Analysis

  • max time kernel
    119s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    25-12-2023 18:33

General

  • Target

    34d120d389a444956c622166d2d7aecc.exe

  • Size

    106KB

  • MD5

    34d120d389a444956c622166d2d7aecc

  • SHA1

    7d402c9b7c612dbec9906c736ef005d2ec923f00

  • SHA256

    9e4d46fc1754243f15e4b548a23231598770b077641f778512ff127a3f30761c

  • SHA512

    d3eb03a9899cdb9a5d909292d2af9b64b84ffdea0d3099fa9445ddde8639e6188357e04366a19531f3cc8d14237d499c8eafa1766e85179df112e2d3397e2498

  • SSDEEP

    1536:R+FDoKqniY1u7Nn2JFkC2styJjCKICFjC7EWisS+5mlatSfkZ:R+FDgK71QkbstyJjCKICpC72s/mlaX

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Loads dropped DLL 2 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Program crash 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs

Processes

  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2876 -s 136
    1⤵
    • Program crash
    PID:2804
  • C:\Users\Admin\AppData\Local\Temp\34d120d389a444956c622166d2d7aecc.exe
    "C:\Users\Admin\AppData\Local\Temp\34d120d389a444956c622166d2d7aecc.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of UnmapMainImage
    PID:2876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\~TMCEA5.tmp

    Filesize

    1KB

    MD5

    5c8db74feb53d8f661844895a129b3a6

    SHA1

    8aae2a816889c9331aacd0d02fb990c1f822597b

    SHA256

    63817fb6daf0b108c6ebcbaf68156610173b7ba9090fa3aad914225e07b5046b

    SHA512

    8bb0a48affedf8c7c9a2fdc7393a20bafd1fe259aa592c02249e65371fd9733b5945bbd422cb370cc98c8f493867adbdbc496e3aad983fd664f267ec909ec73b

  • \Users\Admin\AppData\Local\Temp\~TMCEF4.tmp

    Filesize

    5KB

    MD5

    1b565157b4c868c7a78b8abb7b11eb43

    SHA1

    e58105d08d7ad9a481e0a2d24b7501f365f7678a

    SHA256

    acb5f55a2a6431bdbbabd78d473df7c95265a594b30c322503799c8794710527

    SHA512

    500ab2abd6c7767e97a4322975248d3042b1aa7be60350c77a1b9210e3cf22afdeff9d9438fd2d104b9c5aefebe084cfcc0979d61d372b910c40a1a707049b7d

  • memory/2876-19-0x0000000076620000-0x0000000076730000-memory.dmp

    Filesize

    1.1MB

  • memory/2876-15-0x0000000077760000-0x0000000077762000-memory.dmp

    Filesize

    8KB

  • memory/2876-9-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2876-22-0x0000000076620000-0x0000000076730000-memory.dmp

    Filesize

    1.1MB

  • memory/2876-21-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2876-20-0x0000000076620000-0x0000000076730000-memory.dmp

    Filesize

    1.1MB

  • memory/2876-3-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2876-7-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2876-14-0x0000000077760000-0x0000000077761000-memory.dmp

    Filesize

    4KB

  • memory/2876-13-0x000000007775F000-0x0000000077761000-memory.dmp

    Filesize

    8KB

  • memory/2876-6-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2876-5-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2876-4-0x00000000003C0000-0x00000000003C1000-memory.dmp

    Filesize

    4KB

  • memory/2876-2-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2876-1-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2876-0-0x0000000000400000-0x0000000000431000-memory.dmp

    Filesize

    196KB