Analysis

  • max time kernel
    121s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    13/03/2024, 21:14

General

  • Target

    c6df6db86848b6dfbec4c5f9a5c1af6a.exe

  • Size

    94KB

  • MD5

    c6df6db86848b6dfbec4c5f9a5c1af6a

  • SHA1

    34cf93187f537912be517b86407709e490edd724

  • SHA256

    f8ad91e33550a18cae428560519f1ad1549784e91dc11f5a6587cda5b4ff53e2

  • SHA512

    d80648ef45dca33731a64b749088b6e91bf478bbd943aaf64beee13bfc08e93a1d40ec62037a2f50a1a5dc38c5e04c313eebd5231a8cbba94d235ff18bc8a81c

  • SSDEEP

    768:EEzQE2+b7B1T4t7vI2NiN+U4ZmTX7CaKf+ibj55VTQ1RBkMoas0Qz3FGnuYoEq:E235b7vkmVN+1e3c+ibV561RBhoB1Eq

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Loads dropped DLL 2 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Program crash 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c6df6db86848b6dfbec4c5f9a5c1af6a.exe
    "C:\Users\Admin\AppData\Local\Temp\c6df6db86848b6dfbec4c5f9a5c1af6a.exe"
    1⤵
    • Loads dropped DLL
    PID:1504
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 100
      2⤵
      • Program crash
      PID:2076

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Users\Admin\AppData\Local\Temp\~TM4D74.tmp

          Filesize

          1.2MB

          MD5

          d124f55b9393c976963407dff51ffa79

          SHA1

          2c7bbedd79791bfb866898c85b504186db610b5d

          SHA256

          ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef

          SHA512

          278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06

        • \Users\Admin\AppData\Local\Temp\~TM4DD3.tmp

          Filesize

          1.1MB

          MD5

          9b98d47916ead4f69ef51b56b0c2323c

          SHA1

          290a80b4ded0efc0fd00816f373fcea81a521330

          SHA256

          96e0ae104c9662d0d20fdf59844c2d18334e5847b6c4fc7f8ce4b3b87f39887b

          SHA512

          68b67021f228d8d71df4deb0b6388558b2f935a6aa466a12199cd37ada47ee588ea407b278d190d3a498b0ef3f5f1a2573a469b7ea5561ab2e7055c45565fe94

        • memory/1504-1-0x0000000000230000-0x0000000000253000-memory.dmp

          Filesize

          140KB

        • memory/1504-0-0x0000000000400000-0x0000000000423000-memory.dmp

          Filesize

          140KB

        • memory/1504-2-0x0000000000400000-0x0000000000423000-memory.dmp

          Filesize

          140KB

        • memory/1504-7-0x0000000076EFF000-0x0000000076F01000-memory.dmp

          Filesize

          8KB

        • memory/1504-11-0x0000000076F00000-0x0000000076F01000-memory.dmp

          Filesize

          4KB

        • memory/1504-12-0x0000000076F00000-0x0000000076F02000-memory.dmp

          Filesize

          8KB

        • memory/1504-14-0x0000000076130000-0x0000000076240000-memory.dmp

          Filesize

          1.1MB

        • memory/1504-13-0x0000000076130000-0x0000000076240000-memory.dmp

          Filesize

          1.1MB

        • memory/1504-10-0x0000000000400000-0x0000000000423000-memory.dmp

          Filesize

          140KB

        • memory/1504-15-0x0000000076130000-0x0000000076240000-memory.dmp

          Filesize

          1.1MB