Analysis

  • max time kernel
    115s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/03/2024, 00:28

General

  • Target

    2024-03-30_4ac5f59bf52689d7e4049c58976073c0_mafia_ramnit.exe

  • Size

    240KB

  • MD5

    4ac5f59bf52689d7e4049c58976073c0

  • SHA1

    29de74bf95deedb2a8880494c0b0e1ac710cc57f

  • SHA256

    d1ae2bf536d98cd937e819a098bb6eb7ba2af009dd5724563a6c03233e22885e

  • SHA512

    a81bd7f818a974b8b405d0e4d7c95111461400d53e8820cc5ba4a2b80519be4514635255bf819660c931810d0e4c26e81f2fadae7a63aae91d1547e519d68d36

  • SSDEEP

    6144:TY6Aw1tj3vHMeC6uZy1RfzNf69UGC5p76KXxGj6:2w1FRC5y1RfzNGU9B6KB

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • UPX dump on OEP (original entry point) 6 IoCs
  • Executes dropped EXE 2 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • Program crash 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 30 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-30_4ac5f59bf52689d7e4049c58976073c0_mafia_ramnit.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-30_4ac5f59bf52689d7e4049c58976073c0_mafia_ramnit.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4912
    • C:\Users\Admin\AppData\Local\Temp\2024-03-30_4ac5f59bf52689d7e4049c58976073c0_mafia_ramnitSrv.exe
      C:\Users\Admin\AppData\Local\Temp\2024-03-30_4ac5f59bf52689d7e4049c58976073c0_mafia_ramnitSrv.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:432
      • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
        "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3488
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3944
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3944 CREDAT:17410 /prefetch:2
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:212
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4912 -s 496
      2⤵
      • Program crash
      PID:960
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4912 -ip 4912
    1⤵
      PID:3816
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4372 --field-trial-handle=3488,i,1267426273081718772,6254127258555406296,262144 --variations-seed-version /prefetch:8
      1⤵
        PID:5064

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

              Filesize

              471B

              MD5

              83b49b2e7134c3062b8085920426bfb3

              SHA1

              b4cf85a34739004f8c250efa1c3b021c19830c85

              SHA256

              1cd035d5b63a191de0e8853548025d785dcd928e3049dec5642009391f5befcc

              SHA512

              a7d8db600b83ae679a8b03a677259b5746d883bfd131f09859447c0400835536297b3ed6419a44e961aff996dc5536b55d340399ebacca3be3ba4b8b19781d4e

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

              Filesize

              404B

              MD5

              3c2d836f3b970ffd159449e622defacf

              SHA1

              d9e8ef57535a08a3d7216af00444577b997090f7

              SHA256

              b79407a74548fd3906d927d6b62916c0e742efe456d9c5555e86d8f4a20af829

              SHA512

              1613464ee51104679d0c1d6135e40efeca8c5765eda05625dada76d1b7c5b1481113ad9ef998aeab5611a3b8ff55c87fd3ffae74319acab25e468c01057a6fdf

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\CCR56MZ5\suggestions[1].en-US

              Filesize

              17KB

              MD5

              5a34cb996293fde2cb7a4ac89587393a

              SHA1

              3c96c993500690d1a77873cd62bc639b3a10653f

              SHA256

              c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

              SHA512

              e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

            • C:\Users\Admin\AppData\Local\Temp\2024-03-30_4ac5f59bf52689d7e4049c58976073c0_mafia_ramnitSrv.exe

              Filesize

              55KB

              MD5

              ff5e1f27193ce51eec318714ef038bef

              SHA1

              b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

              SHA256

              fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

              SHA512

              c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

            • memory/432-4-0x0000000000400000-0x000000000042E000-memory.dmp

              Filesize

              184KB

            • memory/432-7-0x0000000000590000-0x000000000059F000-memory.dmp

              Filesize

              60KB

            • memory/432-9-0x0000000000400000-0x000000000042E000-memory.dmp

              Filesize

              184KB

            • memory/3488-15-0x0000000000400000-0x000000000042E000-memory.dmp

              Filesize

              184KB

            • memory/3488-18-0x0000000077202000-0x0000000077203000-memory.dmp

              Filesize

              4KB

            • memory/3488-16-0x0000000000400000-0x000000000042E000-memory.dmp

              Filesize

              184KB

            • memory/3488-14-0x0000000000570000-0x0000000000571000-memory.dmp

              Filesize

              4KB

            • memory/4912-12-0x0000000002E40000-0x0000000002E41000-memory.dmp

              Filesize

              4KB

            • memory/4912-19-0x0000000000D10000-0x0000000000D53000-memory.dmp

              Filesize

              268KB

            • memory/4912-0-0x0000000000D10000-0x0000000000D53000-memory.dmp

              Filesize

              268KB