ramnit | bdf618c3d7bdcab3f3aa43a4337fca9372e35d45523a0030c968dc64c526a949

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 00:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
86d3e319cb2582f566e7741d0300ee40_NeikiAnalytics.dll
Size 157KB
Sample240601-a5e41sbf6x
SHA256 bdf618c3d7bdcab3f3aa43a4337fca9372e35d45523a0030c968dc64c526a949
MD5 86d3e319cb2582f566e7741d0300ee40
SHA1 9f7a58a740db7ebb2f9fe703978b9b192c78c6ac
SHA512 03e9b9761430d8299745818686f0511d39ca22d63aa0663096344fe6c716951c6059551951b7164046cdcb47d4fbf788264c9bbb429de8eed825971446961890
SSDEEP 3072:IMr6N9WfdNAbxBU69VyZhDsHYZ3rDINcQR0n6ecZdGU1QLaLNmYqhPzxm1m:IMqWfdNANO6yEYZ7DVQgsQLPzo1m
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Executes dropped EXE 6 IoCs

pid	Process
3480	rundll32mgr.exe
3596	rundll32mgrmgr.exe
3772	WaterMark.exe
3808	WaterMark.exe
2872	WaterMarkmgr.exe
2164	WaterMark.exe

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3480-18-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/3480-12-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/3480-22-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/3596-31-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/3808-69-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/2872-67-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/2872-60-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/3808-59-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/3772-58-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/3772-42-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/3480-21-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/3480-20-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/3480-17-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/3480-15-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/3808-85-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe
File created	C:\Windows\SysWOW64\rundll32mgrmgr.exe	rundll32mgr.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe	WaterMark.exe
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	WaterMarkmgr.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px49AB.tmp	rundll32mgr.exe
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	rundll32mgr.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px49CA.tmp	rundll32mgrmgr.exe
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	rundll32mgrmgr.exe
File opened for modification	C:\Program Files (x86)\Microsoft\WaterMark.exe	rundll32mgr.exe
File created	C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe	WaterMark.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px4A67.tmp	WaterMarkmgr.exe
File created	C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe	WaterMark.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
3968	4324	WerFault.exe	94
3292	5024	WerFault.exe	91
5092	1192	WerFault.exe	89

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1548133293"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31110077"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423967828"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{87E6A1D6-1FB0-11EF-BCA5-5ABC67A14C95} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31110077"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1552039172"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1552039172"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1548133293"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31110077"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff5800000000000000de04000065020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31110077"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{87EDC83D-1FB0-11EF-BCA5-5ABC67A14C95} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31110077"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1552039172"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{87F02A88-1FB0-11EF-BCA5-5ABC67A14C95} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
3772	WaterMark.exe
3772	WaterMark.exe
3772	WaterMark.exe
3772	WaterMark.exe
3808	WaterMark.exe
3808	WaterMark.exe
3808	WaterMark.exe
3808	WaterMark.exe
2164	WaterMark.exe
2164	WaterMark.exe
2164	WaterMark.exe
2164	WaterMark.exe
3808	WaterMark.exe
3808	WaterMark.exe
3808	WaterMark.exe
3808	WaterMark.exe
3808	WaterMark.exe
3808	WaterMark.exe
3808	WaterMark.exe
3808	WaterMark.exe
3808	WaterMark.exe
3808	WaterMark.exe
3808	WaterMark.exe
3808	WaterMark.exe
3772	WaterMark.exe
3772	WaterMark.exe
3772	WaterMark.exe
3772	WaterMark.exe
3772	WaterMark.exe
3772	WaterMark.exe
3772	WaterMark.exe
3772	WaterMark.exe
3772	WaterMark.exe
3772	WaterMark.exe
3772	WaterMark.exe
3772	WaterMark.exe
2164	WaterMark.exe
2164	WaterMark.exe
2164	WaterMark.exe
2164	WaterMark.exe
2164	WaterMark.exe
2164	WaterMark.exe
2164	WaterMark.exe
2164	WaterMark.exe
2164	WaterMark.exe
2164	WaterMark.exe
2164	WaterMark.exe
2164	WaterMark.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3196	rundll32.exe
Token: SeDebugPrivilege	3772	WaterMark.exe
Token: SeDebugPrivilege	3808	WaterMark.exe
Token: SeDebugPrivilege	2164	WaterMark.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3956	iexplore.exe
1512	iexplore.exe
1156	iexplore.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
1512	iexplore.exe
1512	iexplore.exe
1156	iexplore.exe
1156	iexplore.exe
3956	iexplore.exe
3956	iexplore.exe
1456	IEXPLORE.EXE
1456	IEXPLORE.EXE
1992	IEXPLORE.EXE
1992	IEXPLORE.EXE
2112	IEXPLORE.EXE
2112	IEXPLORE.EXE
1456	IEXPLORE.EXE
1456	IEXPLORE.EXE

Suspicious use of UnmapMainImage 6 IoCs

pid	Process
3480	rundll32mgr.exe
3596	rundll32mgrmgr.exe
3772	WaterMark.exe
3808	WaterMark.exe
2872	WaterMarkmgr.exe
2164	WaterMark.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 3196	2948	rundll32.exe	83
PID 2948 wrote to memory of 3196	2948	rundll32.exe	83
PID 2948 wrote to memory of 3196	2948	rundll32.exe	83
PID 3196 wrote to memory of 3480	3196	rundll32.exe	84
PID 3196 wrote to memory of 3480	3196	rundll32.exe	84
PID 3196 wrote to memory of 3480	3196	rundll32.exe	84
PID 3480 wrote to memory of 3596	3480	rundll32mgr.exe	85
PID 3480 wrote to memory of 3596	3480	rundll32mgr.exe	85
PID 3480 wrote to memory of 3596	3480	rundll32mgr.exe	85
PID 3596 wrote to memory of 3772	3596	rundll32mgrmgr.exe	87
PID 3596 wrote to memory of 3772	3596	rundll32mgrmgr.exe	87
PID 3596 wrote to memory of 3772	3596	rundll32mgrmgr.exe	87
PID 3480 wrote to memory of 3808	3480	rundll32mgr.exe	86
PID 3480 wrote to memory of 3808	3480	rundll32mgr.exe	86
PID 3480 wrote to memory of 3808	3480	rundll32mgr.exe	86
PID 3772 wrote to memory of 2872	3772	WaterMark.exe	88
PID 3772 wrote to memory of 2872	3772	WaterMark.exe	88
PID 3772 wrote to memory of 2872	3772	WaterMark.exe	88
PID 3808 wrote to memory of 1192	3808	WaterMark.exe	89
PID 3808 wrote to memory of 1192	3808	WaterMark.exe	89
PID 3808 wrote to memory of 1192	3808	WaterMark.exe	89
PID 3808 wrote to memory of 1192	3808	WaterMark.exe	89
PID 3808 wrote to memory of 1192	3808	WaterMark.exe	89
PID 3808 wrote to memory of 1192	3808	WaterMark.exe	89
PID 3808 wrote to memory of 1192	3808	WaterMark.exe	89
PID 3808 wrote to memory of 1192	3808	WaterMark.exe	89
PID 3808 wrote to memory of 1192	3808	WaterMark.exe	89
PID 2872 wrote to memory of 2164	2872	WaterMarkmgr.exe	90
PID 2872 wrote to memory of 2164	2872	WaterMarkmgr.exe	90
PID 2872 wrote to memory of 2164	2872	WaterMarkmgr.exe	90
PID 3772 wrote to memory of 5024	3772	WaterMark.exe	91
PID 3772 wrote to memory of 5024	3772	WaterMark.exe	91
PID 3772 wrote to memory of 5024	3772	WaterMark.exe	91
PID 3772 wrote to memory of 5024	3772	WaterMark.exe	91
PID 3772 wrote to memory of 5024	3772	WaterMark.exe	91
PID 3772 wrote to memory of 5024	3772	WaterMark.exe	91
PID 3772 wrote to memory of 5024	3772	WaterMark.exe	91
PID 3772 wrote to memory of 5024	3772	WaterMark.exe	91
PID 3772 wrote to memory of 5024	3772	WaterMark.exe	91
PID 2164 wrote to memory of 4324	2164	WaterMark.exe	94
PID 2164 wrote to memory of 4324	2164	WaterMark.exe	94
PID 2164 wrote to memory of 4324	2164	WaterMark.exe	94
PID 2164 wrote to memory of 4324	2164	WaterMark.exe	94
PID 2164 wrote to memory of 4324	2164	WaterMark.exe	94
PID 2164 wrote to memory of 4324	2164	WaterMark.exe	94
PID 2164 wrote to memory of 4324	2164	WaterMark.exe	94
PID 2164 wrote to memory of 4324	2164	WaterMark.exe	94
PID 2164 wrote to memory of 4324	2164	WaterMark.exe	94
PID 3808 wrote to memory of 3956	3808	WaterMark.exe	107
PID 3808 wrote to memory of 3956	3808	WaterMark.exe	107
PID 3808 wrote to memory of 1512	3808	WaterMark.exe	108
PID 3808 wrote to memory of 1512	3808	WaterMark.exe	108
PID 3772 wrote to memory of 1156	3772	WaterMark.exe	109
PID 3772 wrote to memory of 1156	3772	WaterMark.exe	109
PID 3772 wrote to memory of 616	3772	WaterMark.exe	110
PID 3772 wrote to memory of 616	3772	WaterMark.exe	110
PID 2164 wrote to memory of 4840	2164	WaterMark.exe	111
PID 2164 wrote to memory of 4840	2164	WaterMark.exe	111
PID 2164 wrote to memory of 1308	2164	WaterMark.exe	112
PID 2164 wrote to memory of 1308	2164	WaterMark.exe	112
PID 1512 wrote to memory of 1992	1512	iexplore.exe	113
PID 1512 wrote to memory of 1992	1512	iexplore.exe	113
PID 1512 wrote to memory of 1992	1512	iexplore.exe	113
PID 1156 wrote to memory of 2112	1156	iexplore.exe	114

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\86d3e319cb2582f566e7741d0300ee40_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\86d3e319cb2582f566e7741d0300ee40_NeikiAnalytics.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3196
- - C:\Windows\SysWOW64\rundll32mgr.exe
    C:\Windows\SysWOW64\rundll32mgr.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Suspicious use of UnmapMainImage
    - Suspicious use of WriteProcessMemory
    PID:3480
  - - C:\Windows\SysWOW64\rundll32mgrmgr.exe
      C:\Windows\SysWOW64\rundll32mgrmgr.exe
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious use of UnmapMainImage
      Suspicious use of WriteProcessMemory
      PID:3596
    - - C:\Program Files (x86)\Microsoft\WaterMark.exe
        
        "C:\Program Files (x86)\Microsoft\WaterMark.exe"
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of UnmapMainImage
        Suspicious use of WriteProcessMemory
        
        PID:3772
      - C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe
        
        "C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe"
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of UnmapMainImage
        Suspicious use of WriteProcessMemory
        
        PID:2872
        
        C:\Program Files (x86)\Microsoft\WaterMark.exe
        
        "C:\Program Files (x86)\Microsoft\WaterMark.exe"
        7⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of UnmapMainImage
        Suspicious use of WriteProcessMemory
        
        PID:2164
        
        C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        8⤵
        
        PID:4324
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 204
        9⤵
        Program crash
        
        PID:3968
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        Modifies Internet Explorer settings
        
        PID:4840
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        Modifies Internet Explorer settings
        
        PID:1308
      - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        6⤵
        
        PID:5024
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 204
        7⤵
        Program crash
        
        PID:3292
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1156
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1156 CREDAT:17410 /prefetch:2
        7⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2112
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        Modifies Internet Explorer settings
        
        PID:616
  - - C:\Program Files (x86)\Microsoft\WaterMark.exe
      "C:\Program Files (x86)\Microsoft\WaterMark.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of UnmapMainImage
      Suspicious use of WriteProcessMemory
      PID:3808
    - - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        5⤵
        
        PID:1192
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1192 -s 204
        6⤵
        Program crash
        
        PID:5092
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:3956
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3956 CREDAT:17410 /prefetch:2
        6⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1456
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1512
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1512 CREDAT:17410 /prefetch:2
        6⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 5024 -ip 5024
1⤵
PID:2568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1192 -ip 1192
1⤵
PID:4512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4324 -ip 4324
1⤵
PID:5044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RecoveryStore.{87E6A1D6-1FB0-11EF-BCA5-5ABC67A14C95}.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{87E6A1D6-1FB0-11EF-BCA5-5ABC67A14C95}.dat
Size 5KB
SHA256 82af3131d31d201abd4e2a4cc46762b16af99a8b4c1bc297f79093881f8bf0fd
MD5 02a815e2499943574e24a640971c3411
SHA1 5ba4a9bdd3a12eeec419c60901da2cbd45d4308c
SHA512 34830f2d41f578ff1bc930e17362fa8436f33143df1642c5e50890c08e888bb404bb97679ca7cedb07d9dc6c92afc13499df23bd9a2bfa0e3ba38b877e8e3b81
SSDEEP 24:r3Go/QHDGo/rq879lW/sKx+E9lW/sKx+x+:r3Go4jGoxCU7U
MD5 SHA1 SHA512 SSDEEP

Submit Download

RecoveryStore.{87EDC83D-1FB0-11EF-BCA5-5ABC67A14C95}.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{87EDC83D-1FB0-11EF-BCA5-5ABC67A14C95}.dat
Size 3KB
SHA256 536e6f74702670eb8109b38ea909fc14b97a938b9a443d6d56374b4f092a8a06
MD5 bb1fbcaf097db7120b935b7d7ac255e7
SHA1 2c4b3c6507d4ffaa1f73f415239a738a4a42bf6d
SHA512 b8fdd57c965f58aa15606f291b04ea7e4315c7aa6debe1c14776da7bac54ceabc669ab1e79aa1d7c59a9b2985ab4ec9a834fae089af51e14d05ae9b3fe22b4f7
MD5 SHA1 SHA512

Submit Download

RecoveryStore.{87EDC83D-1FB0-11EF-BCA5-5ABC67A14C95}.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{87EDC83D-1FB0-11EF-BCA5-5ABC67A14C95}.dat
Size 5KB
SHA256 30828fa1579a9a9ad2279ae5a200cff0fa6e48d9ca587534702e37ba199a5c61
MD5 a5de2e12ce618ce528477572097fd8c0
SHA1 e48fcedc3fcaabf94def91fcce1d726852960770
SHA512 df41490ac256dc36483d57061d488a0c9b95d139912c8e2cfa28c8183133aa223a226fa0bebcb311462787c0f2967b32be92371fdc75e4568112cf28479fa5ab
SSDEEP 24:rPGo/QO3Go/q7879lW0ji7Rik+vv7E9lW0ji7Rik+vv7vv7:rPGo48Go5C02dikUvl02dikUvrv
MD5 SHA1 SHA512 SSDEEP

Submit Download

verCC68.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verCC68.tmp
Size 15KB
SHA256 557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
MD5 1a545d0052b581fbb2ab4c52133846bc
SHA1 62f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA512 bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
SSDEEP 384:79Jv9DF9/C9qc9/J9V791T9TK9Xf9Nm9xQ95a9BR9fV:79Jv9DF9/C9qc9/J9V791T9TK9Xf9NmT
MD5 SHA1 SHA512 SSDEEP

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GOWSKSPC\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
MD5 SHA1 SHA512 SSDEEP

Submit Download

rundll32mgr.exe

Path C:\Windows\SysWOW64\rundll32mgr.exe
Size 122KB
SHA256 ea49164b416d1b900f80a14f30295ea7d546483a0d7ba8b3a9e48dbcb48a3dc5
MD5 c5255edf109342e3e1d1eb0990b2d094
SHA1 ba029b47b9b3a5ccccae3038d90382ec68a1dd44
SHA512 6b6911ea424763af3ed4964e67aa75d1ffe74551e1e4e12e6220afcda720dbfdda00d744e23486c07701662bac3702220f760d1c86a188772e9bf8af7b64a3a3
SSDEEP 3072:VR2xn3k0CdM1vabyzJYWqm9RvJS2HvP2VjcyJH:VR2J0LS6VWvJlvOiuH
MD5 SHA1 SHA512 SSDEEP

Submit Download

rundll32mgrmgr.exe

Path C:\Windows\SysWOW64\rundll32mgrmgr.exe
Size 59KB
SHA256 6b20b420e84a30df810d52a9b205a3af0f46cafe82bf378867542f15eb64461e
MD5 f2c8b7e238a07cce22920efb1c8645a6
SHA1 cd2af4b30add747e222f938206b78d7730fdf346
SHA512 c4b9c8c3dccaa39b5ac1faea7e92b0e1d391f0943989178634992be07c40be15b8543f9c6746ab6a5a7136ea00e3c0818fc43bc2eee4e5d282c3cbf7ea279699
SSDEEP 768:w06R0UKzOgnKqGR7//GPc0LOBhvBrHks3IiyhDYQbGmxlNaM+WGa1wuxnzgOYw9N:+R0vxn3Pc0LCH9MtbvabUDzJYWu3BI
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2164-76-0x0000000000060000-0x0000000000061000-memory.dmp

Download

memory/2872-67-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2872-60-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/3196-5-0x0000000077952000-0x0000000077953000-memory.dmp

Download

memory/3196-3-0x0000000000B90000-0x0000000000B91000-memory.dmp

Download

memory/3196-4-0x0000000000C60000-0x0000000000C61000-memory.dmp

Download

memory/3196-1-0x0000000010000000-0x000000001002B000-memory.dmp

Download

memory/3480-15-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/3480-8-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3480-18-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/3480-12-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/3480-22-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/3480-21-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/3480-20-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/3480-17-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/3480-16-0x0000000000A50000-0x0000000000A51000-memory.dmp

Download

memory/3596-14-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/3596-31-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/3772-42-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3772-79-0x0000000000070000-0x0000000000071000-memory.dmp

Download

memory/3772-57-0x0000000000430000-0x0000000000431000-memory.dmp

Download

memory/3772-58-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/3808-78-0x00000000008D0000-0x00000000008D1000-memory.dmp

Download

memory/3808-69-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/3808-64-0x0000000000830000-0x0000000000831000-memory.dmp

Download

memory/3808-85-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/3808-59-0x0000000000400000-0x0000000000433000-memory.dmp

Download