ramnit | c39a02d65e046ab3f46ee1f2315e17b8bf3b748af294d68d0d1a7d8c2f3252d8

General

Target

c39a02d65e046ab3f46ee1f2315e17b8bf3b748af294d68d0d1a7d8c2f3252d8.dll
Size

157KB
MD5

5d5bed54a20709d639a8cccb47b87c47
SHA1

e98c5f4d7139731abf1ec3ad305c991af6eebb15
SHA256

c39a02d65e046ab3f46ee1f2315e17b8bf3b748af294d68d0d1a7d8c2f3252d8
SHA512

7193a0ec1bfa0f6f1d72fd57a2be46cb6d2e14aacce1e45c6069bacb82ef5ed8d385acd63f48ff08179dacca6a6a8cd96cb1e67a2e4153dbaf6b059099dcccd6
SSDEEP

3072:IMr6N9WfdNAbxBk69VyZhDsHYZ3rDINcQR0n6ecZdGU1QLaLNmYqhPzxm1p:IMqWfdNANG6yEYZ7DVQgsQLPzo1p

Score

10^/10

ramnit banker persistence spyware stealer trojan upx worm

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe"	svchost.exe

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

UPX dump on OEP (original entry point) 13 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3044-23-0x0000000000400000-0x0000000000421000-memory.dmp	UPX
behavioral1/memory/3044-31-0x0000000000400000-0x0000000000421000-memory.dmp	UPX
behavioral1/memory/3032-86-0x0000000000400000-0x0000000000433000-memory.dmp	UPX
behavioral1/memory/3068-78-0x0000000000400000-0x0000000000421000-memory.dmp	UPX
behavioral1/memory/1088-41-0x0000000000400000-0x0000000000421000-memory.dmp	UPX
behavioral1/memory/3044-40-0x0000000000400000-0x0000000000421000-memory.dmp	UPX
behavioral1/memory/1088-38-0x0000000000400000-0x0000000000423000-memory.dmp	UPX
behavioral1/memory/3044-30-0x0000000000400000-0x0000000000421000-memory.dmp	UPX
behavioral1/memory/3044-25-0x0000000000400000-0x0000000000421000-memory.dmp	UPX
behavioral1/memory/3044-24-0x0000000000400000-0x0000000000421000-memory.dmp	UPX
behavioral1/memory/1756-136-0x0000000000400000-0x0000000000421000-memory.dmp	UPX
behavioral1/memory/3032-184-0x0000000000400000-0x0000000000421000-memory.dmp	UPX
behavioral1/memory/2772-183-0x0000000000400000-0x0000000000421000-memory.dmp	UPX

Executes dropped EXE 6 IoCs

Processes:

rundll32mgr.exerundll32mgrmgr.exeWaterMark.exeWaterMarkmgr.exeWaterMark.exeWaterMark.exe

pid process

3044 rundll32mgr.exe
1088 rundll32mgrmgr.exe
2772 WaterMark.exe
3068 WaterMarkmgr.exe
3032 WaterMark.exe
1756 WaterMark.exe

pid	process
3044	rundll32mgr.exe
1088	rundll32mgrmgr.exe
2772	WaterMark.exe
3068	WaterMarkmgr.exe
3032	WaterMark.exe
1756	WaterMark.exe

Loads dropped DLL 12 IoCs

Processes:

rundll32.exerundll32mgr.exeWaterMark.exeWaterMarkmgr.exerundll32mgrmgr.exe

pid	process
2996	rundll32.exe
2996	rundll32.exe
3044	rundll32mgr.exe
3044	rundll32mgr.exe
3044	rundll32mgr.exe
3044	rundll32mgr.exe
2772	WaterMark.exe
2772	WaterMark.exe
3068	WaterMarkmgr.exe
3068	WaterMarkmgr.exe
1088	rundll32mgrmgr.exe
1088	rundll32mgrmgr.exe

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/3044-22-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/3044-23-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/3044-31-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/3032-86-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/3068-78-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/3068-70-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/1088-41-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/3044-40-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1088-38-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/3044-30-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/3044-25-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/3044-24-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1756-136-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/3032-184-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2772-183-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Drops file in System32 directory 4 IoCs

Processes:

rundll32.exerundll32mgr.exesvchost.exe

description	ioc	process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe
File created	C:\Windows\SysWOW64\rundll32mgrmgr.exe	rundll32mgr.exe
File created	C:\Windows\SysWOW64\dmlconf.dat	svchost.exe
File opened for modification	C:\Windows\SysWOW64\dmlconf.dat	svchost.exe

