
2eb444a5a498e4ef629dffe3b3799feb13b9e90a

SHA256
7c980c578f5b9f21da1db75d5ecff469f3cee543162d56338464ecb9b4d3c616

SHA512
8c85ca67d5cb4efb437e3d44510b8b77f42da23664b992f9b804b65837ed2eeddf4ee7b86ff9f33189a9d71bb099f1d097a80dbf7a21cc65443fc51c5af199be

Download Submit
C:\Program Files (x86)\Microsoft\WaterMark.exe

Filesize
95KB

MD5
5e58db00b2e0a1a44777f0e196d0cd1f

SHA1
2eb444a5a498e4ef629dffe3b3799feb13b9e90a

SHA256
7c980c578f5b9f21da1db75d5ecff469f3cee543162d56338464ecb9b4d3c616

SHA512
8c85ca67d5cb4efb437e3d44510b8b77f42da23664b992f9b804b65837ed2eeddf4ee7b86ff9f33189a9d71bb099f1d097a80dbf7a21cc65443fc51c5af199be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
dedb504b3469b24ec0df79c68f5772e2

SHA1
177a8b1045b456316ca32d90aba942bf34774c64

SHA256
e18111fd56db31f02eb16990f0bbc7991a0c80571703281ee66010e229c9f8b0

SHA512
101312fa01991caeaef010d0d21e740244cb3768490a1b82ae12e7524e50b6e7f2e23c08978ac4c373e9013baa0a8f50de8e1994341556b78ecd88ce13df5680

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
dedb504b3469b24ec0df79c68f5772e2

SHA1
177a8b1045b456316ca32d90aba942bf34774c64

SHA256
e18111fd56db31f02eb16990f0bbc7991a0c80571703281ee66010e229c9f8b0

SHA512
101312fa01991caeaef010d0d21e740244cb3768490a1b82ae12e7524e50b6e7f2e23c08978ac4c373e9013baa0a8f50de8e1994341556b78ecd88ce13df5680

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
dedb504b3469b24ec0df79c68f5772e2

SHA1
177a8b1045b456316ca32d90aba942bf34774c64

SHA256
e18111fd56db31f02eb16990f0bbc7991a0c80571703281ee66010e229c9f8b0

SHA512
101312fa01991caeaef010d0d21e740244cb3768490a1b82ae12e7524e50b6e7f2e23c08978ac4c373e9013baa0a8f50de8e1994341556b78ecd88ce13df5680

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
434B

MD5
09e33a23bc2a8c3333c9dbd403299b73

SHA1
ea78f289373132f636c37af00948cd1b762cda4f

SHA256
ab900c547746ff428ae1e4126207504136a4d33f97079eb3a5df77291b683445

SHA512
df44cc1cbc92fd2af748e64970de056e54b71ae430e951e7576fc054d7185985fa7644b789e54ada5bbef592938ccf630e4a1f314bd2ba581711109dd9fb05e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
434B

MD5
13168340424b840233db4df97b1495db

SHA1
529e1231c9575111c609547d774fc09d901b279b

SHA256
d63839517a77e926be81f59955979e3eb4d108d8b1f14adb96aca606194d5645

SHA512
ba7dfaf5aff2666f889f306c2f24f64d7712537a9a967f33150f9b0a79d9e541fd9aee699b640d07f83288111a3b86119ecfc3c3657810c1530c163830fce6c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
434B

MD5
13168340424b840233db4df97b1495db

SHA1
529e1231c9575111c609547d774fc09d901b279b

SHA256
d63839517a77e926be81f59955979e3eb4d108d8b1f14adb96aca606194d5645

SHA512
ba7dfaf5aff2666f889f306c2f24f64d7712537a9a967f33150f9b0a79d9e541fd9aee699b640d07f83288111a3b86119ecfc3c3657810c1530c163830fce6c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
434B

MD5
13168340424b840233db4df97b1495db

SHA1
529e1231c9575111c609547d774fc09d901b279b

SHA256
d63839517a77e926be81f59955979e3eb4d108d8b1f14adb96aca606194d5645

SHA512
ba7dfaf5aff2666f889f306c2f24f64d7712537a9a967f33150f9b0a79d9e541fd9aee699b640d07f83288111a3b86119ecfc3c3657810c1530c163830fce6c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
434B

MD5
13168340424b840233db4df97b1495db

SHA1
529e1231c9575111c609547d774fc09d901b279b

SHA256
d63839517a77e926be81f59955979e3eb4d108d8b1f14adb96aca606194d5645

SHA512
ba7dfaf5aff2666f889f306c2f24f64d7712537a9a967f33150f9b0a79d9e541fd9aee699b640d07f83288111a3b86119ecfc3c3657810c1530c163830fce6c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
434B

MD5
13168340424b840233db4df97b1495db

SHA1
529e1231c9575111c609547d774fc09d901b279b

SHA256
d63839517a77e926be81f59955979e3eb4d108d8b1f14adb96aca606194d5645

SHA512
ba7dfaf5aff2666f889f306c2f24f64d7712537a9a967f33150f9b0a79d9e541fd9aee699b640d07f83288111a3b86119ecfc3c3657810c1530c163830fce6c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{9893B545-6F4E-11ED-A0EE-DE60447A8195}.dat

