ramnit | 4f3f92c76a390bb91672096c646ba448860edc8973ce9ef550dfbf6108dc3a95

General

Target

4f3f92c76a390bb91672096c646ba448860edc8973ce9ef550dfbf6108dc3a95.dll
Size

608KB
MD5

cdb6566d6f87909ca27a2dba7b7b046f
SHA1

346e4d24ed8b7c88f3cf7e88587a943d2f59334c
SHA256

4f3f92c76a390bb91672096c646ba448860edc8973ce9ef550dfbf6108dc3a95
SHA512

177d195b546036ce25f804a9d80ea0e244c29a281c91f7abc91e61dd64758896d932fcb87b51373c95c144d5d9280c3a0c4370a95f746f5521197dd2f8672786
SSDEEP

12288:IhpUrEIZJqr1AkBWwNa5R0EYl795/amaX3QXaPKUSK+QCV7:I/jG01NHXaPpCV7

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

UPX dump on OEP (original entry point) 10 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4940-10-0x0000000000400000-0x0000000000421000-memory.dmp	UPX
behavioral2/memory/4940-12-0x0000000000400000-0x0000000000421000-memory.dmp	UPX
behavioral2/memory/4940-13-0x0000000000400000-0x0000000000421000-memory.dmp	UPX
behavioral2/memory/4940-16-0x0000000000400000-0x0000000000421000-memory.dmp	UPX
behavioral2/memory/4940-15-0x0000000000400000-0x0000000000421000-memory.dmp	UPX
behavioral2/memory/4940-9-0x0000000000400000-0x0000000000421000-memory.dmp	UPX
behavioral2/memory/1108-23-0x0000000000400000-0x0000000000430000-memory.dmp	UPX
behavioral2/memory/1108-30-0x0000000000400000-0x0000000000421000-memory.dmp	UPX
behavioral2/memory/1108-41-0x0000000000400000-0x0000000000421000-memory.dmp	UPX
behavioral2/memory/1108-42-0x0000000000400000-0x0000000000421000-memory.dmp	UPX

Executes dropped EXE 2 IoCs

Processes:

rundll32mgr.exeWaterMark.exe

pid process

4940 rundll32mgr.exe
1108 WaterMark.exe

pid	process
4940	rundll32mgr.exe
1108	WaterMark.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4940-7-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4940-10-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4940-12-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4940-13-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4940-16-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4940-15-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4940-9-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1108-30-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1108-41-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1108-42-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe

description	ioc	process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

Drops file in Program Files directory 3 IoCs

Processes:

rundll32mgr.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft\pxE88B.tmp	rundll32mgr.exe
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	rundll32mgr.exe
File opened for modification	C:\Program Files (x86)\Microsoft\WaterMark.exe	rundll32mgr.exe

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

3832 5004 WerFault.exe rundll32.exe
2112 4440 WerFault.exe svchost.exe

pid	pid_target	process	target process
3832	5004	WerFault.exe	rundll32.exe
2112	4440	WerFault.exe	svchost.exe

Modifies Internet Explorer settings 1 TTPs 53 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXEIEXPLORE.EXEiexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1620181253"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1620181253"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1593306622"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1593618963"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{8A59EEA1-00F2-11EF-B9F7-7E3D4A1755AD} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31102207"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31102207"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31102207"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1593618963"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420587694"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31102207"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31102207"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{8A6AA00C-00F2-11EF-B9F7-7E3D4A1755AD} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31102207"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1593306622"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

WaterMark.exe

pid	process
1108	WaterMark.exe
1108	WaterMark.exe
1108	WaterMark.exe
1108	WaterMark.exe
1108	WaterMark.exe
1108	WaterMark.exe
1108	WaterMark.exe
1108	WaterMark.exe
1108	WaterMark.exe
1108	WaterMark.exe
1108	WaterMark.exe
1108	WaterMark.exe
1108	WaterMark.exe
1108	WaterMark.exe
1108	WaterMark.exe
1108	WaterMark.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WaterMark.exe

description pid process

Token: SeDebugPrivilege 1108 WaterMark.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

iexplore.exeiexplore.exe

pid process

3920 iexplore.exe
3916 iexplore.exe

description	pid	process
Token: SeDebugPrivilege	1108	WaterMark.exe

pid	process
3920	iexplore.exe
3916	iexplore.exe

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

iexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXE

pid	process
3916	iexplore.exe
3916	iexplore.exe
3920	iexplore.exe
3920	iexplore.exe
1920	IEXPLORE.EXE
1920	IEXPLORE.EXE
1980	IEXPLORE.EXE
1980	IEXPLORE.EXE
1920	IEXPLORE.EXE
1920	IEXPLORE.EXE

Suspicious use of UnmapMainImage 2 IoCs

Processes:

rundll32mgr.exeWaterMark.exe

pid process

4940 rundll32mgr.exe
1108 WaterMark.exe

pid	process
4940	rundll32mgr.exe
1108	WaterMark.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

rundll32.exerundll32.exerundll32mgr.exeWaterMark.exeiexplore.exeiexplore.exe

description	pid	process	target process
PID 5080 wrote to memory of 5004	5080	rundll32.exe	rundll32.exe
PID 5080 wrote to memory of 5004	5080	rundll32.exe	rundll32.exe
PID 5080 wrote to memory of 5004	5080	rundll32.exe	rundll32.exe
PID 5004 wrote to memory of 4940	5004	rundll32.exe	rundll32mgr.exe
PID 5004 wrote to memory of 4940	5004	rundll32.exe	rundll32mgr.exe
PID 5004 wrote to memory of 4940	5004	rundll32.exe	rundll32mgr.exe
PID 4940 wrote to memory of 1108	4940	rundll32mgr.exe	WaterMark.exe
PID 4940 wrote to memory of 1108	4940	rundll32mgr.exe	WaterMark.exe
PID 4940 wrote to memory of 1108	4940	rundll32mgr.exe	WaterMark.exe
PID 1108 wrote to memory of 4440	1108	WaterMark.exe	svchost.exe
PID 1108 wrote to memory of 4440	1108	WaterMark.exe	svchost.exe
PID 1108 wrote to memory of 4440	1108	WaterMark.exe	svchost.exe
PID 1108 wrote to memory of 4440	1108	WaterMark.exe	svchost.exe
PID 1108 wrote to memory of 4440	1108	WaterMark.exe	svchost.exe
PID 1108 wrote to memory of 4440	1108	WaterMark.exe	svchost.exe
PID 1108 wrote to memory of 4440	1108	WaterMark.exe	svchost.exe
PID 1108 wrote to memory of 4440	1108	WaterMark.exe	svchost.exe
PID 1108 wrote to memory of 4440	1108	WaterMark.exe	svchost.exe
PID 1108 wrote to memory of 3916	1108	WaterMark.exe	iexplore.exe
PID 1108 wrote to memory of 3916	1108	WaterMark.exe	iexplore.exe
PID 1108 wrote to memory of 3920	1108	WaterMark.exe	iexplore.exe
PID 1108 wrote to memory of 3920	1108	WaterMark.exe	iexplore.exe
PID 3920 wrote to memory of 1920	3920	iexplore.exe	IEXPLORE.EXE
PID 3920 wrote to memory of 1920	3920	iexplore.exe	IEXPLORE.EXE
PID 3920 wrote to memory of 1920	3920	iexplore.exe	IEXPLORE.EXE
PID 3916 wrote to memory of 1980	3916	iexplore.exe	IEXPLORE.EXE
PID 3916 wrote to memory of 1980	3916	iexplore.exe	IEXPLORE.EXE
PID 3916 wrote to memory of 1980	3916	iexplore.exe	IEXPLORE.EXE

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4f3f92c76a390bb91672096c646ba448860edc8973ce9ef550dfbf6108dc3a95.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5080

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4f3f92c76a390bb91672096c646ba448860edc8973ce9ef550dfbf6108dc3a95.dll,#1
2⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5004

C:\Windows\SysWOW64\rundll32mgr.exe
C:\Windows\SysWOW64\rundll32mgr.exe
3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4940

C:\Program Files (x86)\Microsoft\WaterMark.exe
"C:\Program Files (x86)\Microsoft\WaterMark.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1108

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
5⤵
PID:4440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 212
6⤵
- Program crash
PID:2112

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3916

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3916 CREDAT:17410 /prefetch:2
6⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1980

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3920

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3920 CREDAT:17410 /prefetch:2
6⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5004 -s 628
3⤵
- Program crash
PID:3832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5004 -ip 5004
1⤵
PID:2748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4440 -ip 4440
1⤵
PID:4752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3720 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:8
1⤵
PID:4084

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
471B

MD5
3c306eef3600e13ab3f9294f5337836f

SHA1
66782ff2397216af4c65e2e888dd60124f724429

SHA256
baca6039db0f154dc0d7f628499010d6f447bcd6d13aeea9b52c32a9a1945844

SHA512
790e49192f555d9a53db05638c36e51b2d41666cde91d805296a8561c5a9bcae18ad0d7b19e7ca09716e42bac3abf8445f47ba31b7e78438379fe1ac40252d17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
404B

MD5
2f4811c0ce3c85ba3e3873fbe0c3fb8e

SHA1
e8f5fdd6853a56ebee36045cf293f021322262e2

SHA256
a55f66608bbbaf91bc47533c1b30a7704dd30564a3758cabe8e2a5bdb6f581e0

SHA512
a81f1522cced7c5a5f074ddc37a46208fa10ea3bd4a192950726e9cc6d1fc2ab55dfd01db86a9894749a23dad2766638da13b26c718369f1de388ab99b77ffcf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
404B

MD5
d6a00fcaa935c304d11e61371a4a920d

SHA1
42e8f6a88c300ed963f2b280800eadcb61417b0e

SHA256
fa00b749e65e249cf8a406979b583aff558ba3fc646314dbc3f026cf2ae9e1e2

SHA512
4e12afc8f4985215aa7f787d923ba4d5ae7637411f93b63a7355fdf05bd5bb32e4f2f7fa3b8c1f85803ba0e3a7bb042243f9d521275ed5e0bb47adeeac772231

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{8A59EEA1-00F2-11EF-B9F7-7E3D4A1755AD}.dat
Filesize
5KB

MD5
643086ae4af371b0fb04416e216a9ecf

SHA1
8859b8d2e640fffa33efcd9bbae42fbce7d460ee

SHA256
864cfb5e9c9b92e7a7ee979141cf911c5cb1ee965e62768c1c6bebe8380d4c90

SHA512
a9e3d8a16070b884949ce5e8522e53f2751d900db558a7b67b3f1dd825cf524b3c59c8bf64739f9f5073c5456ad9c46dc092b6a7497145708ccd374ca98dc3f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{8A6AA00C-00F2-11EF-B9F7-7E3D4A1755AD}.dat
Filesize
5KB

MD5
34b7b6d26f3a11a7fcd1d03f95548fed

SHA1
7be99c71b5b218513391638553172a6f238b4fe7

SHA256
8db5408a0017e2c9254e5b1d87e7d7bcfea5a7b886a48324afbb75379c5ff3e3

SHA512
368aad212cc92acac8ff42cb8fbf37fd8af813eb3f490cd7b69edec64d8b85e0b822add85f993050c1287bccdbbda38e917191559154f86d1cb06853337d5d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver6EF1.tmp
Filesize
15KB

MD5
1a545d0052b581fbb2ab4c52133846bc

SHA1
62f3266a9b9925cd6d98658b92adec673cbe3dd3

SHA256
557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

SHA512
bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\O8VM10HV\suggestions[1].en-US
Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Windows\SysWOW64\rundll32mgr.exe
Filesize
149KB

MD5
8d87ebfc9dc5999ca44efe778f374615

SHA1
d3cb9d32706995373c25f44b6843a0c8a28502ef

SHA256
0ac48779df767bd67c862f7154cf13eaec6c15aea06ff74e41f09b8bb23a2d8d

SHA512
553588d1d7d34c12c7f1b41a442a9f5745c34e62f7505ced34f8846475ea05bab9b231a63ae4d06c98a65b3c4749ed6921dd8fc280aa09f6bdf6523386a79c18

Download Submit
memory/1108-31-0x0000000000060000-0x0000000000061000-memory.dmp

Filesize
4KB

Download
memory/1108-42-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1108-41-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1108-37-0x0000000000070000-0x0000000000071000-memory.dmp

Filesize
4KB

Download
memory/1108-23-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1108-30-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1108-36-0x0000000077692000-0x0000000077693000-memory.dmp

Filesize
4KB

Download
memory/1108-32-0x0000000077692000-0x0000000077693000-memory.dmp

Filesize
4KB

Download
memory/4440-35-0x0000000000FA0000-0x0000000000FA1000-memory.dmp

Filesize
4KB

Download
memory/4440-34-0x0000000000FC0000-0x0000000000FC1000-memory.dmp

Filesize
4KB

Download
memory/4940-10-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4940-9-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4940-13-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4940-12-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4940-15-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4940-16-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4940-11-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/4940-7-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4940-6-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4940-5-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/5004-40-0x0000000010000000-0x0000000010099000-memory.dmp

Filesize
612KB

Download
memory/5004-0-0x0000000010000000-0x0000000010099000-memory.dmp

Filesize
612KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads