Analysis
-
max time kernel
179s -
max time network
449s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
25/12/2023, 18:33
General
-
Target
34d120d389a444956c622166d2d7aecc.exe
-
Size
106KB
-
MD5
34d120d389a444956c622166d2d7aecc
-
SHA1
7d402c9b7c612dbec9906c736ef005d2ec923f00
-
SHA256
9e4d46fc1754243f15e4b548a23231598770b077641f778512ff127a3f30761c
-
SHA512
d3eb03a9899cdb9a5d909292d2af9b64b84ffdea0d3099fa9445ddde8639e6188357e04366a19531f3cc8d14237d499c8eafa1766e85179df112e2d3397e2498
-
SSDEEP
1536:R+FDoKqniY1u7Nn2JFkC2styJjCKICFjC7EWisS+5mlatSfkZ:R+FDgK71QkbstyJjCKICpC72s/mlaX
Malware Config
Signatures
-
Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
-
Loads dropped DLL 1 IoCs
-
UPX packed file 9 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Program crash 1 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\34d120d389a444956c622166d2d7aecc.exe"C:\Users\Admin\AppData\Local\Temp\34d120d389a444956c622166d2d7aecc.exe"1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4052 -s 4402⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4052 -ip 40521⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
773KB
MD5b0340987c977b76c922a9d81d18b0cdf
SHA15611a46ceee3c7e0b363f5f33a86c8a59a7445d5
SHA256510c754f55139977305e9145ac80357eec525b1cd5f07c4a5701fe067ed856a0
SHA51228768d88ae8a66e55d67c9660df3dbf3a11ec7f1d1e1f2aabbcd4221e66055a0c1c864a9426a749c97d4dae44ab01d6b6f4ca3ea40abc204b2d84d79f0e2936d
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
196KB
-
Filesize
4KB
-
Filesize
168KB
-
Filesize
196KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
196KB
-
Filesize
196KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
196KB