Filesize
5KB

MD5
a2854fee5068d64dd5f46daf4d568f64

SHA1
c23720f36d8841c3a39b2a76cde979b48d05c1a7

SHA256
6d477fcf0e294708ef089aeb047cd742a10d852ea5c344d30991e4951c0d37d9

SHA512
3354ed4a089414d02828d90875582b6c1efd366cd006b7002ec95315fdc90b8e8bc41d86d376d74bef6721899d31f317ee8ddd01ed1519389e3f7e726ef55a4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{9893DC55-6F4E-11ED-A0EE-DE60447A8195}.dat

Filesize
5KB

MD5
aece37fba2991fec196d5d1d1a19ca58

SHA1
d1e174541c2d6fe2ef7e8b95a15620147c99451a

SHA256
b96f611d1024df0e146c131eb76e172eca10a4b9c4548212c1da9d1e96d8c30b

SHA512
e464069a6e893512f830985c25b471e0507245a7fbfa79e561c5725e5dbb30a734f72bdc829b9e3fca16835010856e3b0050275e1999b354a50eb42ec21023e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{989D3DC3-6F4E-11ED-A0EE-DE60447A8195}.dat

Filesize
5KB

MD5
80219b79c63b10d5b708667499263071

SHA1
686c0e7805fc3ef890560c63f21643172ffd2c56

SHA256
990373db8864551149ae5210b75e803f19cef4fc04c8a2833c95cfb99befa4e3

SHA512
532eaaf61fa8d4281f06eb535380a6b584f693c896470573fd7f238b8ecefd2a9a1bff0a554b4e57a90ac64649186bead6ac71c48c6f3389fef02a21b7271cf8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{989D3DC3-6F4E-11ED-A0EE-DE60447A8195}.dat

Filesize
5KB

MD5
80219b79c63b10d5b708667499263071

SHA1
686c0e7805fc3ef890560c63f21643172ffd2c56

SHA256
990373db8864551149ae5210b75e803f19cef4fc04c8a2833c95cfb99befa4e3

SHA512
532eaaf61fa8d4281f06eb535380a6b584f693c896470573fd7f238b8ecefd2a9a1bff0a554b4e57a90ac64649186bead6ac71c48c6f3389fef02a21b7271cf8

Download Submit
C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
193KB

MD5
e8ec913726c2936d53e1b6b6a63d5100

SHA1
229d133d45490f2a673a208bdb3c341d947d6cfe

SHA256
3969d6261c5888b988ae85e897b88a11fd14688ade7d5332538d922f2de0d77e

SHA512
098d142e7caad42e00f4a4966df974754a5eaeaa651cd317ffe39d2141754382afe2e34294c1cc50599458674e61b67939e6ccafd9c1a79e0ac95784e09e7618

Download Submit
C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
193KB

MD5
e8ec913726c2936d53e1b6b6a63d5100

SHA1
229d133d45490f2a673a208bdb3c341d947d6cfe

SHA256
3969d6261c5888b988ae85e897b88a11fd14688ade7d5332538d922f2de0d77e

SHA512
098d142e7caad42e00f4a4966df974754a5eaeaa651cd317ffe39d2141754382afe2e34294c1cc50599458674e61b67939e6ccafd9c1a79e0ac95784e09e7618

Download Submit
C:\Windows\SysWOW64\rundll32mgrmgr.exe

Filesize
95KB

MD5
5e58db00b2e0a1a44777f0e196d0cd1f

SHA1
2eb444a5a498e4ef629dffe3b3799feb13b9e90a

SHA256
7c980c578f5b9f21da1db75d5ecff469f3cee543162d56338464ecb9b4d3c616

SHA512
8c85ca67d5cb4efb437e3d44510b8b77f42da23664b992f9b804b65837ed2eeddf4ee7b86ff9f33189a9d71bb099f1d097a80dbf7a21cc65443fc51c5af199be

Download Submit
C:\Windows\SysWOW64\rundll32mgrmgr.exe

Filesize
95KB

MD5
5e58db00b2e0a1a44777f0e196d0cd1f

SHA1
2eb444a5a498e4ef629dffe3b3799feb13b9e90a

SHA256
7c980c578f5b9f21da1db75d5ecff469f3cee543162d56338464ecb9b4d3c616

SHA512
8c85ca67d5cb4efb437e3d44510b8b77f42da23664b992f9b804b65837ed2eeddf4ee7b86ff9f33189a9d71bb099f1d097a80dbf7a21cc65443fc51c5af199be

Download Submit
memory/1180-144-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1180-156-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1420-172-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1420-184-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1420-173-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1420-185-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1420-183-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1420-167-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1420-178-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1740-151-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1740-146-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1780-168-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1780-171-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1780-180-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1780-169-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1780-186-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1780-179-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1780-181-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1780-170-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1780-182-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2836-133-0x0000000010000000-0x0000000010050000-memory.dmp

Filesize
320KB

Download