ramnit | d73379fab1de9711c9ddfeaeb92b2b9aeca4aefda67d950483bb6ec5ff00e446

Analysis

max time kernel
146s
max time network
153s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
06-12-2023 21:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d7999a3e9af0b9c230f38adebb5fc300.dll
Size

564KB
MD5

d7999a3e9af0b9c230f38adebb5fc300
SHA1

6072f81e32d11f65a32b13540dbee2dd4e60a987
SHA256

d73379fab1de9711c9ddfeaeb92b2b9aeca4aefda67d950483bb6ec5ff00e446
SHA512

9e842a564d12df7915d62638f27a8619a549131a0a7990ec453de04762b559daec9e86427319d554168ae0075ef5a77795f41308dec727f7a136fdfef634e648
SSDEEP

12288:tehnaNPpSVZmNxRCwnwm3W3OHIIf5m9RhWFVJ:teh0PpS6NxNnwYeOHXAhWTJ

Score

10^/10

ramnit sality backdoor banker evasion persistence spyware stealer trojan upx worm

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe"	svchost.exe

Modifies firewall policy service 2 TTPs 3 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Processes:

rundll32mgr.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	rundll32mgr.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	rundll32mgr.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	rundll32mgr.exe

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality
UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1548.002

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

rundll32mgr.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" rundll32mgr.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	rundll32mgr.exe

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

rundll32mgr.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	rundll32mgr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	rundll32mgr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	rundll32mgr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	rundll32mgr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	rundll32mgr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	rundll32mgr.exe

Executes dropped EXE 2 IoCs

Processes:

rundll32mgr.exeWaterMark.exe

pid process

2692 rundll32mgr.exe
2788 WaterMark.exe
Loads dropped DLL 4 IoCs

Processes:

rundll32.exerundll32mgr.exe

pid process

2908 rundll32.exe
2908 rundll32.exe
2692 rundll32mgr.exe
2692 rundll32mgr.exe

pid	process
2908	rundll32.exe
2908	rundll32.exe
2692	rundll32mgr.exe
2692	rundll32mgr.exe

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2692-13-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2692-14-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2692-15-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2692-16-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2692-17-0x0000000002940000-0x00000000039CE000-memory.dmp	upx
behavioral1/memory/2692-21-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2692-23-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2692-25-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2692-20-0x0000000002940000-0x00000000039CE000-memory.dmp	upx
behavioral1/memory/2692-26-0x0000000002940000-0x00000000039CE000-memory.dmp	upx
behavioral1/memory/2788-42-0x0000000000400000-0x0000000000434000-memory.dmp	upx
behavioral1/memory/2692-37-0x0000000000670000-0x00000000006A4000-memory.dmp	upx
behavioral1/memory/2788-50-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2788-191-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

rundll32mgr.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	rundll32mgr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	rundll32mgr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	rundll32mgr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	rundll32mgr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	rundll32mgr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	rundll32mgr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	rundll32mgr.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

rundll32mgr.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" rundll32mgr.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	rundll32mgr.exe

Drops file in System32 directory 3 IoCs

Processes:

svchost.exerundll32.exe

description	ioc	process
File created	C:\Windows\SysWOW64\dmlconf.dat	svchost.exe
File opened for modification	C:\Windows\SysWOW64\dmlconf.dat	svchost.exe
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

Drops file in Program Files directory 64 IoCs

Processes:

svchost.exerundll32mgr.exe

description	ioc	process
File opened for modification	C:\Program Files\Common Files\System\wab32.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\eclipse_1655.dll	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\InkDiv.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\jaas_nt.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\msdfmap.dll	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\vk_swiftshader.dll	svchost.exe
File opened for modification	C:\Program Files\Internet Explorer\DiagnosticsHub.DataWarehouse.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\WindowsAccessBridge-64.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\WaterMark.exe	rundll32mgr.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\msxactps.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\javaw.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html	svchost.exe
File opened for modification	C:\Program Files\DVD Maker\OmdProject.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\JavaAccessBridge-64.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\verify.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\license.html	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\IpsPlugin.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jsound.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java_crw_demo.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jsoundds.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\jawt.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\micaut.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\JdbcOdbc.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm	svchost.exe
File opened for modification	C:\Program Files\Internet Explorer\pdmproxy100.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\gstreamer-lite.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\about.html	svchost.exe
File opened for modification	C:\Program Files\Internet Explorer\msdbg2.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\awt.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jli.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\jfxwebkit.dll	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\glib-lite.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\eclipse_1665.dll	svchost.exe
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	rundll32mgr.exe
File opened for modification	C:\Program Files\BackupWatch.html	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\net.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\TabIpsps.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VGX\VGX.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\eula.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\unpack200.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\sunmscapi.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\splashscreen.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\mraut.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\msadce.dll	svchost.exe
File opened for modification	C:\Program Files\Internet Explorer\jsdebuggeride.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\epl-v10.html	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\preface.htm	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px9C3F.tmp	rundll32mgr.exe
File opened for modification	C:\Program Files\7-Zip\7-zip32.dll	svchost.exe
File opened for modification	C:\Program Files\Internet Explorer\networkinspection.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dt_shmem.dll	svchost.exe

Drops file in Windows directory 1 IoCs

Processes:

rundll32mgr.exe

description ioc process

File opened for modification C:\Windows\SYSTEM.INI rundll32mgr.exe

description	ioc	process
File opened for modification	C:\Windows\SYSTEM.INI	rundll32mgr.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

rundll32mgr.exeWaterMark.exesvchost.exe

pid	process
2692	rundll32mgr.exe
2788	WaterMark.exe
2788	WaterMark.exe
2788	WaterMark.exe
2788	WaterMark.exe
2788	WaterMark.exe
2788	WaterMark.exe
2788	WaterMark.exe
2788	WaterMark.exe
560	svchost.exe
560	svchost.exe
560	svchost.exe
560	svchost.exe
560	svchost.exe
560	svchost.exe
560	svchost.exe
560	svchost.exe
560	svchost.exe
560	svchost.exe
560	svchost.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

Processes:

rundll32mgr.exeWaterMark.exesvchost.exe

description	pid	process
Token: SeDebugPrivilege	2692	rundll32mgr.exe
Token: SeDebugPrivilege	2692	rundll32mgr.exe
Token: SeDebugPrivilege	2692	rundll32mgr.exe
Token: SeDebugPrivilege	2692	rundll32mgr.exe
Token: SeDebugPrivilege	2692	rundll32mgr.exe
Token: SeDebugPrivilege	2692	rundll32mgr.exe
Token: SeDebugPrivilege	2692	rundll32mgr.exe
Token: SeDebugPrivilege	2692	rundll32mgr.exe
Token: SeDebugPrivilege	2692	rundll32mgr.exe
Token: SeDebugPrivilege	2692	rundll32mgr.exe
Token: SeDebugPrivilege	2692	rundll32mgr.exe
Token: SeDebugPrivilege	2692	rundll32mgr.exe
Token: SeDebugPrivilege	2692	rundll32mgr.exe
Token: SeDebugPrivilege	2692	rundll32mgr.exe
Token: SeDebugPrivilege	2692	rundll32mgr.exe
Token: SeDebugPrivilege	2692	rundll32mgr.exe
Token: SeDebugPrivilege	2692	rundll32mgr.exe
Token: SeDebugPrivilege	2692	rundll32mgr.exe
Token: SeDebugPrivilege	2788	WaterMark.exe
Token: SeDebugPrivilege	560	svchost.exe

Suspicious use of UnmapMainImage 2 IoCs

Processes:

rundll32mgr.exeWaterMark.exe

pid process

2692 rundll32mgr.exe
2788 WaterMark.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

