Analysis
-
max time kernel
182s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
30-12-2023 01:18
General
-
Target
09d431e14c3e3ae3b41d14c6db558f19.exe
-
Size
60KB
-
MD5
09d431e14c3e3ae3b41d14c6db558f19
-
SHA1
c4407b5bf198498beb8245747696cf01a0f818d4
-
SHA256
5ca1d0fd1f4e7d980a1d1a8675c701595713af9e4da79ee579caac48837d4687
-
SHA512
679268ecd71af9aa1648cf6acf72d56d00002393e9cf7859e101c1b3f233465c3ee892ca2c0374ebafb556775f4e36437a374ebd2d4d6818adfad51e242159f1
-
SSDEEP
1536:/h8Zc0c2TXH53F/y8fnFZTd6Ue6IWVvmfYC+zyl+U8/6OJeq:58Zc0hTH53F/y0nzTd6UjIWVvn+of
Malware Config
Signatures
-
Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
-
Loads dropped DLL 1 IoCs
-
UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Program crash 1 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\09d431e14c3e3ae3b41d14c6db558f19.exe"C:\Users\Admin\AppData\Local\Temp\09d431e14c3e3ae3b41d14c6db558f19.exe"1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4628 -s 5802⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4628 -ip 46281⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD5d6bf489d3cede23b18babc82fffbe88f
SHA107137ba7295d82635e08e8abc43e1e06a3465a5f
SHA256338335891bf5070a3ac8c3e91ba53de2ccae9c1ee61f802cfa196e7fae6836c9
SHA51211e59e9ad7392d94809e67ce4eb390e928b96c352f13e201b6c5491c2c7efc53317a361f88f47473d5a63fe149c96e7ac5a6eacea2adc536b2c7ce487eb7edc2
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
4KB
-
Filesize
108KB
-
Filesize
108KB