Overview

overview

10

Static

static

3

c9a9f77499...a0.exe

windows7-x64

10

c9a9f77499...a0.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/04/2024, 23:14

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    c9a9f77499cefd78fec07f20c715e318c8c557cceb53934c7c82347563aa7aa0.exe

  • Size

    498KB

  • MD5

    a73dbd8928f706068b73ec32594ea4b0

  • SHA1

    3e6f873185a252034294b1fc2f2f0efe2e1ea244

  • SHA256

    c9a9f77499cefd78fec07f20c715e318c8c557cceb53934c7c82347563aa7aa0

  • SHA512

    d4f2beff84fd44a77a0e15f8435554847eb4839f63e49db6cfb78edf67723492d652c1789edcfc14360043bb1aa21b2b3329401763bc9ffd828696b75a2cdfee

  • SSDEEP

    12288:+7+lV+++cWNRLv7kP2S2IuzI/oS0E7Jw:+7V++rbq29IwE7u

Score
10/10
ramnitbankerspywarestealertrojanupxworm

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

    trojanspywarestealerwormbankerramnit
  • Executes dropped EXE 4 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 30 IoCs
    adwarespyware
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c9a9f77499cefd78fec07f20c715e318c8c557cceb53934c7c82347563aa7aa0.exe
    "C:\Users\Admin\AppData\Local\Temp\c9a9f77499cefd78fec07f20c715e318c8c557cceb53934c7c82347563aa7aa0.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:1980
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a47B7.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4456
      • C:\Users\Admin\AppData\Local\Temp\c9a9f77499cefd78fec07f20c715e318c8c557cceb53934c7c82347563aa7aa0.exe
        "C:\Users\Admin\AppData\Local\Temp\c9a9f77499cefd78fec07f20c715e318c8c557cceb53934c7c82347563aa7aa0.exe"
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1592
        • C:\Users\Admin\AppData\Local\Temp\c9a9f77499cefd78fec07f20c715e318c8c557cceb53934c7c82347563aa7aa0Srv.exe
          C:\Users\Admin\AppData\Local\Temp\c9a9f77499cefd78fec07f20c715e318c8c557cceb53934c7c82347563aa7aa0Srv.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1396
          • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
            "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1472
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe"
              6⤵
              • Modifies Internet Explorer settings
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:1432
              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1432 CREDAT:17410 /prefetch:2
                7⤵
                • Modifies Internet Explorer settings
                • Suspicious use of SetWindowsHookEx
                PID:2924
    • C:\Windows\Logo1_.exe
      C:\Windows\Logo1_.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3196
      • C:\Windows\SysWOW64\net.exe
        net stop "Kingsoft AntiVirus Service"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2616
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
          4⤵
            PID:1252

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe
            Filesize

            244KB

            MD5

            e9101e5822a7e363ce9b642bdc58683c

            SHA1

            8ed724000fe98ff627fd832a4ab869c331da73f7

            SHA256

            34f6854132070c1560e46a5b02c2b1520d207febcfc87c1b65d1ff4f5416fae0

            SHA512

            164f93edcb677527f89a191ffb7bc9acda7016530e234d3da79f3e5e553c25129cd88b0acad1764b986e5f28fd995eef7219b43746f81f14f0712dd1bdf72c68

            Download Submit

          • C:\Program Files\BlockGroup.exe
            Filesize

            550KB

            MD5

            c2f487c4440ad79c30252e1c2813ba7d

            SHA1

            c2dfc47eb1641c77ca47ddd9737d7906c8562db9

            SHA256

            ec076dec0e1a9e7ffedfd56c0374efebf4ea01822bc4ed72ef1833e00ecf4aff

            SHA512

            25293bc2fd2ea9a2c998be4b577fa100af04b985ad2a4c831fe486e121896051be83b67447e4b561795895dff96ca28fde390a111050a8847d66a332ad604db0

            Download Submit

          • C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
            Filesize

            636KB

            MD5

            2500f702e2b9632127c14e4eaae5d424

            SHA1

            8726fef12958265214eeb58001c995629834b13a

            SHA256

            82e5b0001f025ca3b8409c98e4fb06c119c68de1e4ef60a156360cb4ef61d19c

            SHA512

            f420c62fa1f6897f51dd7a0f0e910fb54ad14d51973a2d4840eeea0448c860bf83493fb1c07be65f731efc39e19f8a99886c8cfd058cee482fe52d255a33a55c

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
            Filesize

            471B

            MD5

            a1852ee38cd3084a003edcdcf6e5ab26

            SHA1

            e3e597545204d1a393380620a31800f4f9f73fd8

            SHA256

            85a5c9ffa349561e5f1e1c81e24f96a88a48110fba4fe630fdaf415267e02561

            SHA512

            ea673692ea83b98505c8bb0b0f22f04c3c5c8760e3f70e9916f8adf27a6a1b1e71b26b1ea01cbe932ffcf4fa861f99e47bc53ed571b660b95383948e0e1ae567

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
            Filesize

            404B

            MD5

            8b23dcb37152cb822de730cebf34ae56

            SHA1

            ceb240da999b1b85c4542a7dd5ab6ab6ebd10aaf

            SHA256

            7d56716237aafe5a6a5cf13bff759b76dad19ae0775e343b875d86d202d6bbbd

            SHA512

            bda7fbbe7da156b24ce682c344ff9a9fa5ee90dd39d019bc955ab4eba72c63297c6084b69be5268c3c15364ed6b088e29d6d6534adb8a5485a1cfb0270b10778

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\SZ2TD4H5\suggestions[1].en-US
            Filesize

            17KB

            MD5

            5a34cb996293fde2cb7a4ac89587393a

            SHA1

            3c96c993500690d1a77873cd62bc639b3a10653f

            SHA256

            c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

            SHA512

            e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\$$a47B7.bat
            Filesize

            722B

            MD5

            f6b7b2236d56dcc02e11da2f408d62c6

            SHA1

            1e591f642ca26b00adb4e55ef93ac200dee48cf4

            SHA256

            1d9ddb4611f0a692f4a2e8314c620d341304ad09aae130058f71a937813701d1

            SHA512

            e9ce9de96f5b1e952a9232e23fc43bcf8001c2435071099aa68d2443d5180d3b8be8ffd6af37dff135af52434468b2e338e40f2bc6743f04595cfd49c837c165

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\c9a9f77499cefd78fec07f20c715e318c8c557cceb53934c7c82347563aa7aa0.exe.exe
            Filesize

            472KB

            MD5

            e749732b629bec1fca82f3a9c37921ef

            SHA1

            ae37bd2b0c0fa1980a44d31139d4fc0519008579

            SHA256

            02bc6b0a00a7baaf9c977404e694a82b2d2fa29fff13eb5b92d13d36b0666169

            SHA512

            a933b77510a38dd2e4c4b8e22a8cd6044c951f5c5b04210e5faee9905820e5c323a6b1e3210fc34da8f76ef6444d9d33760036ae1672a046c873e1821a8eceaf

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\c9a9f77499cefd78fec07f20c715e318c8c557cceb53934c7c82347563aa7aa0Srv.exe
            Filesize

            55KB

            MD5

            ff5e1f27193ce51eec318714ef038bef

            SHA1

            b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

            SHA256

            fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

            SHA512

            c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

            Download Submit

          • C:\Windows\Logo1_.exe
            Filesize

            26KB

            MD5

            6de702b5aaf6cf84dcbba969d8b48fca

            SHA1

            0934b7ddfd3047c9417012f86a02ba869c9f4545

            SHA256

            c4a9a61669a0e266374d2d5e0313d2af8e9286e5c401eeea5f510744c04ff74f

            SHA512

            044c399fbd648a413b9674d1bbc751c7141e761bd446e6cb1a615422df4d6870772976f6d0aca957d3fe2bb3f319ad825ce50c8292e4c9d4516feedae26782aa

            Download Submit

          • F:\$RECYCLE.BIN\S-1-5-21-2818691465-3043947619-2475182763-1000\_desktop.ini
            Filesize

            9B

            MD5

            73b8aef84e892e3f77d41747dce253db

            SHA1

            d642a92c96e4ed570d998a73e42fc24fafe8caf9

            SHA256

            a81f7465f537233bbd4b8fa9034e52a8ceffcdf97bf36244c4d404ebec14eb24

            SHA512

            9b0690efee220355932375db333b5487c369ca9fdcf8497bcb5283d78d21fb4fefb7c06bbe533fb1f18fd3b32256a013090af6dd957b9d09cc373d0d5b89cf6d

            Download Submit

          • memory/1396-23-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

            Download

          • memory/1396-29-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

            Download

          • memory/1396-22-0x0000000000560000-0x000000000056F000-memory.dmp

            Filesize

            60KB

            Download

          • memory/1472-32-0x00000000006B0000-0x00000000006B1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/1472-33-0x0000000077902000-0x0000000077903000-memory.dmp

            Filesize

            4KB

            Download

          • memory/1472-34-0x0000000077902000-0x0000000077903000-memory.dmp

            Filesize

            4KB

            Download

          • memory/1472-28-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

            Download

          • memory/1472-31-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

            Download

          • memory/1592-38-0x0000000000620000-0x0000000000772000-memory.dmp

            Filesize

            1.3MB

            Download

          • memory/1592-18-0x0000000000620000-0x0000000000772000-memory.dmp

            Filesize

            1.3MB

            Download

          • memory/1980-0-0x0000000000400000-0x0000000000434000-memory.dmp

            Filesize

            208KB

            Download

          • memory/1980-9-0x0000000000400000-0x0000000000434000-memory.dmp

            Filesize

            208KB

            Download

          • memory/3196-64-0x0000000000400000-0x0000000000434000-memory.dmp

            Filesize

            208KB

            Download

          • memory/3196-70-0x0000000000400000-0x0000000000434000-memory.dmp

            Filesize

            208KB

            Download

          • memory/3196-47-0x0000000000400000-0x0000000000434000-memory.dmp

            Filesize

            208KB

            Download

          • memory/3196-185-0x0000000000400000-0x0000000000434000-memory.dmp

            Filesize

            208KB

            Download

          • memory/3196-1285-0x0000000000400000-0x0000000000434000-memory.dmp

            Filesize

            208KB

            Download

          • memory/3196-12-0x0000000000400000-0x0000000000434000-memory.dmp

            Filesize

            208KB

            Download

          • memory/3196-4853-0x0000000000400000-0x0000000000434000-memory.dmp

            Filesize

            208KB

            Download

          • memory/3196-37-0x0000000000400000-0x0000000000434000-memory.dmp

            Filesize

            208KB

            Download

          • memory/3196-5318-0x0000000000400000-0x0000000000434000-memory.dmp

            Filesize

            208KB

            Download