rundll32.exerundll32.exerundll32mgr.exeWaterMark.exesvchost.exe

description	pid	process	target process
PID 2852 wrote to memory of 2908	2852	rundll32.exe	rundll32.exe
PID 2852 wrote to memory of 2908	2852	rundll32.exe	rundll32.exe
PID 2852 wrote to memory of 2908	2852	rundll32.exe	rundll32.exe
PID 2852 wrote to memory of 2908	2852	rundll32.exe	rundll32.exe
PID 2852 wrote to memory of 2908	2852	rundll32.exe	rundll32.exe
PID 2852 wrote to memory of 2908	2852	rundll32.exe	rundll32.exe
PID 2852 wrote to memory of 2908	2852	rundll32.exe	rundll32.exe
PID 2908 wrote to memory of 2692	2908	rundll32.exe	rundll32mgr.exe
PID 2908 wrote to memory of 2692	2908	rundll32.exe	rundll32mgr.exe
PID 2908 wrote to memory of 2692	2908	rundll32.exe	rundll32mgr.exe
PID 2908 wrote to memory of 2692	2908	rundll32.exe	rundll32mgr.exe
PID 2692 wrote to memory of 1120	2692	rundll32mgr.exe	taskhost.exe
PID 2692 wrote to memory of 2788	2692	rundll32mgr.exe	WaterMark.exe
PID 2692 wrote to memory of 2788	2692	rundll32mgr.exe	WaterMark.exe
PID 2692 wrote to memory of 2788	2692	rundll32mgr.exe	WaterMark.exe
PID 2692 wrote to memory of 2788	2692	rundll32mgr.exe	WaterMark.exe
PID 2788 wrote to memory of 2568	2788	WaterMark.exe	svchost.exe
PID 2788 wrote to memory of 2568	2788	WaterMark.exe	svchost.exe
PID 2788 wrote to memory of 2568	2788	WaterMark.exe	svchost.exe
PID 2788 wrote to memory of 2568	2788	WaterMark.exe	svchost.exe
PID 2788 wrote to memory of 2568	2788	WaterMark.exe	svchost.exe
PID 2788 wrote to memory of 2568	2788	WaterMark.exe	svchost.exe
PID 2788 wrote to memory of 2568	2788	WaterMark.exe	svchost.exe
PID 2788 wrote to memory of 2568	2788	WaterMark.exe	svchost.exe
PID 2788 wrote to memory of 2568	2788	WaterMark.exe	svchost.exe
PID 2788 wrote to memory of 2568	2788	WaterMark.exe	svchost.exe
PID 2788 wrote to memory of 560	2788	WaterMark.exe	svchost.exe
PID 2788 wrote to memory of 560	2788	WaterMark.exe	svchost.exe
PID 2788 wrote to memory of 560	2788	WaterMark.exe	svchost.exe
PID 2788 wrote to memory of 560	2788	WaterMark.exe	svchost.exe
PID 2788 wrote to memory of 560	2788	WaterMark.exe	svchost.exe
PID 2788 wrote to memory of 560	2788	WaterMark.exe	svchost.exe
PID 2788 wrote to memory of 560	2788	WaterMark.exe	svchost.exe
PID 2788 wrote to memory of 560	2788	WaterMark.exe	svchost.exe
PID 2788 wrote to memory of 560	2788	WaterMark.exe	svchost.exe
PID 2788 wrote to memory of 560	2788	WaterMark.exe	svchost.exe
PID 560 wrote to memory of 260	560	svchost.exe	smss.exe
PID 560 wrote to memory of 260	560	svchost.exe	smss.exe
PID 560 wrote to memory of 260	560	svchost.exe	smss.exe
PID 560 wrote to memory of 260	560	svchost.exe	smss.exe
PID 560 wrote to memory of 260	560	svchost.exe	smss.exe
PID 560 wrote to memory of 336	560	svchost.exe	csrss.exe
PID 560 wrote to memory of 336	560	svchost.exe	csrss.exe
PID 560 wrote to memory of 336	560	svchost.exe	csrss.exe
PID 560 wrote to memory of 336	560	svchost.exe	csrss.exe
PID 560 wrote to memory of 336	560	svchost.exe	csrss.exe
PID 560 wrote to memory of 372	560	svchost.exe	wininit.exe
PID 560 wrote to memory of 372	560	svchost.exe	wininit.exe
PID 560 wrote to memory of 372	560	svchost.exe	wininit.exe
PID 560 wrote to memory of 372	560	svchost.exe	wininit.exe
PID 560 wrote to memory of 372	560	svchost.exe	wininit.exe
PID 560 wrote to memory of 384	560	svchost.exe	csrss.exe
PID 560 wrote to memory of 384	560	svchost.exe	csrss.exe
PID 560 wrote to memory of 384	560	svchost.exe	csrss.exe
PID 560 wrote to memory of 384	560	svchost.exe	csrss.exe
PID 560 wrote to memory of 384	560	svchost.exe	csrss.exe
PID 560 wrote to memory of 420	560	svchost.exe	winlogon.exe
PID 560 wrote to memory of 420	560	svchost.exe	winlogon.exe
PID 560 wrote to memory of 420	560	svchost.exe	winlogon.exe
PID 560 wrote to memory of 420	560	svchost.exe	winlogon.exe
PID 560 wrote to memory of 420	560	svchost.exe	winlogon.exe
PID 560 wrote to memory of 464	560	svchost.exe	services.exe
PID 560 wrote to memory of 464	560	svchost.exe	services.exe
PID 560 wrote to memory of 464	560	svchost.exe	services.exe

System policy modification 1 TTPs 1 IoCs
evasion

Modify Registry
T1112

Processes:

rundll32mgr.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" rundll32mgr.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	rundll32mgr.exe

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
1⤵
PID:488

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1232

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d7999a3e9af0b9c230f38adebb5fc300.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2852

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d7999a3e9af0b9c230f38adebb5fc300.dll,#1
3⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2908

