Analysis

  • max time kernel
    122s
  • max time network
    135s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    07/01/2024, 19:37

General

  • Target

    a5a32a6ee05184ac6a06b8e2097900ab.exe

  • Size

    94KB

  • MD5

    a5a32a6ee05184ac6a06b8e2097900ab

  • SHA1

    0d48f3a10508b57fd85dc3dd00456f8737882e8e

  • SHA256

    3bbde22a359e87d031d57a749ffedbed03268f435ef4982a5421f3b0df19e380

  • SHA512

    81f5648541e826e7a54bfb1d058cf1ca7c3c92200675d74b48e4679ac5e1bcd92beaeb1bf9656ac3a4eda68cba0c9834686ece6b1559d5643e7cec0b1474bf65

  • SSDEEP

    768:tEzQE2+b7B1T4t7vI2NiN+U4ZmTX7CaKf+ibj55VTQ1RBkMoas0Qz3FGnuYoEq:t235b7vkmVN+1e3c+ibV561RBhoB1Eq

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Loads dropped DLL 2 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Program crash 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a5a32a6ee05184ac6a06b8e2097900ab.exe
    "C:\Users\Admin\AppData\Local\Temp\a5a32a6ee05184ac6a06b8e2097900ab.exe"
    1⤵
    • Loads dropped DLL
    PID:2152
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 100
      2⤵
      • Program crash
      PID:2744

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Users\Admin\AppData\Local\Temp\~TM6EF9.tmp

          Filesize

          1024KB

          MD5

          59f264ca492edb26629a7707c8f8dad2

          SHA1

          0a830790b930c73c7e5cee1e8ca5cbc764c1b845

          SHA256

          34e2e6f2a662292adf7d4673d86deae818902e3a6147be1ca62d2171f3a6f700

          SHA512

          47dae259c3dccc5f074ceacea6f502b52f6e348a6f735f1faba1c7f7e73da74869363b96800698e68c9ff0b254d9fc3dece79bfcbcd651d92571938385c3763f

        • memory/2152-0-0x0000000000400000-0x0000000000423000-memory.dmp

          Filesize

          140KB

        • memory/2152-3-0x0000000000400000-0x0000000000423000-memory.dmp

          Filesize

          140KB

        • memory/2152-2-0x00000000001B0000-0x00000000001D3000-memory.dmp

          Filesize

          140KB

        • memory/2152-6-0x00000000770AF000-0x00000000770B1000-memory.dmp

          Filesize

          8KB

        • memory/2152-8-0x00000000770B0000-0x00000000770B2000-memory.dmp

          Filesize

          8KB

        • memory/2152-7-0x00000000770B0000-0x00000000770B1000-memory.dmp

          Filesize

          4KB

        • memory/2152-12-0x0000000075D10000-0x0000000075E20000-memory.dmp

          Filesize

          1.1MB

        • memory/2152-14-0x0000000000400000-0x0000000000423000-memory.dmp

          Filesize

          140KB

        • memory/2152-15-0x0000000075D10000-0x0000000075E20000-memory.dmp

          Filesize

          1.1MB

        • memory/2152-13-0x0000000075D10000-0x0000000075E20000-memory.dmp

          Filesize

          1.1MB