ramnit | d535a0124949096793a4ca37a90d901f855e0da09ed7f96f174eb556d4e7bc04

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 03:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d535a0124949096793a4ca37a90d901f855e0da09ed7f96f174eb556d4e7bc04.exe
Size 126KB
Sample240418-dnd26shd52
SHA256 d535a0124949096793a4ca37a90d901f855e0da09ed7f96f174eb556d4e7bc04
MD5 5a44b598cd3bf64c86e1a32ea8b22c87
SHA1 b6a6494da713568c75f5dff448f6d377625591ff
SHA512 c9e21d536559bc1998e4354cae78a304807954c141d026ff770d167bc01df4c75ca774d15473eb31b54f055f1cb7158c2c73ff24cf37b3ce082ab1bae3f6a789
SSDEEP 3072:zLftffjmNvcAVI2IaNGAGP1OYg6vTzuVo9Wil:fVfjmNvjSzP1O12w
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Executes dropped EXE 4 IoCs

pid	Process
1428	Logo1_.exe
3380	d535a0124949096793a4ca37a90d901f855e0da09ed7f96f174eb556d4e7bc04.exe
2460	d535a0124949096793a4ca37a90d901f855e0da09ed7f96f174eb556d4e7bc04Srv.exe
5008	DesktopLayer.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0008000000023409-21.dat	upx
behavioral2/memory/2460-22-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral2/memory/2460-25-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral2/memory/5008-33-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral2/memory/5008-35-0x0000000000400000-0x000000000042E000-memory.dmp	upx

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.27323.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\Autogen\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\eu-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sw\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Multimedia Platform\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Images\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\root\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\en-us\View3d\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\en-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ca-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\people\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hu-hu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ff\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\sk-SK\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Voices\beeps\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\SIGNUP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\plugin2\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\swiftshader\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\Autogen\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sl-sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_2019.807.41.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.1813.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nb-no\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\eu-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\he\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\PhotosApp\Assets\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ar-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\contrast-high\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\Retail\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	d535a0124949096793a4ca37a90d901f855e0da09ed7f96f174eb556d4e7bc04.exe
File created	C:\Windows\Logo1_.exe	d535a0124949096793a4ca37a90d901f855e0da09ed7f96f174eb556d4e7bc04.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Modifies Internet Explorer settings 1 TTPs 30 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31101245"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3575416028"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3570260040"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31101245"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3570415547"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31101245"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420174714"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{006DD354-FD31-11EE-8A9B-FEF12A1805AF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
1428	Logo1_.exe
1428	Logo1_.exe
1428	Logo1_.exe
1428	Logo1_.exe
1428	Logo1_.exe
1428	Logo1_.exe
1428	Logo1_.exe
1428	Logo1_.exe
1428	Logo1_.exe
1428	Logo1_.exe
1428	Logo1_.exe
1428	Logo1_.exe
5008	DesktopLayer.exe
5008	DesktopLayer.exe
5008	DesktopLayer.exe
5008	DesktopLayer.exe
5008	DesktopLayer.exe
5008	DesktopLayer.exe
5008	DesktopLayer.exe
5008	DesktopLayer.exe
1428	Logo1_.exe
1428	Logo1_.exe
1428	Logo1_.exe
1428	Logo1_.exe
1428	Logo1_.exe
1428	Logo1_.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2540	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2540	iexplore.exe
2540	iexplore.exe
3304	IEXPLORE.EXE
3304	IEXPLORE.EXE
3304	IEXPLORE.EXE
3304	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 1316	1852	d535a0124949096793a4ca37a90d901f855e0da09ed7f96f174eb556d4e7bc04.exe	88
PID 1852 wrote to memory of 1316	1852	d535a0124949096793a4ca37a90d901f855e0da09ed7f96f174eb556d4e7bc04.exe	88
PID 1852 wrote to memory of 1316	1852	d535a0124949096793a4ca37a90d901f855e0da09ed7f96f174eb556d4e7bc04.exe	88
PID 1852 wrote to memory of 1428	1852	d535a0124949096793a4ca37a90d901f855e0da09ed7f96f174eb556d4e7bc04.exe	89
PID 1852 wrote to memory of 1428	1852	d535a0124949096793a4ca37a90d901f855e0da09ed7f96f174eb556d4e7bc04.exe	89
PID 1852 wrote to memory of 1428	1852	d535a0124949096793a4ca37a90d901f855e0da09ed7f96f174eb556d4e7bc04.exe	89
PID 1428 wrote to memory of 4740	1428	Logo1_.exe	90
PID 1428 wrote to memory of 4740	1428	Logo1_.exe	90
PID 1428 wrote to memory of 4740	1428	Logo1_.exe	90
PID 4740 wrote to memory of 4724	4740	net.exe	93
PID 4740 wrote to memory of 4724	4740	net.exe	93
PID 4740 wrote to memory of 4724	4740	net.exe	93
PID 1316 wrote to memory of 3380	1316	cmd.exe	94
PID 1316 wrote to memory of 3380	1316	cmd.exe	94
PID 1316 wrote to memory of 3380	1316	cmd.exe	94
PID 3380 wrote to memory of 2460	3380	d535a0124949096793a4ca37a90d901f855e0da09ed7f96f174eb556d4e7bc04.exe	95
PID 3380 wrote to memory of 2460	3380	d535a0124949096793a4ca37a90d901f855e0da09ed7f96f174eb556d4e7bc04.exe	95
PID 3380 wrote to memory of 2460	3380	d535a0124949096793a4ca37a90d901f855e0da09ed7f96f174eb556d4e7bc04.exe	95
PID 2460 wrote to memory of 5008	2460	d535a0124949096793a4ca37a90d901f855e0da09ed7f96f174eb556d4e7bc04Srv.exe	96
PID 2460 wrote to memory of 5008	2460	d535a0124949096793a4ca37a90d901f855e0da09ed7f96f174eb556d4e7bc04Srv.exe	96
PID 2460 wrote to memory of 5008	2460	d535a0124949096793a4ca37a90d901f855e0da09ed7f96f174eb556d4e7bc04Srv.exe	96
PID 5008 wrote to memory of 2540	5008	DesktopLayer.exe	97
PID 5008 wrote to memory of 2540	5008	DesktopLayer.exe	97
PID 2540 wrote to memory of 3304	2540	iexplore.exe	98
PID 2540 wrote to memory of 3304	2540	iexplore.exe	98
PID 2540 wrote to memory of 3304	2540	iexplore.exe	98
PID 1428 wrote to memory of 2540	1428	Logo1_.exe	97
PID 1428 wrote to memory of 2540	1428	Logo1_.exe	97

C:\Users\Admin\AppData\Local\Temp\d535a0124949096793a4ca37a90d901f855e0da09ed7f96f174eb556d4e7bc04.exe
"C:\Users\Admin\AppData\Local\Temp\d535a0124949096793a4ca37a90d901f855e0da09ed7f96f174eb556d4e7bc04.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a67D2.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1316
- - C:\Users\Admin\AppData\Local\Temp\d535a0124949096793a4ca37a90d901f855e0da09ed7f96f174eb556d4e7bc04.exe
    "C:\Users\Admin\AppData\Local\Temp\d535a0124949096793a4ca37a90d901f855e0da09ed7f96f174eb556d4e7bc04.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3380
  - - C:\Users\Admin\AppData\Local\Temp\d535a0124949096793a4ca37a90d901f855e0da09ed7f96f174eb556d4e7bc04Srv.exe
      C:\Users\Admin\AppData\Local\Temp\d535a0124949096793a4ca37a90d901f855e0da09ed7f96f174eb556d4e7bc04Srv.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2460
    - - C:\Program Files (x86)\Microsoft\DesktopLayer.exe
        
        "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5008
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2540
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2540 CREDAT:17410 /prefetch:2
        7⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:3304
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1428
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4740
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:4724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GoogleUpdateCore.exe

Path C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe
Size 251KB
SHA256 e5137cfd43e6bbd5e2044cc56e6d08b4441423481a9f5be2efdf8b2d4261047e
MD5 bdd08c2b14bc84bdb0bb437b6dbcf72f
SHA1 529a6a7c8beaa8b3074c6377b17bdb17fb848b54
SHA512 7b2d923586038a4b0a4069d8c0d18b93ec39e363e6428f032df50a5091ec0617e921316bffcb70709d1e16d32b928d9c83cc3d831b57c641fb6497e1ae876fca
SSDEEP 6144:UVfjmNHgiC4bXqsTk90qC1AOb7eswf1Px++fD8PJ:W7+AitXqsTkiR7twRx+gD8PJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 570KB
SHA256 ee00fd559aebd0ad9a665de2ca9de129d13243e5ecf56724d3b9513cb1d8ae26
MD5 d4bbaa83fb9621669e64ab93da4a6301
SHA1 da051eb49de23b582f78fc14249a9e17179fffc3
SHA512 914ea142308fd11434182854baff67bdaf1e2e7fa2635e02066a0f3bf9b9a6048857b5b5f9d8fd479c73bec3d179669fd04b27682e34f701a80b21857457ba0b
SSDEEP 6144:fVfjmNCE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4t0BHk:N7+57a3iwbihym2g7XO3LWUQfh4Co
MD5 SHA1 SHA512 SSDEEP

Submit Download

windowsdesktop-runtime-8.0.2-win-x64.exe

Path C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Size 636KB
SHA256 82e5b0001f025ca3b8409c98e4fb06c119c68de1e4ef60a156360cb4ef61d19c
MD5 2500f702e2b9632127c14e4eaae5d424
SHA1 8726fef12958265214eeb58001c995629834b13a
SHA512 f420c62fa1f6897f51dd7a0f0e910fb54ad14d51973a2d4840eeea0448c860bf83493fb1c07be65f731efc39e19f8a99886c8cfd058cee482fe52d255a33a55c
SSDEEP 12288:Pp7+H5mWukhI2jFMSjysAS9X/GsfTDYrGiqNLBryHi3H2g78C9Qz1DnmQ:R7u5mWpI2jFM5sFzfTpi4LsHof7T9sH
MD5 SHA1 SHA512 SSDEEP

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NUBP7RHT\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
MD5 SHA1 SHA512 SSDEEP

Submit Download

$$a67D2.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a67D2.bat
Size 722B
SHA256 7eb63a6323b06e35139358223486f4f83f4578dd7e775137cba86676724f96f9
MD5 521df65bc88af27bc9e014b00b71bba6
SHA1 e49861fbc5860cebb473c89e0e374e8d38f6e6bf
SHA512 916a8b5fd9d622d6fb8b72286e4aa0bad24e94184b633c1c854d39211e0a8f666b3ca9eac64bb2277029475ed04bdb8e3c86bc98e519943c08b154c31cba4406
MD5 SHA1 SHA512

Submit Download

d535a0124949096793a4ca37a90d901f855e0da09ed7f96f174eb556d4e7bc04.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\d535a0124949096793a4ca37a90d901f855e0da09ed7f96f174eb556d4e7bc04.exe.exe
Size 100KB
SHA256 9734a6045be672f49461f2738d58b37739cc92975d8cbfa8adc87b2ec473f5fb
MD5 d9b2d979ba36d6dda50fbd6ad35d3003
SHA1 80c365734ddf0e710c9a351b22fcda20ed34af11
SHA512 880c919ded48b4bdc2e04d60bf87a3eb8fb6e8f60228898a81d70ad9b530a699272cd3b05202cc193f8a55e8d1220783dc81c663ab8d5fbaa32f88fdf6d8d64f
SSDEEP 1536:LXMAVIZ5uIaNGAfm9P1eUSD8g6vTgUkPoVIjoko9Wisc7aaqVA5:LcAVI2IaNGAGP1OYg6vTzuVo9Wil
MD5 SHA1 SHA512 SSDEEP

Submit Download

d535a0124949096793a4ca37a90d901f855e0da09ed7f96f174eb556d4e7bc04Srv.exe

Path C:\Users\Admin\AppData\Local\Temp\d535a0124949096793a4ca37a90d901f855e0da09ed7f96f174eb556d4e7bc04Srv.exe
Size 55KB
SHA256 fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
MD5 ff5e1f27193ce51eec318714ef038bef
SHA1 b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA512 c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
SSDEEP 1536:Q+hzRsibKplyXTq8OGRnsPFG+RODTb7MXL5uXZnzE:bROzoTq0+RO7IwnY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 e135aefb131eeff159bb49e808679a6b837a183fae3e5c0b32d6f237ccddc7ef
MD5 512efa11327090c7e4e592a32ad9a28c
SHA1 d6821ff811143ff9cb7027ef991e9582f4ffc7d5
SHA512 074cb80f5835408e074f336ad7fd6ab4cd87e7614d389453c7ab0a753aa9f3aa2e56e9c0f4d50a1070fce1632f55aefc60a45bab97dd2cd480201cd10b81345b
SSDEEP 768:zN1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:zLfgLdQAQfcfymN
MD5 SHA1 SHA512 SSDEEP

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-4084619521-2220719027-1909462854-1000\_desktop.ini
Size 9B
SHA256 e9719e3c653627668046bac84b77097bfb0cd018d68465c17130ed31d6d6eca6
MD5 72b7e38c6ba037d117f32b55c07b1a9c
SHA1 35e2435e512e17ca2be885e17d75913f06b90361
SHA512 2bebd814b81ad2dc547802d42891d833caaad81d004758ec4373f9c7af2971eb822f0a559d2d5d4fca499912fea95e25bab22e92cb0c149d6a4c692eee6ee46a
MD5 SHA1 SHA512

Submit Download

memory/1428-5268-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1428-4829-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1428-1263-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1428-407-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1428-10-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1428-62-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1428-38-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1428-58-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1428-48-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1852-8-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1852-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2460-22-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2460-25-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2460-23-0x0000000002040000-0x000000000204F000-memory.dmp

Download

memory/3380-41-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/3380-39-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/3380-18-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/5008-36-0x00000000777A2000-0x00000000777A3000-memory.dmp

Download

memory/5008-35-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/5008-34-0x00000000777A2000-0x00000000777A3000-memory.dmp

Download

memory/5008-33-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/5008-32-0x0000000000550000-0x000000000055F000-memory.dmp

Download

memory/5008-31-0x0000000000560000-0x0000000000561000-memory.dmp

Download