ramnit | 4f3f92c76a390bb91672096c646ba448860edc8973ce9ef550dfbf6108dc3a95

General

Target

4f3f92c76a390bb91672096c646ba448860edc8973ce9ef550dfbf6108dc3a95.dll
Size

608KB
MD5

cdb6566d6f87909ca27a2dba7b7b046f
SHA1

346e4d24ed8b7c88f3cf7e88587a943d2f59334c
SHA256

4f3f92c76a390bb91672096c646ba448860edc8973ce9ef550dfbf6108dc3a95
SHA512

177d195b546036ce25f804a9d80ea0e244c29a281c91f7abc91e61dd64758896d932fcb87b51373c95c144d5d9280c3a0c4370a95f746f5521197dd2f8672786
SSDEEP

12288:IhpUrEIZJqr1AkBWwNa5R0EYl795/amaX3QXaPKUSK+QCV7:I/jG01NHXaPpCV7

Score

10^/10

ramnit banker persistence spyware stealer trojan upx worm

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe"	svchost.exe

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

UPX dump on OEP (original entry point) 10 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2920-15-0x0000000000400000-0x0000000000421000-memory.dmp	UPX
behavioral1/memory/2920-17-0x0000000000400000-0x0000000000421000-memory.dmp	UPX
behavioral1/memory/2920-19-0x0000000000400000-0x0000000000421000-memory.dmp	UPX
behavioral1/memory/2920-21-0x0000000000400000-0x0000000000421000-memory.dmp	UPX
behavioral1/memory/2920-13-0x0000000000400000-0x0000000000421000-memory.dmp	UPX
behavioral1/memory/2920-23-0x0000000000400000-0x0000000000421000-memory.dmp	UPX
behavioral1/memory/2200-43-0x0000000000400000-0x0000000000421000-memory.dmp	UPX
behavioral1/memory/2200-42-0x0000000000400000-0x0000000000421000-memory.dmp	UPX
behavioral1/memory/2200-344-0x0000000000400000-0x0000000000421000-memory.dmp	UPX
behavioral1/memory/2200-499-0x0000000000400000-0x0000000000421000-memory.dmp	UPX

Executes dropped EXE 2 IoCs

Processes:

rundll32mgr.exeWaterMark.exe

pid process

2920 rundll32mgr.exe
2200 WaterMark.exe
Loads dropped DLL 4 IoCs

Processes:

rundll32.exerundll32mgr.exe

pid process

2968 rundll32.exe
2968 rundll32.exe
2920 rundll32mgr.exe
2920 rundll32mgr.exe

pid	process
2920	rundll32mgr.exe
2200	WaterMark.exe

pid	process
2968	rundll32.exe
2968	rundll32.exe
2920	rundll32mgr.exe
2920	rundll32mgr.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2920-11-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2920-15-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2920-17-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2920-16-0x0000000000400000-0x0000000000430000-memory.dmp	upx
behavioral1/memory/2920-19-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2920-21-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2920-13-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2920-23-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2200-43-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2200-42-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2200-344-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2200-499-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Drops file in System32 directory 3 IoCs

Processes:

rundll32.exesvchost.exe

description	ioc	process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe
File created	C:\Windows\SysWOW64\dmlconf.dat	svchost.exe
File opened for modification	C:\Windows\SysWOW64\dmlconf.dat	svchost.exe

Drops file in Program Files directory 64 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\eclipse_1665.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Web.Entity.Resources.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\mshwjpn.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\JAWTAccessBridge-64.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\libvlc.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libaraw_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mlp_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\System\wab32.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\prism-d3d.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\zip.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Esl\AiodLite.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdaterInstallMgr.exe	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEEXCH.DLL	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\about.html	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Routing.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\npvlc.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\meta_engine\libtaglib_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\visualization\libprojectm_plugin.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\license.html	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\msoshext.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\mlib_image.dll	svchost.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\MSOHEV.DLL	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationProvider.resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\d3d11\libdirect3d11_filters_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Internet Explorer\networkinspection.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\ReachFramework.resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libscte18_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libswscale_plugin.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Help\ITIRCL55.DLL	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\tpcps.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\nio.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.IO.Log.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\librawvid_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Mail\wabfind.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\RELEASE-NOTES.html	svchost.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\PresentationFramework.resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\libfloat_mixer_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\cpu.html	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\settings.html	svchost.exe
File opened for modification	C:\Program Files\Common Files\System\ado\msadox.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\msdaosp.dll	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\libEGL.dll	svchost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\mozwer.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_mp4_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libcanvas_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\InkObj.dll	svchost.exe
File opened for modification	C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.dll	svchost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\mozavutil.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\control\liboldrc_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\lua\liblua_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\cpyr.htm	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\jsoundds.dll	svchost.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Net.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libsamplerate_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libtrivial_channel_mixer_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libvhs_plugin.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\ahclient.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\deploy.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Web.Entity.Design.Resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\libinteger_mixer_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libdca_plugin.dll	svchost.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2460 2968 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2460	2968	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

Processes:

WaterMark.exesvchost.exe

pid	process
2200	WaterMark.exe
2200	WaterMark.exe
2200	WaterMark.exe
2200	WaterMark.exe
2200	WaterMark.exe
2200	WaterMark.exe
2200	WaterMark.exe
2200	WaterMark.exe
2340	svchost.exe
2340	svchost.exe
2340	svchost.exe
2340	svchost.exe
2340	svchost.exe
2340	svchost.exe
2340	svchost.exe
2340	svchost.exe
2340	svchost.exe
2340	svchost.exe
2340	svchost.exe
2340	svchost.exe
2340	svchost.exe
2340	svchost.exe
2340	svchost.exe
2340	svchost.exe
2340	svchost.exe
2340	svchost.exe
2340	svchost.exe
2340	svchost.exe
2340	svchost.exe
2340	svchost.exe
2340	svchost.exe
2340	svchost.exe
2340	svchost.exe
2340	svchost.exe
2340	svchost.exe
2340	svchost.exe
2340	svchost.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

WaterMark.exesvchost.exerundll32.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	2200	WaterMark.exe
Token: SeDebugPrivilege	2340	svchost.exe
Token: SeDebugPrivilege	2968	rundll32.exe
Token: SeDebugPrivilege	2460	WerFault.exe
Token: SeDebugPrivilege	2200	WaterMark.exe

Suspicious use of UnmapMainImage 2 IoCs

Processes:

rundll32mgr.exeWaterMark.exe

pid process

2920 rundll32mgr.exe
2200 WaterMark.exe

pid	process
2920	rundll32mgr.exe
2200	WaterMark.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

rundll32.exerundll32.exerundll32mgr.exeWaterMark.exesvchost.exe

description	pid	process	target process
PID 2016 wrote to memory of 2968	2016	rundll32.exe	rundll32.exe
PID 2016 wrote to memory of 2968	2016	rundll32.exe	rundll32.exe
PID 2016 wrote to memory of 2968	2016	rundll32.exe	rundll32.exe
PID 2016 wrote to memory of 2968	2016	rundll32.exe	rundll32.exe
PID 2016 wrote to memory of 2968	2016	rundll32.exe	rundll32.exe
PID 2016 wrote to memory of 2968	2016	rundll32.exe	rundll32.exe
PID 2016 wrote to memory of 2968	2016	rundll32.exe	rundll32.exe
PID 2968 wrote to memory of 2920	2968	rundll32.exe	rundll32mgr.exe
PID 2968 wrote to memory of 2920	2968	rundll32.exe	rundll32mgr.exe
PID 2968 wrote to memory of 2920	2968	rundll32.exe	rundll32mgr.exe
PID 2968 wrote to memory of 2920	2968	rundll32.exe	rundll32mgr.exe
PID 2968 wrote to memory of 2460	2968	rundll32.exe	WerFault.exe
PID 2968 wrote to memory of 2460	2968	rundll32.exe	WerFault.exe
PID 2968 wrote to memory of 2460	2968	rundll32.exe	WerFault.exe
PID 2968 wrote to memory of 2460	2968	rundll32.exe	WerFault.exe
PID 2920 wrote to memory of 2200	2920	rundll32mgr.exe	WaterMark.exe
PID 2920 wrote to memory of 2200	2920	rundll32mgr.exe	WaterMark.exe
PID 2920 wrote to memory of 2200	2920	rundll32mgr.exe	WaterMark.exe
PID 2920 wrote to memory of 2200	2920	rundll32mgr.exe	WaterMark.exe
PID 2200 wrote to memory of 2736	2200	WaterMark.exe	svchost.exe
PID 2200 wrote to memory of 2736	2200	WaterMark.exe	svchost.exe
PID 2200 wrote to memory of 2736	2200	WaterMark.exe	svchost.exe
PID 2200 wrote to memory of 2736	2200	WaterMark.exe	svchost.exe
PID 2200 wrote to memory of 2736	2200	WaterMark.exe	svchost.exe
PID 2200 wrote to memory of 2736	2200	WaterMark.exe	svchost.exe
PID 2200 wrote to memory of 2736	2200	WaterMark.exe	svchost.exe
PID 2200 wrote to memory of 2736	2200	WaterMark.exe	svchost.exe
PID 2200 wrote to memory of 2736	2200	WaterMark.exe	svchost.exe
PID 2200 wrote to memory of 2736	2200	WaterMark.exe	svchost.exe
PID 2200 wrote to memory of 2340	2200	WaterMark.exe	svchost.exe
PID 2200 wrote to memory of 2340	2200	WaterMark.exe	svchost.exe
PID 2200 wrote to memory of 2340	2200	WaterMark.exe	svchost.exe
PID 2200 wrote to memory of 2340	2200	WaterMark.exe	svchost.exe
PID 2200 wrote to memory of 2340	2200	WaterMark.exe	svchost.exe
PID 2200 wrote to memory of 2340	2200	WaterMark.exe	svchost.exe
PID 2200 wrote to memory of 2340	2200	WaterMark.exe	svchost.exe
PID 2200 wrote to memory of 2340	2200	WaterMark.exe	svchost.exe
PID 2200 wrote to memory of 2340	2200	WaterMark.exe	svchost.exe
PID 2200 wrote to memory of 2340	2200	WaterMark.exe	svchost.exe
PID 2340 wrote to memory of 260	2340	svchost.exe	smss.exe
PID 2340 wrote to memory of 260	2340	svchost.exe	smss.exe
PID 2340 wrote to memory of 260	2340	svchost.exe	smss.exe
PID 2340 wrote to memory of 260	2340	svchost.exe	smss.exe
PID 2340 wrote to memory of 260	2340	svchost.exe	smss.exe
PID 2340 wrote to memory of 336	2340	svchost.exe	csrss.exe
PID 2340 wrote to memory of 336	2340	svchost.exe	csrss.exe
PID 2340 wrote to memory of 336	2340	svchost.exe	csrss.exe
PID 2340 wrote to memory of 336	2340	svchost.exe	csrss.exe
PID 2340 wrote to memory of 336	2340	svchost.exe	csrss.exe
PID 2340 wrote to memory of 384	2340	svchost.exe	wininit.exe
PID 2340 wrote to memory of 384	2340	svchost.exe	wininit.exe
PID 2340 wrote to memory of 384	2340	svchost.exe	wininit.exe
PID 2340 wrote to memory of 384	2340	svchost.exe	wininit.exe
PID 2340 wrote to memory of 384	2340	svchost.exe	wininit.exe
PID 2340 wrote to memory of 400	2340	svchost.exe	csrss.exe
PID 2340 wrote to memory of 400	2340	svchost.exe	csrss.exe
PID 2340 wrote to memory of 400	2340	svchost.exe	csrss.exe
PID 2340 wrote to memory of 400	2340	svchost.exe	csrss.exe
PID 2340 wrote to memory of 400	2340	svchost.exe	csrss.exe
PID 2340 wrote to memory of 436	2340	svchost.exe	winlogon.exe
PID 2340 wrote to memory of 436	2340	svchost.exe	winlogon.exe
PID 2340 wrote to memory of 436	2340	svchost.exe	winlogon.exe
PID 2340 wrote to memory of 436	2340	svchost.exe	winlogon.exe
PID 2340 wrote to memory of 436	2340	svchost.exe	winlogon.exe

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe
1⤵
PID:260

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:336

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:384

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
2⤵
PID:480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
3⤵
PID:600

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
4⤵
PID:1688

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -Embedding
4⤵
PID:780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS
3⤵
PID:676

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
3⤵
PID:752

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
3⤵
PID:820

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
4⤵
PID:1172

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
3⤵
PID:860

C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
4⤵
PID:1712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
3⤵
PID:972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService
3⤵
PID:276

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
3⤵
PID:1028

C:\Windows\system32\taskhost.exe
"taskhost.exe"
3⤵
PID:1084

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
3⤵
PID:1120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
3⤵
PID:2808

C:\Windows\system32\sppsvc.exe
C:\Windows\system32\sppsvc.exe
3⤵
PID:2892

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
2⤵
PID:496

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
2⤵
PID:504

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:400

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:436

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1196

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4f3f92c76a390bb91672096c646ba448860edc8973ce9ef550dfbf6108dc3a95.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2016

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4f3f92c76a390bb91672096c646ba448860edc8973ce9ef550dfbf6108dc3a95.dll,#1
3⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2968

C:\Windows\SysWOW64\rundll32mgr.exe
C:\Windows\SysWOW64\rundll32mgr.exe
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2920

C:\Program Files (x86)\Microsoft\WaterMark.exe
"C:\Program Files (x86)\Microsoft\WaterMark.exe"
5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2200

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
6⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
PID:2736

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 232
4⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2460

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html
Filesize
312KB

MD5
de53e52e74b1fc1334ed1c68a475fa45

SHA1
a58729806d688d9bfc622e2362fd4c5b9631d0c6

SHA256
327e49807646ad23fa88f5eca49a561d46962df7db30ddc74b3602771b5b796d

SHA512
142d8129347da45549ad05fef338ba4dd0661222d12dece84503553de5aa4bda6be57f43cdea7bdf66925317f2bdff470951d886d614b0d1c0e59c0035871dc8

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html
Filesize
308KB

MD5
647477309b0079c26ab18564557ccb7a

SHA1
c10347dba1db3486bec23102c8c1248fe239a620

SHA256
4354849c950d0ee778c83f139d9d09f25a672882e7b21dbe083ed8893db71cae

SHA512
158a8a7c36614a0fde5e359426916bbf8f11a89ca9dd92642faba8cf09ea5b8bd75d03d78ae37da82afd556ecc8f77272f94d14eadc20f15f34b72c06ad73a15

Download Submit
\Windows\SysWOW64\rundll32mgr.exe
Filesize
149KB

MD5
8d87ebfc9dc5999ca44efe778f374615

SHA1
d3cb9d32706995373c25f44b6843a0c8a28502ef

SHA256
0ac48779df767bd67c862f7154cf13eaec6c15aea06ff74e41f09b8bb23a2d8d

SHA512
553588d1d7d34c12c7f1b41a442a9f5745c34e62f7505ced34f8846475ea05bab9b231a63ae4d06c98a65b3c4749ed6921dd8fc280aa09f6bdf6523386a79c18

Download Submit
memory/2200-41-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/2200-72-0x0000000000060000-0x0000000000061000-memory.dmp

Filesize
4KB

Download
memory/2200-344-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2200-45-0x000000007792F000-0x0000000077930000-memory.dmp

Filesize
4KB

Download
memory/2200-84-0x000000007792F000-0x0000000077930000-memory.dmp

Filesize
4KB

Download
memory/2200-499-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2200-42-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2200-43-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2340-90-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2340-91-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2340-89-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2340-85-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2340-93-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2340-94-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2340-92-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2340-100-0x0000000077930000-0x0000000077931000-memory.dmp

Filesize
4KB

Download
memory/2340-74-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2460-321-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/2736-58-0x00000000000A0000-0x00000000000A1000-memory.dmp

Filesize
4KB

Download
memory/2736-496-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2736-60-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2736-63-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2736-61-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/2736-68-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2736-55-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2736-48-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2736-46-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2920-13-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2920-34-0x0000000000050000-0x0000000000080000-memory.dmp

Filesize
192KB

Download
memory/2920-11-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2920-14-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/2920-23-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2920-21-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2920-19-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2920-16-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2920-15-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2920-17-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2968-311-0x0000000077930000-0x0000000077931000-memory.dmp

Filesize
4KB

Download
memory/2968-307-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download
memory/2968-304-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2968-0-0x0000000010000000-0x0000000010099000-memory.dmp

Filesize
612KB

Download
memory/2968-12-0x0000000000140000-0x0000000000170000-memory.dmp

Filesize
192KB

Download
memory/2968-10-0x0000000000140000-0x0000000000170000-memory.dmp

Filesize
192KB

Download
memory/2968-3-0x0000000010000000-0x0000000010099000-memory.dmp

Filesize
612KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads