Analysis

  • max time kernel
    147s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/01/2024, 19:37

General

  • Target

    a5a32a6ee05184ac6a06b8e2097900ab.exe

  • Size

    94KB

  • MD5

    a5a32a6ee05184ac6a06b8e2097900ab

  • SHA1

    0d48f3a10508b57fd85dc3dd00456f8737882e8e

  • SHA256

    3bbde22a359e87d031d57a749ffedbed03268f435ef4982a5421f3b0df19e380

  • SHA512

    81f5648541e826e7a54bfb1d058cf1ca7c3c92200675d74b48e4679ac5e1bcd92beaeb1bf9656ac3a4eda68cba0c9834686ece6b1559d5643e7cec0b1474bf65

  • SSDEEP

    768:tEzQE2+b7B1T4t7vI2NiN+U4ZmTX7CaKf+ibj55VTQ1RBkMoas0Qz3FGnuYoEq:t235b7vkmVN+1e3c+ibV561RBhoB1Eq

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Loads dropped DLL 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Program crash 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a5a32a6ee05184ac6a06b8e2097900ab.exe
    "C:\Users\Admin\AppData\Local\Temp\a5a32a6ee05184ac6a06b8e2097900ab.exe"
    1⤵
    • Loads dropped DLL
    PID:4980
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 280
      2⤵
      • Program crash
      PID:5068
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4980 -ip 4980
    1⤵
      PID:920

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/4980-0-0x0000000000400000-0x0000000000423000-memory.dmp

            Filesize

            140KB

          • memory/4980-7-0x00000000778C2000-0x00000000778C3000-memory.dmp

            Filesize

            4KB

          • memory/4980-6-0x00000000778C2000-0x00000000778C4000-memory.dmp

            Filesize

            8KB

          • memory/4980-2-0x0000000002050000-0x0000000002073000-memory.dmp

            Filesize

            140KB

          • memory/4980-1-0x0000000000400000-0x0000000000423000-memory.dmp

            Filesize

            140KB

          • memory/4980-9-0x0000000002050000-0x0000000002073000-memory.dmp

            Filesize

            140KB

          • memory/4980-8-0x0000000000400000-0x0000000000423000-memory.dmp

            Filesize

            140KB