C:\Windows\SysWOW64\rundll32mgr.exe
C:\Windows\SysWOW64\rundll32mgr.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2692

C:\Program Files (x86)\Microsoft\WaterMark.exe
"C:\Program Files (x86)\Microsoft\WaterMark.exe"
5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2788

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
6⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
PID:2568

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:560

C:\Windows\system32\sppsvc.exe
C:\Windows\system32\sppsvc.exe
1⤵
PID:3060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
1⤵
PID:2944

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1160

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
1⤵
PID:1076

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService
1⤵
PID:332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
1⤵
PID:992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
PID:856

C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
2⤵
PID:240

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
1⤵
PID:816

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS
1⤵
PID:684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
1⤵
PID:604

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -Embedding
2⤵
PID:2136

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:480

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:464

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:384

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:372

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:336

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe
1⤵
PID:260

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Modify Registry

T1112

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\WaterMark.exe
Filesize
164KB

MD5
a3b1f1c4cd75bea10095e054f990bf1d

SHA1
15bf037b2166d2533e12bbec9f1d5f9a3ad8c81b

SHA256
a4c51942f696650a7ce0530a88c3742380ac82bc1ddc75c24d1417f0958caaee

SHA512
7457591c9676baa6043e4c3ae6ede364f19964c4e4e6a91a06e148221402791cabf9d5ab2bfcb629120ab136fee0a2994c0830f7cbfb112c5c6b07109b6a1a94

Download Submit
C:\Program Files (x86)\Microsoft\WaterMark.exe
Filesize
164KB

MD5
a3b1f1c4cd75bea10095e054f990bf1d

SHA1
15bf037b2166d2533e12bbec9f1d5f9a3ad8c81b

SHA256
a4c51942f696650a7ce0530a88c3742380ac82bc1ddc75c24d1417f0958caaee

SHA512
7457591c9676baa6043e4c3ae6ede364f19964c4e4e6a91a06e148221402791cabf9d5ab2bfcb629120ab136fee0a2994c0830f7cbfb112c5c6b07109b6a1a94

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html
Filesize
342KB

MD5
c45f70d81ce6bd59fe9d15335a0bda6a

SHA1
3b193cb68d7a986df9e5cf2cb33f288c44040252

SHA256
12e3e61194a6f65a3c1f4d70e59439b8f0aa91685cb182aed53cbeb53aa3b5d1

SHA512
dd4f842a771b41c6317ec409eb4f6d9ed4a7e200cb27529e36f468667e8cf640f698d3d8ffb6f9fb8582ecdb5999dcb93011b8947fef3e046e439ef18107bf1c

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html
Filesize
338KB

MD5
07a248bd3b838275d24349d12a545dda

SHA1
78c6b24ba63ed418128dbd6a41322889bccbc72f

SHA256
36753397ae0ba6af91daa735aa88dee182ab7d903582ba8a39075efd8b97452f

SHA512
65ddbd7cbe9895242cbd389c98f5d4bdbd9aecfba825c55b4f0f7ff7d36c7cef232ce706ef25bbcb473498ab4cd61b6e1cf0c9583de0efd88e0bc70ba54ec6bd

Download Submit
C:\Windows\SysWOW64\rundll32mgr.exe
Filesize
164KB

MD5
a3b1f1c4cd75bea10095e054f990bf1d

SHA1
15bf037b2166d2533e12bbec9f1d5f9a3ad8c81b

SHA256
a4c51942f696650a7ce0530a88c3742380ac82bc1ddc75c24d1417f0958caaee

SHA512
7457591c9676baa6043e4c3ae6ede364f19964c4e4e6a91a06e148221402791cabf9d5ab2bfcb629120ab136fee0a2994c0830f7cbfb112c5c6b07109b6a1a94

Download Submit
C:\Windows\SysWOW64\rundll32mgr.exe
Filesize
164KB

MD5
a3b1f1c4cd75bea10095e054f990bf1d

SHA1
15bf037b2166d2533e12bbec9f1d5f9a3ad8c81b

SHA256
a4c51942f696650a7ce0530a88c3742380ac82bc1ddc75c24d1417f0958caaee

SHA512
7457591c9676baa6043e4c3ae6ede364f19964c4e4e6a91a06e148221402791cabf9d5ab2bfcb629120ab136fee0a2994c0830f7cbfb112c5c6b07109b6a1a94

Download Submit
C:\Windows\SysWOW64\rundll32mgr.exe
Filesize
164KB

MD5
a3b1f1c4cd75bea10095e054f990bf1d

SHA1
15bf037b2166d2533e12bbec9f1d5f9a3ad8c81b

SHA256
a4c51942f696650a7ce0530a88c3742380ac82bc1ddc75c24d1417f0958caaee

SHA512
7457591c9676baa6043e4c3ae6ede364f19964c4e4e6a91a06e148221402791cabf9d5ab2bfcb629120ab136fee0a2994c0830f7cbfb112c5c6b07109b6a1a94

Download Submit
\Program Files (x86)\Microsoft\WaterMark.exe
Filesize
164KB

MD5
a3b1f1c4cd75bea10095e054f990bf1d

SHA1
15bf037b2166d2533e12bbec9f1d5f9a3ad8c81b

SHA256
a4c51942f696650a7ce0530a88c3742380ac82bc1ddc75c24d1417f0958caaee

SHA512
7457591c9676baa6043e4c3ae6ede364f19964c4e4e6a91a06e148221402791cabf9d5ab2bfcb629120ab136fee0a2994c0830f7cbfb112c5c6b07109b6a1a94

Download Submit
\Program Files (x86)\Microsoft\WaterMark.exe
Filesize
164KB

MD5
a3b1f1c4cd75bea10095e054f990bf1d

SHA1
15bf037b2166d2533e12bbec9f1d5f9a3ad8c81b

SHA256
a4c51942f696650a7ce0530a88c3742380ac82bc1ddc75c24d1417f0958caaee

SHA512
7457591c9676baa6043e4c3ae6ede364f19964c4e4e6a91a06e148221402791cabf9d5ab2bfcb629120ab136fee0a2994c0830f7cbfb112c5c6b07109b6a1a94

Download Submit
\Windows\SysWOW64\rundll32mgr.exe
Filesize
164KB

MD5
a3b1f1c4cd75bea10095e054f990bf1d

SHA1
15bf037b2166d2533e12bbec9f1d5f9a3ad8c81b

SHA256
a4c51942f696650a7ce0530a88c3742380ac82bc1ddc75c24d1417f0958caaee

SHA512
7457591c9676baa6043e4c3ae6ede364f19964c4e4e6a91a06e148221402791cabf9d5ab2bfcb629120ab136fee0a2994c0830f7cbfb112c5c6b07109b6a1a94

Download Submit
\Windows\SysWOW64\rundll32mgr.exe
Filesize
164KB

MD5
a3b1f1c4cd75bea10095e054f990bf1d

SHA1
15bf037b2166d2533e12bbec9f1d5f9a3ad8c81b

SHA256
a4c51942f696650a7ce0530a88c3742380ac82bc1ddc75c24d1417f0958caaee

SHA512
7457591c9676baa6043e4c3ae6ede364f19964c4e4e6a91a06e148221402791cabf9d5ab2bfcb629120ab136fee0a2994c0830f7cbfb112c5c6b07109b6a1a94

Download Submit
memory/560-94-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download
memory/560-93-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/560-89-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/560-80-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/560-95-0x0000000077CF0000-0x0000000077CF1000-memory.dmp

Filesize
4KB

Download
memory/560-96-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/560-97-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/560-98-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/560-99-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/1120-28-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/2568-76-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2568-54-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2568-484-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2568-63-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2568-71-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2568-68-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/2568-66-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2568-64-0x00000000000A0000-0x00000000000A1000-memory.dmp

Filesize
4KB

Download
memory/2568-56-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2692-16-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2692-18-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/2692-11-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2692-13-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2692-25-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2692-20-0x0000000002940000-0x00000000039CE000-memory.dmp

Filesize
16.6MB

Download
memory/2692-26-0x0000000002940000-0x00000000039CE000-memory.dmp

Filesize
16.6MB

Download
memory/2692-37-0x0000000000670000-0x00000000006A4000-memory.dmp

Filesize
208KB

Download
memory/2692-23-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2692-14-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2692-21-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2692-15-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2692-17-0x0000000002940000-0x00000000039CE000-memory.dmp

Filesize
16.6MB

Download
memory/2692-39-0x0000000000670000-0x00000000006A4000-memory.dmp

Filesize
208KB

Download
memory/2788-52-0x0000000077CEF000-0x0000000077CF0000-memory.dmp

Filesize
4KB

Download
memory/2788-78-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2788-50-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2788-51-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2788-191-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2788-42-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2908-10-0x0000000000180000-0x00000000001B4000-memory.dmp

Filesize
208KB

Download
memory/2908-8-0x0000000010000000-0x000000001008B000-memory.dmp

Filesize
556KB

Download
memory/2908-1-0x0000000010000000-0x000000001008B000-memory.dmp

Filesize
556KB

Download