Drops file in Program Files directory 64 IoCs

Processes:

svchost.exerundll32mgr.exe

description	ioc	process
File opened for modification	C:\Program Files\VideoLAN\VLC\npvlc.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libsamplerate_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\InkDiv.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jli.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\epl-v10.html	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\mlib_image.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Services.Design.resources.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\settings.html	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\mip.exe	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSPTLS.DLL	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEODDBS.DLL	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\mojo_core.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\about.html	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libsatip_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libswscale_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libmirror_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\w2k_lsa_auth.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\management.dll	svchost.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\IEAWSDC.DLL	svchost.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\MSOHEVI.DLL	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_avi_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\journal.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\npt.dll	svchost.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libmod_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.Speech.resources.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\WindowsFormsIntegration.resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libsubtitle_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_dirac_plugin.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Help\1049\hxdsui.dll	svchost.exe
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	rundll32mgr.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\license.html	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_dummy_plugin.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\mshwgst.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\ssvagent.exe	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libantiflicker_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Media Player\WMPSideShowGadget.exe	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\clock.html	svchost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Esl\AiodLite.dll	svchost.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dt_socket.dll	svchost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nssckbi.dll	svchost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\xul.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\librv32_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_output\libdirect3d11_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\settings.html	svchost.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\msdaosp.dll	svchost.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\MSOHEV.DLL	svchost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libshm_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_wav_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Internet Explorer\JSProfilerCore.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_av1_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\misc\libgnutls_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\about.html	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationProvider.resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libttml_plugin.dll	svchost.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

WaterMark.exeWaterMark.exe

pid	process
2772	WaterMark.exe
2772	WaterMark.exe
3032	WaterMark.exe
3032	WaterMark.exe
2772	WaterMark.exe
3032	WaterMark.exe
3032	WaterMark.exe
2772	WaterMark.exe
3032	WaterMark.exe
2772	WaterMark.exe
3032	WaterMark.exe
2772	WaterMark.exe
3032	WaterMark.exe
2772	WaterMark.exe
2772	WaterMark.exe
3032	WaterMark.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

rundll32.exeWaterMark.exeWaterMark.exesvchost.exesvchost.exe

description	pid	process
Token: SeDebugPrivilege	2996	rundll32.exe
Token: SeDebugPrivilege	2772	WaterMark.exe
Token: SeDebugPrivilege	3032	WaterMark.exe
Token: SeDebugPrivilege	1236	svchost.exe
Token: SeDebugPrivilege	3012	svchost.exe

Suspicious use of UnmapMainImage 6 IoCs

Processes:

rundll32mgr.exerundll32mgrmgr.exeWaterMarkmgr.exeWaterMark.exeWaterMark.exeWaterMark.exe

pid process

3044 rundll32mgr.exe
1088 rundll32mgrmgr.exe
3068 WaterMarkmgr.exe
2772 WaterMark.exe
3032 WaterMark.exe
1756 WaterMark.exe

pid	process
3044	rundll32mgr.exe
1088	rundll32mgrmgr.exe
3068	WaterMarkmgr.exe
2772	WaterMark.exe
3032	WaterMark.exe
1756	WaterMark.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

rundll32.exerundll32.exerundll32mgr.exeWaterMark.exeWaterMarkmgr.exeWaterMark.exerundll32mgrmgr.exe

