Analysis

  • max time kernel
    122s
  • max time network
    131s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    30/03/2024, 00:28

General

  • Target

    2024-03-30_4ac5f59bf52689d7e4049c58976073c0_mafia_ramnit.exe

  • Size

    240KB

  • MD5

    4ac5f59bf52689d7e4049c58976073c0

  • SHA1

    29de74bf95deedb2a8880494c0b0e1ac710cc57f

  • SHA256

    d1ae2bf536d98cd937e819a098bb6eb7ba2af009dd5724563a6c03233e22885e

  • SHA512

    a81bd7f818a974b8b405d0e4d7c95111461400d53e8820cc5ba4a2b80519be4514635255bf819660c931810d0e4c26e81f2fadae7a63aae91d1547e519d68d36

  • SSDEEP

    6144:TY6Aw1tj3vHMeC6uZy1RfzNf69UGC5p76KXxGj6:2w1FRC5y1RfzNGU9B6KB

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • UPX dump on OEP (original entry point) 6 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • Program crash 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-30_4ac5f59bf52689d7e4049c58976073c0_mafia_ramnit.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-30_4ac5f59bf52689d7e4049c58976073c0_mafia_ramnit.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2356
    • C:\Users\Admin\AppData\Local\Temp\2024-03-30_4ac5f59bf52689d7e4049c58976073c0_mafia_ramnitSrv.exe
      C:\Users\Admin\AppData\Local\Temp\2024-03-30_4ac5f59bf52689d7e4049c58976073c0_mafia_ramnitSrv.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:2096
      • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
        "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3036
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2624
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2624 CREDAT:275457 /prefetch:2
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:2656
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 188
      2⤵
      • Program crash
      PID:2572

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          344B

          MD5

          6833edd309ffb29474acef998fc95064

          SHA1

          47ec918332e79358758ee179f5a1641d73765b58

          SHA256

          8db87ecf929e1f590e1d591a89214aa90ef42c1747008f43bfd45f3c9bffa097

          SHA512

          6744c61e26cc2239d46f538c03a4d01e3a275ede9a7edca657e776560a153757e0c17a3d6af648887ca033bf8026dd88ce5784257ebfbfc2810651bb69818635

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          344B

          MD5

          d202b3fcab2271cb345dff2f5da3cadd

          SHA1

          7239077e87ba4788cefa965286d8d6d316429414

          SHA256

          c6060ffd7bda3f3757523da0fddf1b5da63c40627e2d170562b27a2b095288f5

          SHA512

          d1c23eb3534552cde94756e05b11c76e716b59cf2c73cb058979d7207ff20294c504a04a99d9452d2dda0fdc4c9cef7ed234ec48638c7ad1f02453f95b5f560a

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          344B

          MD5

          772fc4f32e41f53e064bd3b80a708459

          SHA1

          b691c4c3b8740480c637af6002353b61cf41d812

          SHA256

          9895d10097357b50493f865e96468a9a6ef9626ea18d3fb872627042afcb5b31

          SHA512

          b768ef6da86f7c7ea77c24433f4f59b8a9a7426aef26b131622d63a419d2219facbac4c3c4447080c6c510ba1284fbe20527c02d8dfdeaa7ea56b9aead4be8ef

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          344B

          MD5

          e005ccec425d8b212ba56245548bef51

          SHA1

          0cfced8c4eadec314ca40dc32bf170092a5a329c

          SHA256

          011f5bba120b4a8168797a0a3d3a0933f13bf7e7f22fe29736d53f4754e422be

          SHA512

          1a3bcb24b3f937fefe30b69193b46ccf7086828be53fd0e72b35761823dccc7cdb9cf23f607e5f8c8cb09195a11cd9d0211d93fe5d9d8682a28f7084fe766474

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          344B

          MD5

          ecd8472c51bd65c1c130f8a388bd0a96

          SHA1

          77d298c0dedb8db42f1491b2be012402826df208

          SHA256

          7e1c3a3de82310f4466be7c329c27fe0872035e623ea9848c81b261ce060e5d5

          SHA512

          9dca140f54cb6a2ff056e60aa7cbf9fc95abf7f56d4b29914c0c52cc3bdee6156cedaebac403b64d7e1d12c839c48c470280476ff71e035437c9ebd0ed7dbc57

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          344B

          MD5

          03f8349f0f6ef490a8e82db44d8bd7c7

          SHA1

          20ed3cce67b193054272e8c535e76b83ae980b9b

          SHA256

          9ffe0e33fb2cdbc5db5388ae2383cd492d3d772ca36aa46379e874b3d41af315

          SHA512

          af87c75485f4677a79d2028f432423430203cfd850169e6f1be63ec1afa3095d007fec6153009f4211c75b639469e0b552324a60f1da9b6812bc12f9952bef0f

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          344B

          MD5

          c07cb75d5bfa87dce672a34b625fcc54

          SHA1

          d91539a4d4470b633c18cbe73e00b84a42914870

          SHA256

          a66423760279110685c2db7ff57db2f37f855feefa9bc8dec7a478abf75e5179

          SHA512

          e4a2fbe10abd4723fbbe34c92df5d19ac143d6fadf6559db38cc1e82ccc163e6a92945814a72e131071a2a732335d5fd8fb7e2c9069a4105738dfef940c53614

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          344B

          MD5

          73084660c553e96f1ec36068f7dcc5c8

          SHA1

          2da5be67b51e2c740ec454b1a990b2906f97d454

          SHA256

          bb904303cbc660c4868889533e110cfa31e6f00d4d8fec5f73e41d5c5c938fa7

          SHA512

          54c944df134608df83b23dc96fedf932e3032db246b55a9a088c68caa0a73cdedbb976ebc6e97a8045606eb2f35ca748decc756c98308cdf642f41e597fc3729

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          344B

          MD5

          3d7365b2bcdf41d19c26a0cc524fc101

          SHA1

          8b530e5b018db3412e6df799cb24d2abbab101d8

          SHA256

          e8c781106ad797c4de1c7f899f519ff003576dea0434ee30cc90a759e6513074

          SHA512

          71fa70ef59eaedfd669247645879c48923a43ffe39b907b7a4739d6f316c9f18d8a75f3bb71346998e91e3a8fc3ca1dd4d4dd59df442141a8afb251dbfa03cc8

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          344B

          MD5

          835939648508a16f9bcdefd61bd1c33e

          SHA1

          a924f8927025731ab70cb094265a6876da664ce7

          SHA256

          adbf403f1d60249e84657b15c394a7a1eb0f067cb5d1da8cd73742dc6b9ac39b

          SHA512

          b80bcb8cdc5b5be6412b5d584c25aee06cb84fdea3de491737e1a85c031b90629fd9a7f6c41c891a6890868ca5dc4c4ec187af173f1862090d6dc97be98be760

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          344B

          MD5

          bc4b99c5db0be56e15c33e42a1ebedc7

          SHA1

          cb5f0c082afea55a53d2f802c08bfc163bb2bc3b

          SHA256

          0dfaa6563b5ee42e45c0c44be6db16d491b5f32f6a5c55f15884be400cd5218a

          SHA512

          71eca0a6e400716bfc186d92b788e78166e668b16164b6c8304b6032310228473c355895162883fd4499924d1e6b7b21224738017cb347b88c64f537a59e8297

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          344B

          MD5

          aacc5a5b28684737d5d1bfbba8d045f2

          SHA1

          5990e64ca0bb64c3649591afb885bd05d04b564b

          SHA256

          10f30a08da2cdcc655a1e5baf9f88da4c313e0db6347febb97666ec7aefaa1d6

          SHA512

          beb42c248a577b80d51520ca899bae0e7fffb5cb8a63bec329f389d5cadde0a44ec7864c09894d850c135fa1164595615b1ef452d6e565a4835cd614de92b1b1

