Analysis

  • max time kernel
    153s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    14/03/2024, 00:00

General

  • Target

    dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaff.exe

  • Size

    2.7MB

  • MD5

    f86ae0ab21191e40ccad928817144643

  • SHA1

    5ac604256f9e7c428cbda9b31b401f9715f44646

  • SHA256

    dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaff

  • SHA512

    807b4e5c831a1c3a5541edeee21b9281599c19d9fccbaa1f3004008ce544fb19edd39ab8a4a25748b2b14770f76895a8d1bf82e0cf2ac52ffbdc73d1a9be1ce3

  • SSDEEP

    49152:OkjRhlIBG6uH6x5Ipt8/AibVeARh2gtpyviyMqO2BwLJuwJCVhrwGaX:OmIIKO4HRjjv3KuMDFQ

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • UPX dump on OEP (original entry point) 3 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: MapViewOfSection 22 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\wininit.exe
    wininit.exe
    1⤵
      PID:364
      • C:\Windows\system32\services.exe
        C:\Windows\system32\services.exe
        2⤵
          PID:468
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k DcomLaunch
            3⤵
              PID:608
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k RPCSS
              3⤵
                PID:688
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
                3⤵
                  PID:736
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
                  3⤵
                    PID:824
                    • C:\Windows\system32\Dwm.exe
                      "C:\Windows\system32\Dwm.exe"
                      4⤵
                        PID:1196
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k netsvcs
                      3⤵
                        PID:860
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k LocalService
                        3⤵
                          PID:972
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k NetworkService
                          3⤵
                            PID:272
                          • C:\Windows\System32\spoolsv.exe
                            C:\Windows\System32\spoolsv.exe
                            3⤵
                              PID:1032
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
                              3⤵
                                PID:1084
                              • C:\Windows\system32\taskhost.exe
                                "taskhost.exe"
                                3⤵
                                  PID:1112
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
                                  3⤵
                                    PID:3044
                                  • C:\Windows\system32\sppsvc.exe
                                    C:\Windows\system32\sppsvc.exe
                                    3⤵
                                      PID:2984
                                  • C:\Windows\system32\lsass.exe
                                    C:\Windows\system32\lsass.exe
                                    2⤵
                                      PID:484
                                    • C:\Windows\system32\lsm.exe
                                      C:\Windows\system32\lsm.exe
                                      2⤵
                                        PID:492
                                    • C:\Windows\system32\csrss.exe
                                      %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
                                      1⤵
                                        PID:384
                                      • C:\Windows\system32\winlogon.exe
                                        winlogon.exe
                                        1⤵
                                          PID:424
                                        • C:\Windows\Explorer.EXE
                                          C:\Windows\Explorer.EXE
                                          1⤵
                                            PID:1224
                                            • C:\Users\Admin\AppData\Local\Temp\dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaff.exe
                                              "C:\Users\Admin\AppData\Local\Temp\dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaff.exe"
                                              2⤵
                                              • Loads dropped DLL
                                              • Drops file in System32 directory
                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                              • Suspicious use of AdjustPrivilegeToken
                                              • Suspicious use of SetWindowsHookEx
                                              • Suspicious use of WriteProcessMemory
                                              PID:3060
                                              • C:\Users\Admin\AppData\Local\Temp\dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe
                                                C:\Users\Admin\AppData\Local\Temp\dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe
                                                3⤵
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious behavior: MapViewOfSection
                                                • Suspicious use of AdjustPrivilegeToken
                                                • Suspicious use of WriteProcessMemory
                                                PID:2628
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 284
                                                3⤵
                                                • Executes dropped EXE
                                                • Program crash
                                                PID:2848

                                          Network

                                                MITRE ATT&CK Matrix

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads

                                                • C:\Windows\SysWOW64\WerFault.exe

                                                  Filesize

                                                  352KB

                                                  MD5

                                                  5feab868caedbbd1b7a145ca8261e4aa

                                                  SHA1

                                                  f43f28cc5165608e6fb3794e9a3d083ca2c75f0e

                                                  SHA256

                                                  08bace187a0225e10677de9aa6738a7118be3e5cad6dc45fb8d3366a61bb343c

                                                  SHA512

                                                  91108ab6dd422c1d500fc0a65df6faffdb7000828a0f908b1c053129b4b8702fdb7309fa3f4f6054ad542dfe24fd4853e2fe32f7e45aa369e7a3cb6137bdaca1

                                                • \Users\Admin\AppData\Local\Temp\dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe

                                                  Filesize

                                                  240KB

                                                  MD5

                                                  410283e841c8970b5945702fde8f7e72

                                                  SHA1

                                                  8fcf50336f1a2aeefc5edcf7875ffa5cadc361e4

                                                  SHA256

                                                  cf60207e00045ed560e7580ef9223344cea11b94d4e96adafc84c0ae66152446

                                                  SHA512

                                                  4368074c54fe0dc6c54f7d3342e195f79fc0262ca7918b95b3fc459c98f4267058b60cea7a9cb1843c09794ac8d5a7703d977c7b205715aaa0d5ec5219788933

                                                • \Users\Admin\AppData\Local\Temp\~TM8D51.tmp

                                                  Filesize

                                                  1.2MB

                                                  MD5

                                                  d124f55b9393c976963407dff51ffa79

                                                  SHA1

                                                  2c7bbedd79791bfb866898c85b504186db610b5d

                                                  SHA256

                                                  ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef

                                                  SHA512

                                                  278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06

                                                • \Users\Admin\AppData\Local\Temp\~TM8E5C.tmp

                                                  Filesize

                                                  1.1MB

                                                  MD5

                                                  9b98d47916ead4f69ef51b56b0c2323c

                                                  SHA1

                                                  290a80b4ded0efc0fd00816f373fcea81a521330

                                                  SHA256

                                                  96e0ae104c9662d0d20fdf59844c2d18334e5847b6c4fc7f8ce4b3b87f39887b

                                                  SHA512

                                                  68b67021f228d8d71df4deb0b6388558b2f935a6aa466a12199cd37ada47ee588ea407b278d190d3a498b0ef3f5f1a2573a469b7ea5561ab2e7055c45565fe94

                                                • memory/2628-15-0x000000007799F000-0x00000000779A0000-memory.dmp

                                                  Filesize

                                                  4KB

                                                • memory/2628-36-0x0000000076BD0000-0x0000000076CE0000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/2628-13-0x00000000779A0000-0x00000000779A1000-memory.dmp

                                                  Filesize

                                                  4KB

                                                • memory/2628-32-0x0000000000240000-0x0000000000241000-memory.dmp

                                                  Filesize

                                                  4KB

                                                • memory/2628-16-0x0000000000400000-0x000000000043F000-memory.dmp

                                                  Filesize

                                                  252KB

                                                • memory/2628-34-0x00000000779A1000-0x00000000779A2000-memory.dmp

                                                  Filesize

                                                  4KB

                                                • memory/2628-18-0x0000000000320000-0x000000000035F000-memory.dmp

                                                  Filesize

                                                  252KB

                                                • memory/2628-35-0x0000000000400000-0x000000000043F000-memory.dmp

                                                  Filesize

                                                  252KB

                                                • memory/2628-11-0x0000000000400000-0x000000000043F000-memory.dmp

                                                  Filesize

                                                  252KB

                                                • memory/2628-33-0x0000000076BD0000-0x0000000076CE0000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/2628-31-0x0000000076BD0000-0x0000000076CE0000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/2628-25-0x000000007799F000-0x00000000779A1000-memory.dmp

                                                  Filesize

                                                  8KB

                                                • memory/2628-27-0x00000000779A0000-0x00000000779A1000-memory.dmp

                                                  Filesize

                                                  4KB

                                                • memory/2628-28-0x00000000779A0000-0x00000000779A2000-memory.dmp

                                                  Filesize

                                                  8KB

                                                • memory/2848-22-0x000000007EFA0000-0x000000007EFAC000-memory.dmp

                                                  Filesize

                                                  48KB

                                                • memory/3060-1-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

                                                  Filesize

                                                  3.8MB

                                                • memory/3060-5-0x0000000000E60000-0x0000000000E9F000-memory.dmp

                                                  Filesize

                                                  252KB

                                                • memory/3060-20-0x000000007EBC0000-0x000000007EBCC000-memory.dmp

                                                  Filesize

                                                  48KB

                                                • memory/3060-19-0x00000000779A0000-0x00000000779A1000-memory.dmp

                                                  Filesize

                                                  4KB

                                                • memory/3060-12-0x0000000000E60000-0x0000000000E9F000-memory.dmp

                                                  Filesize

                                                  252KB

                                                • memory/3060-17-0x000000007799F000-0x00000000779A0000-memory.dmp

                                                  Filesize

                                                  4KB

                                                • memory/3060-0-0x0000000000400000-0x0000000000E54000-memory.dmp

                                                  Filesize

                                                  10.3MB

                                                • memory/3060-37-0x0000000000400000-0x0000000000E54000-memory.dmp

                                                  Filesize

                                                  10.3MB

                                                • memory/3060-38-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

                                                  Filesize

                                                  3.8MB

                                                • memory/3060-40-0x000000007EBC0000-0x000000007EBCC000-memory.dmp

                                                  Filesize

                                                  48KB