General

  • Target

    c33e7ed929760020820e8808289c240e

  • Size

    137KB

  • Sample

    240312-nkngjsfg2v

  • MD5

    c33e7ed929760020820e8808289c240e

  • SHA1

    f80ad9fe901f6202458daa5dc1a69a9267047c30

  • SHA256

    2aa23be9dc781c96f2b6b49c0c64f28fed2904c732ad8c3a70017fbac1b1f381

  • SHA512

    549504e94f098661268f1179c4611d278196fb0e139ecca31303aca0519909d8fc80f5c87145ccb362ef3a151343c8e8970d9fd5f2563972e02dd0d7ca8886a5

  • SSDEEP

    3072:KjbKvUBiR3s5j1dUM75P5lquVcGPflJ0oyai39dT5v:KicgFKjUMFnqu+0flJt2

Malware Config

Targets

    • Target

      c33e7ed929760020820e8808289c240e

    • Size

      137KB

    • MD5

      c33e7ed929760020820e8808289c240e

    • SHA1

      f80ad9fe901f6202458daa5dc1a69a9267047c30

    • SHA256

      2aa23be9dc781c96f2b6b49c0c64f28fed2904c732ad8c3a70017fbac1b1f381

    • SHA512

      549504e94f098661268f1179c4611d278196fb0e139ecca31303aca0519909d8fc80f5c87145ccb362ef3a151343c8e8970d9fd5f2563972e02dd0d7ca8886a5

    • SSDEEP

      3072:KjbKvUBiR3s5j1dUM75P5lquVcGPflJ0oyai39dT5v:KicgFKjUMFnqu+0flJt2

    • Modifies WinLogon for persistence

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

    • UAC bypass

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks