Overview

overview

10

Static

static

3

c9a9f77499...a0.exe

windows7-x64

10

c9a9f77499...a0.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/04/2024, 23:14

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    c9a9f77499cefd78fec07f20c715e318c8c557cceb53934c7c82347563aa7aa0.exe
  • Size 498KB
  • Sample240429-28c8dadc96
  • SHA256 c9a9f77499cefd78fec07f20c715e318c8c557cceb53934c7c82347563aa7aa0
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
ramnitbankerspywarestealertrojanupxworm

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

    trojanspywarestealerwormbankerramnit
  • Executes dropped EXE 4 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 30 IoCs
    adwarespyware
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c9a9f77499cefd78fec07f20c715e318c8c557cceb53934c7c82347563aa7aa0.exe
    "C:\Users\Admin\AppData\Local\Temp\c9a9f77499cefd78fec07f20c715e318c8c557cceb53934c7c82347563aa7aa0.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:1980
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a47B7.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4456
      • C:\Users\Admin\AppData\Local\Temp\c9a9f77499cefd78fec07f20c715e318c8c557cceb53934c7c82347563aa7aa0.exe
        "C:\Users\Admin\AppData\Local\Temp\c9a9f77499cefd78fec07f20c715e318c8c557cceb53934c7c82347563aa7aa0.exe"
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1592
        • C:\Users\Admin\AppData\Local\Temp\c9a9f77499cefd78fec07f20c715e318c8c557cceb53934c7c82347563aa7aa0Srv.exe
          C:\Users\Admin\AppData\Local\Temp\c9a9f77499cefd78fec07f20c715e318c8c557cceb53934c7c82347563aa7aa0Srv.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1396
          • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
            "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1472
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe"
              6⤵
              • Modifies Internet Explorer settings
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:1432
              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1432 CREDAT:17410 /prefetch:2
                7⤵
                • Modifies Internet Explorer settings
                • Suspicious use of SetWindowsHookEx
                PID:2924
    • C:\Windows\Logo1_.exe
      C:\Windows\Logo1_.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3196
      • C:\Windows\SysWOW64\net.exe
        net stop "Kingsoft AntiVirus Service"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2616
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
          4⤵
            PID:1252

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          GoogleUpdateCore.exe
          • Path C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe
          • Size 244KB
          • SHA256 34f6854132070c1560e46a5b02c2b1520d207febcfc87c1b65d1ff4f5416fae0
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          BlockGroup.exe
          • Path C:\Program Files\BlockGroup.exe
          • Size 550KB
          • SHA256 ec076dec0e1a9e7ffedfd56c0374efebf4ea01822bc4ed72ef1833e00ecf4aff
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          windowsdesktop-runtime-8.0.2-win-x64.exe
          • Path C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
          • Size 636KB
          • SHA256 82e5b0001f025ca3b8409c98e4fb06c119c68de1e4ef60a156360cb4ef61d19c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
          • Size 471B
          • SHA256 85a5c9ffa349561e5f1e1c81e24f96a88a48110fba4fe630fdaf415267e02561
          • MD5 SHA1 SHA512
          Submit Download

          7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
          • Size 404B
          • SHA256 7d56716237aafe5a6a5cf13bff759b76dad19ae0775e343b875d86d202d6bbbd
          • MD5 SHA1 SHA512
          Submit Download

          suggestions[1].en-US
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\SZ2TD4H5\suggestions[1].en-US
          • Size 17KB
          • SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          $$a47B7.bat
          • Path C:\Users\Admin\AppData\Local\Temp\$$a47B7.bat
          • Size 722B
          • SHA256 1d9ddb4611f0a692f4a2e8314c620d341304ad09aae130058f71a937813701d1
          • MD5 SHA1 SHA512
          Submit Download

          c9a9f77499cefd78fec07f20c715e318c8c557cceb53934c7c82347563aa7aa0.exe.exe
          • Path C:\Users\Admin\AppData\Local\Temp\c9a9f77499cefd78fec07f20c715e318c8c557cceb53934c7c82347563aa7aa0.exe.exe
          • Size 472KB
          • SHA256 02bc6b0a00a7baaf9c977404e694a82b2d2fa29fff13eb5b92d13d36b0666169
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          c9a9f77499cefd78fec07f20c715e318c8c557cceb53934c7c82347563aa7aa0Srv.exe
          • Path C:\Users\Admin\AppData\Local\Temp\c9a9f77499cefd78fec07f20c715e318c8c557cceb53934c7c82347563aa7aa0Srv.exe
          • Size 55KB
          • SHA256 fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Logo1_.exe
          • Path C:\Windows\Logo1_.exe
          • Size 26KB
          • SHA256 c4a9a61669a0e266374d2d5e0313d2af8e9286e5c401eeea5f510744c04ff74f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _desktop.ini
          • Path F:\$RECYCLE.BIN\S-1-5-21-2818691465-3043947619-2475182763-1000\_desktop.ini
          • Size 9B
          • SHA256 a81f7465f537233bbd4b8fa9034e52a8ceffcdf97bf36244c4d404ebec14eb24
          • MD5 SHA1 SHA512
          Submit Download

          memory/1396-23-0x0000000000400000-0x000000000042E000-memory.dmp
          Download

          memory/1396-29-0x0000000000400000-0x000000000042E000-memory.dmp
          Download

          memory/1396-22-0x0000000000560000-0x000000000056F000-memory.dmp
          Download

          memory/1472-32-0x00000000006B0000-0x00000000006B1000-memory.dmp
          Download

          memory/1472-33-0x0000000077902000-0x0000000077903000-memory.dmp
          Download

          memory/1472-34-0x0000000077902000-0x0000000077903000-memory.dmp
          Download

          memory/1472-28-0x0000000000400000-0x000000000042E000-memory.dmp
          Download

          memory/1472-31-0x0000000000400000-0x000000000042E000-memory.dmp
          Download

          memory/1592-38-0x0000000000620000-0x0000000000772000-memory.dmp
          Download

          memory/1592-18-0x0000000000620000-0x0000000000772000-memory.dmp
          Download

          memory/1980-0-0x0000000000400000-0x0000000000434000-memory.dmp
          Download

          memory/1980-9-0x0000000000400000-0x0000000000434000-memory.dmp
          Download

          memory/3196-64-0x0000000000400000-0x0000000000434000-memory.dmp
          Download

          memory/3196-70-0x0000000000400000-0x0000000000434000-memory.dmp
          Download

          memory/3196-47-0x0000000000400000-0x0000000000434000-memory.dmp
          Download

          memory/3196-185-0x0000000000400000-0x0000000000434000-memory.dmp
          Download

          memory/3196-1285-0x0000000000400000-0x0000000000434000-memory.dmp
          Download

          memory/3196-12-0x0000000000400000-0x0000000000434000-memory.dmp
          Download

          memory/3196-4853-0x0000000000400000-0x0000000000434000-memory.dmp
          Download

          memory/3196-37-0x0000000000400000-0x0000000000434000-memory.dmp
          Download

          memory/3196-5318-0x0000000000400000-0x0000000000434000-memory.dmp
          Download