description	pid	process	target process
PID 2984 wrote to memory of 2996	2984	rundll32.exe	rundll32.exe
PID 2984 wrote to memory of 2996	2984	rundll32.exe	rundll32.exe
PID 2984 wrote to memory of 2996	2984	rundll32.exe	rundll32.exe
PID 2984 wrote to memory of 2996	2984	rundll32.exe	rundll32.exe
PID 2984 wrote to memory of 2996	2984	rundll32.exe	rundll32.exe
PID 2984 wrote to memory of 2996	2984	rundll32.exe	rundll32.exe
PID 2984 wrote to memory of 2996	2984	rundll32.exe	rundll32.exe
PID 2996 wrote to memory of 3044	2996	rundll32.exe	rundll32mgr.exe
PID 2996 wrote to memory of 3044	2996	rundll32.exe	rundll32mgr.exe
PID 2996 wrote to memory of 3044	2996	rundll32.exe	rundll32mgr.exe
PID 2996 wrote to memory of 3044	2996	rundll32.exe	rundll32mgr.exe
PID 3044 wrote to memory of 1088	3044	rundll32mgr.exe	rundll32mgrmgr.exe
PID 3044 wrote to memory of 1088	3044	rundll32mgr.exe	rundll32mgrmgr.exe
PID 3044 wrote to memory of 1088	3044	rundll32mgr.exe	rundll32mgrmgr.exe
PID 3044 wrote to memory of 1088	3044	rundll32mgr.exe	rundll32mgrmgr.exe
PID 3044 wrote to memory of 2772	3044	rundll32mgr.exe	WaterMark.exe
PID 3044 wrote to memory of 2772	3044	rundll32mgr.exe	WaterMark.exe
PID 3044 wrote to memory of 2772	3044	rundll32mgr.exe	WaterMark.exe
PID 3044 wrote to memory of 2772	3044	rundll32mgr.exe	WaterMark.exe
PID 2772 wrote to memory of 3068	2772	WaterMark.exe	WaterMarkmgr.exe
PID 2772 wrote to memory of 3068	2772	WaterMark.exe	WaterMarkmgr.exe
PID 2772 wrote to memory of 3068	2772	WaterMark.exe	WaterMarkmgr.exe
PID 2772 wrote to memory of 3068	2772	WaterMark.exe	WaterMarkmgr.exe
PID 3068 wrote to memory of 3032	3068	WaterMarkmgr.exe	WaterMark.exe
PID 3068 wrote to memory of 3032	3068	WaterMarkmgr.exe	WaterMark.exe
PID 3068 wrote to memory of 3032	3068	WaterMarkmgr.exe	WaterMark.exe
PID 3068 wrote to memory of 3032	3068	WaterMarkmgr.exe	WaterMark.exe
PID 2772 wrote to memory of 2836	2772	WaterMark.exe	svchost.exe
PID 2772 wrote to memory of 2836	2772	WaterMark.exe	svchost.exe
PID 2772 wrote to memory of 2836	2772	WaterMark.exe	svchost.exe
PID 2772 wrote to memory of 2836	2772	WaterMark.exe	svchost.exe
PID 2772 wrote to memory of 2836	2772	WaterMark.exe	svchost.exe
PID 2772 wrote to memory of 2836	2772	WaterMark.exe	svchost.exe
PID 2772 wrote to memory of 2836	2772	WaterMark.exe	svchost.exe
PID 2772 wrote to memory of 2836	2772	WaterMark.exe	svchost.exe
PID 2772 wrote to memory of 2836	2772	WaterMark.exe	svchost.exe
PID 2772 wrote to memory of 2836	2772	WaterMark.exe	svchost.exe
PID 3032 wrote to memory of 2792	3032	WaterMark.exe	svchost.exe
PID 3032 wrote to memory of 2792	3032	WaterMark.exe	svchost.exe
PID 3032 wrote to memory of 2792	3032	WaterMark.exe	svchost.exe
PID 3032 wrote to memory of 2792	3032	WaterMark.exe	svchost.exe
PID 3032 wrote to memory of 2792	3032	WaterMark.exe	svchost.exe
PID 3032 wrote to memory of 2792	3032	WaterMark.exe	svchost.exe
PID 3032 wrote to memory of 2792	3032	WaterMark.exe	svchost.exe
PID 3032 wrote to memory of 2792	3032	WaterMark.exe	svchost.exe
PID 3032 wrote to memory of 2792	3032	WaterMark.exe	svchost.exe
PID 3032 wrote to memory of 2792	3032	WaterMark.exe	svchost.exe
PID 1088 wrote to memory of 1756	1088	rundll32mgrmgr.exe	WaterMark.exe
PID 1088 wrote to memory of 1756	1088	rundll32mgrmgr.exe	WaterMark.exe
PID 1088 wrote to memory of 1756	1088	rundll32mgrmgr.exe	WaterMark.exe
PID 1088 wrote to memory of 1756	1088	rundll32mgrmgr.exe	WaterMark.exe
PID 2772 wrote to memory of 1236	2772	WaterMark.exe	svchost.exe
PID 2772 wrote to memory of 1236	2772	WaterMark.exe	svchost.exe
PID 2772 wrote to memory of 1236	2772	WaterMark.exe	svchost.exe
PID 3032 wrote to memory of 3012	3032	WaterMark.exe	svchost.exe
PID 2772 wrote to memory of 1236	2772	WaterMark.exe	svchost.exe
PID 3032 wrote to memory of 3012	3032	WaterMark.exe	svchost.exe
PID 3032 wrote to memory of 3012	3032	WaterMark.exe	svchost.exe
PID 3032 wrote to memory of 3012	3032	WaterMark.exe	svchost.exe
PID 3032 wrote to memory of 3012	3032	WaterMark.exe	svchost.exe
PID 3032 wrote to memory of 3012	3032	WaterMark.exe	svchost.exe
PID 3032 wrote to memory of 3012	3032	WaterMark.exe	svchost.exe
PID 3032 wrote to memory of 3012	3032	WaterMark.exe	svchost.exe
PID 3032 wrote to memory of 3012	3032	WaterMark.exe	svchost.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c39a02d65e046ab3f46ee1f2315e17b8bf3b748af294d68d0d1a7d8c2f3252d8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2984

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c39a02d65e046ab3f46ee1f2315e17b8bf3b748af294d68d0d1a7d8c2f3252d8.dll,#1
2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2996

C:\Windows\SysWOW64\rundll32mgr.exe
C:\Windows\SysWOW64\rundll32mgr.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3044

C:\Windows\SysWOW64\rundll32mgrmgr.exe
C:\Windows\SysWOW64\rundll32mgrmgr.exe
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1088

C:\Program Files (x86)\Microsoft\WaterMark.exe
"C:\Program Files (x86)\Microsoft\WaterMark.exe"
5⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:1756

C:\Program Files (x86)\Microsoft\WaterMark.exe
"C:\Program Files (x86)\Microsoft\WaterMark.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2772

C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe
"C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3068

C:\Program Files (x86)\Microsoft\WaterMark.exe
"C:\Program Files (x86)\Microsoft\WaterMark.exe"
6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3032

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
7⤵
PID:2792

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:3012

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
5⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
PID:2836

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1236

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html
Filesize
257KB

MD5
4bf956cab1f157de0a320d8958f05ae3

SHA1
05f83f75d1c3395cafb37ac5382b2b06cca24f1a

SHA256
97e6e44e0d377cb54adcbf33b4f4f7d0dad25cccf46ec416ab0504cde90bc14f

SHA512
a62752aad7cf0487d377e53a3202316c306c825c92e938d5029b1202cdab74d1acdd8ff5da5a4f0d3ac34fb72b5b9c9121e2b37603cf46770d591af217f78882

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html
Filesize
253KB

MD5
7cc001586ba4d2ade489cd45ac7d9489

SHA1
275bb5b4961c6987cbd3175441bd010bb4267091

SHA256
a53ce8d308b05abacf7373b8010fb23555eab6ef1fb151e38bc4554a919b3190

SHA512
6183c19283b44382415138c64d0156eb564c1ad2d4ca416032d66d80714c0b82cbc8a10c70a7199801af232df21eaea6490df4577cecae77042c64a9f2c3663c

Download Submit
\Windows\SysWOW64\rundll32mgr.exe
Filesize
122KB

MD5
c5255edf109342e3e1d1eb0990b2d094

SHA1
ba029b47b9b3a5ccccae3038d90382ec68a1dd44

SHA256
ea49164b416d1b900f80a14f30295ea7d546483a0d7ba8b3a9e48dbcb48a3dc5

SHA512
6b6911ea424763af3ed4964e67aa75d1ffe74551e1e4e12e6220afcda720dbfdda00d744e23486c07701662bac3702220f760d1c86a188772e9bf8af7b64a3a3

Download Submit
\Windows\SysWOW64\rundll32mgrmgr.exe
Filesize
59KB

MD5
f2c8b7e238a07cce22920efb1c8645a6

SHA1
cd2af4b30add747e222f938206b78d7730fdf346

SHA256
6b20b420e84a30df810d52a9b205a3af0f46cafe82bf378867542f15eb64461e

SHA512
c4b9c8c3dccaa39b5ac1faea7e92b0e1d391f0943989178634992be07c40be15b8543f9c6746ab6a5a7136ea00e3c0818fc43bc2eee4e5d282c3cbf7ea279699

Download Submit
memory/1088-128-0x0000000000050000-0x0000000000083000-memory.dmp

Filesize
204KB

Download
memory/1088-41-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1088-129-0x0000000000050000-0x0000000000083000-memory.dmp

Filesize
204KB

Download
memory/1088-38-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1756-136-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2772-79-0x0000000000050000-0x0000000000051000-memory.dmp

Filesize
4KB

Download
memory/2772-51-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2772-68-0x0000000000120000-0x0000000000143000-memory.dmp

Filesize
140KB

Download
memory/2772-183-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2772-69-0x0000000000120000-0x0000000000143000-memory.dmp

Filesize
140KB

Download
memory/2836-110-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2836-89-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2836-114-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2836-91-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2996-12-0x0000000077190000-0x0000000077191000-memory.dmp

Filesize
4KB

Download
memory/2996-2-0x0000000010000000-0x000000001002B000-memory.dmp

Filesize
172KB

Download
memory/2996-11-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/2996-10-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/2996-3-0x0000000000170000-0x00000000001A3000-memory.dmp

Filesize
204KB

Download
memory/3032-86-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3032-184-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3044-25-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3044-30-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3044-40-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3044-24-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3044-39-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/3044-31-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3044-23-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3044-22-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3044-15-0x00000000001A0000-0x00000000001C3000-memory.dmp

Filesize
140KB

Download
memory/3068-70-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3068-78-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads