Analysis

  • max time kernel
    149s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    14/03/2024, 14:08

General

  • Target

    c8ce4c8f369ecd6d09a8a6b6a6ab4036.exe

  • Size

    328KB

  • MD5

    c8ce4c8f369ecd6d09a8a6b6a6ab4036

  • SHA1

    d57d709bfac190fe1d9f534276807f9a7fb7e80d

  • SHA256

    26d02628a31361a685324ba26749014c99f2895e65bc78b49358482a5fffb4b2

  • SHA512

    40c121b4545dfe70461783780934e6e084ced34164db0544db4595a7fa3c16b944c94b0323e787934e85894783698dbf0816e404effb5bdb9e4b108054b1e209

  • SSDEEP

    6144:BEc828Ea8XDd6GaYDkakxmZQmCkAyYZ9T:BEc8ARz8YDGxm6D5hD

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • UAC bypass 3 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 7 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c8ce4c8f369ecd6d09a8a6b6a6ab4036.exe
    "C:\Users\Admin\AppData\Local\Temp\c8ce4c8f369ecd6d09a8a6b6a6ab4036.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:2352
    • C:\Users\Admin\AppData\Local\Temp\c8ce4c8f369ecd6d09a8a6b6a6ab4036mgr.exe
      C:\Users\Admin\AppData\Local\Temp\c8ce4c8f369ecd6d09a8a6b6a6ab4036mgr.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2192
      • C:\Windows\SysWOW64\svchost.exe
        C:\Windows\system32\svchost.exe
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1704
      • C:\Windows\SysWOW64\svchost.exe
        C:\Windows\system32\svchost.exe
        3⤵
        • Modifies WinLogon for persistence
        • UAC bypass
        • Checks BIOS information in registry
        • Drops startup file
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2124
      • C:\Users\Admin\AppData\Local\Temp\kowtrkqakarvnhae.exe
        "C:\Users\Admin\AppData\Local\Temp\kowtrkqakarvnhae.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2696
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2352 -s 268
      2⤵
      • Program crash
      PID:2548

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\c8ce4c8f369ecd6d09a8a6b6a6ab4036mgr.exe

          Filesize

          107KB

          MD5

          81fb76285084bad225824705f6865a94

          SHA1

          cb36881ed931102f3f86ebf309069f608f17dc7e

          SHA256

          5f1c8013050932e6b70197fbc2216884639ad52d5a9d56a04fffc2408cf43b8b

          SHA512

          acc66f0dad718609d305f83b6e4ef374a4c3409ae0bb81bc4adea129c19b9259c2dc47796853ad906c96aba33de9fa9fa00a8628f2aca0d3e28cec5d767ced64

        • memory/1704-28-0x0000000000080000-0x0000000000081000-memory.dmp

          Filesize

          4KB

        • memory/1704-40-0x0000000000090000-0x0000000000091000-memory.dmp

          Filesize

          4KB

        • memory/1704-36-0x00000000000A0000-0x00000000000A1000-memory.dmp

          Filesize

          4KB

        • memory/1704-38-0x0000000000080000-0x0000000000081000-memory.dmp

          Filesize

          4KB

        • memory/1704-39-0x0000000020010000-0x000000002001B000-memory.dmp

          Filesize

          44KB

        • memory/1704-37-0x0000000020010000-0x000000002001B000-memory.dmp

          Filesize

          44KB

        • memory/1704-32-0x0000000020010000-0x000000002001B000-memory.dmp

          Filesize

          44KB

        • memory/1704-26-0x0000000020010000-0x000000002001B000-memory.dmp

          Filesize

          44KB

        • memory/2124-74-0x0000000020010000-0x0000000020023000-memory.dmp

          Filesize

          76KB

        • memory/2124-72-0x0000000020010000-0x0000000020023000-memory.dmp

          Filesize

          76KB

        • memory/2124-119-0x0000000020010000-0x0000000020023000-memory.dmp

          Filesize

          76KB

        • memory/2124-110-0x0000000020010000-0x0000000020023000-memory.dmp

          Filesize

          76KB

        • memory/2124-111-0x0000000020010000-0x0000000020023000-memory.dmp

          Filesize

          76KB

        • memory/2124-112-0x0000000020010000-0x0000000020023000-memory.dmp

          Filesize

          76KB

        • memory/2124-113-0x0000000020010000-0x0000000020023000-memory.dmp

          Filesize

          76KB

        • memory/2124-43-0x0000000020010000-0x0000000020023000-memory.dmp

          Filesize

          76KB

        • memory/2124-49-0x0000000020010000-0x0000000020023000-memory.dmp

          Filesize

          76KB

        • memory/2124-58-0x0000000020010000-0x0000000020023000-memory.dmp

          Filesize

          76KB

        • memory/2124-59-0x0000000020010000-0x0000000020023000-memory.dmp

          Filesize

          76KB

        • memory/2124-66-0x0000000020010000-0x0000000020023000-memory.dmp

          Filesize

          76KB

        • memory/2124-67-0x0000000020010000-0x0000000020023000-memory.dmp

          Filesize

          76KB

        • memory/2124-68-0x0000000020010000-0x0000000020023000-memory.dmp

          Filesize

          76KB

        • memory/2124-69-0x0000000020010000-0x0000000020023000-memory.dmp

          Filesize

          76KB

        • memory/2124-70-0x0000000020010000-0x0000000020023000-memory.dmp

          Filesize

          76KB

        • memory/2124-71-0x0000000020010000-0x0000000020023000-memory.dmp

          Filesize

          76KB

        • memory/2124-114-0x0000000020010000-0x0000000020023000-memory.dmp

          Filesize

          76KB

        • memory/2124-73-0x0000000020010000-0x0000000020023000-memory.dmp

          Filesize

          76KB

        • memory/2124-115-0x0000000020010000-0x0000000020023000-memory.dmp

          Filesize

          76KB

        • memory/2124-75-0x0000000020010000-0x0000000020023000-memory.dmp

          Filesize

          76KB

        • memory/2124-116-0x0000000020010000-0x0000000020023000-memory.dmp

          Filesize

          76KB

        • memory/2124-118-0x0000000020010000-0x0000000020023000-memory.dmp

          Filesize

          76KB

        • memory/2124-117-0x0000000020010000-0x0000000020023000-memory.dmp

          Filesize

          76KB

        • memory/2192-78-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/2192-12-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/2192-108-0x00000000024C0000-0x00000000024FE000-memory.dmp

          Filesize

          248KB

        • memory/2192-18-0x0000000000280000-0x0000000000281000-memory.dmp

          Filesize

          4KB

        • memory/2192-15-0x0000000000220000-0x0000000000226000-memory.dmp

          Filesize

          24KB

        • memory/2192-87-0x00000000024C0000-0x00000000024FE000-memory.dmp

          Filesize

          248KB

        • memory/2192-88-0x0000000000220000-0x0000000000226000-memory.dmp

          Filesize

          24KB

        • memory/2192-90-0x00000000024C0000-0x00000000024FE000-memory.dmp

          Filesize

          248KB

        • memory/2192-98-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/2192-101-0x00000000024C0000-0x00000000024FE000-memory.dmp

          Filesize

          248KB

        • memory/2192-19-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/2192-21-0x0000000077B6F000-0x0000000077B70000-memory.dmp

          Filesize

          4KB

        • memory/2352-0-0x0000000000400000-0x000000000049A000-memory.dmp

          Filesize

          616KB

        • memory/2352-79-0x0000000000270000-0x0000000000271000-memory.dmp

          Filesize

          4KB

        • memory/2352-76-0x0000000000230000-0x000000000026E000-memory.dmp

          Filesize

          248KB

        • memory/2352-77-0x0000000000230000-0x000000000024B000-memory.dmp

          Filesize

          108KB

        • memory/2352-14-0x0000000000400000-0x000000000049A000-memory.dmp

          Filesize

          616KB

        • memory/2352-13-0x0000000000270000-0x0000000000271000-memory.dmp

          Filesize

          4KB

        • memory/2352-10-0x0000000000230000-0x000000000026E000-memory.dmp

          Filesize

          248KB

        • memory/2352-11-0x0000000000230000-0x000000000024B000-memory.dmp

          Filesize

          108KB

        • memory/2352-8-0x0000000000400000-0x000000000049A000-memory.dmp

          Filesize

          616KB

        • memory/2696-104-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/2696-105-0x0000000000220000-0x0000000000226000-memory.dmp

          Filesize

          24KB