Analysis
- max time kernel
144s - max time network
179s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
27/03/2024, 01:20
General
- Target e06e284c5e6ce9f790803adb6ac64564.exe
- Size 96KB
- Sample240327-bqds3sgh46
- SHA256 204e6ed6bd6c8cd7d850b5f651baf98d092c77c726081aecf3623e95ebaf5b57
Malware Config
Signatures
- Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
- Loads dropped DLL 1 IoCs
- UPX packed file 9 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Program crash 1 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e06e284c5e6ce9f790803adb6ac64564.exe"C:\Users\Admin\AppData\Local\Temp\e06e284c5e6ce9f790803adb6ac64564.exe"1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 872 -s 3802⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 872 -ip 8721⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
~TMA7B.tmp
memory/872-6-0x0000000000400000-0x0000000000425000-memory.dmp
memory/872-2-0x0000000000400000-0x0000000000425000-memory.dmp
memory/872-3-0x0000000000400000-0x0000000000425000-memory.dmp
memory/872-4-0x0000000000400000-0x0000000000425000-memory.dmp
memory/872-5-0x00000000006B0000-0x00000000006B1000-memory.dmp
memory/872-0-0x0000000000400000-0x0000000000426000-memory.dmp
memory/872-8-0x0000000000400000-0x0000000000425000-memory.dmp
memory/872-7-0x0000000000400000-0x0000000000425000-memory.dmp
memory/872-10-0x0000000000400000-0x0000000000425000-memory.dmp
memory/872-11-0x0000000000400000-0x0000000000425000-memory.dmp
memory/872-1-0x0000000000400000-0x0000000000425000-memory.dmp
memory/872-15-0x0000000077862000-0x0000000077864000-memory.dmp
memory/872-16-0x0000000077862000-0x0000000077863000-memory.dmp