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          344B

          MD5

          fc062a7544e0f10581dd8f00ee44696e

          SHA1

          ebfd945607e5fde042bd62557c38d7891619b1f4

          SHA256

          f57b35a01cafc42bf3ba96310e6d8a5290cf9b6ad0e23b50be235437158a313b

          SHA512

          8cbe4cc3deb3526a7aa6563029cc6bca389e41249c439ff8ca6433eff1765d180cf80d3144447c46813ca9a7cac1a0d69fca7745e4c58244d9924c6af8581299

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          344B

          MD5

          1d17ff2120582ef9b44e55d67227aa20

          SHA1

          fe0e7a6de37b0b573c9f0597304864d8f94a375a

          SHA256

          f5b7ff09bbeb9dfd4027d6c60f30d7c3412463eeaa2527b647ae583237d9fdb8

          SHA512

          cc6712d85caae6ccfea2d9b26926e99c36a0e6558bb6f4c00136bca9baa4f4bd80131ef5d199f4d57a8c9e1e44b7c4799efa7432c412ac7068ca9795451bef7c

        • C:\Users\Admin\AppData\Local\Temp\Cab61F1.tmp

          Filesize

          65KB

          MD5

          ac05d27423a85adc1622c714f2cb6184

          SHA1

          b0fe2b1abddb97837ea0195be70ab2ff14d43198

          SHA256

          c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

          SHA512

          6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

        • C:\Users\Admin\AppData\Local\Temp\Cab62BE.tmp

          Filesize

          68KB

          MD5

          29f65ba8e88c063813cc50a4ea544e93

          SHA1

          05a7040d5c127e68c25d81cc51271ffb8bef3568

          SHA256

          1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

          SHA512

          e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

        • C:\Users\Admin\AppData\Local\Temp\Tar62D2.tmp

          Filesize

          177KB

          MD5

          435a9ac180383f9fa094131b173a2f7b

          SHA1

          76944ea657a9db94f9a4bef38f88c46ed4166983

          SHA256

          67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

          SHA512

          1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

        • \Users\Admin\AppData\Local\Temp\2024-03-30_4ac5f59bf52689d7e4049c58976073c0_mafia_ramnitSrv.exe

          Filesize

          55KB

          MD5

          ff5e1f27193ce51eec318714ef038bef

          SHA1

          b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

          SHA256

          fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

          SHA512

          c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

        • memory/2096-12-0x0000000000400000-0x000000000042E000-memory.dmp

          Filesize

          184KB

        • memory/2096-14-0x00000000003C0000-0x00000000003CF000-memory.dmp

          Filesize

          60KB

        • memory/2096-498-0x00000000003C0000-0x00000000003CF000-memory.dmp

          Filesize

          60KB

        • memory/2356-5-0x00000000000E0000-0x000000000010E000-memory.dmp

          Filesize

          184KB

        • memory/2356-0-0x0000000001130000-0x0000000001173000-memory.dmp

          Filesize

          268KB

        • memory/2356-497-0x00000000000E0000-0x000000000010E000-memory.dmp

          Filesize

          184KB

        • memory/2356-496-0x0000000001130000-0x0000000001173000-memory.dmp

          Filesize

          268KB

        • memory/2356-16-0x0000000000080000-0x0000000000081000-memory.dmp

          Filesize

          4KB

        • memory/3036-15-0x0000000000400000-0x000000000042E000-memory.dmp

          Filesize

          184KB

        • memory/3036-20-0x0000000077C2F000-0x0000000077C30000-memory.dmp

          Filesize

          4KB

        • memory/3036-19-0x0000000000400000-0x000000000042E000-memory.dmp

          Filesize

          184KB

        • memory/3036-18-0x0000000000240000-0x0000000000241000-memory.dmp

          Filesize

          4KB