Analysis

  • max time kernel
    93s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-06-2024 02:36

General

  • Target

    bc8f1f867b2e6c7d90ee8db77ce5e6e7bb14fabbe9cf4b53092b8915c59eb572.dll

  • Size

    719KB

  • MD5

    bcbf9d2fc64727580c2f6b88f965b980

  • SHA1

    381e0beb7ec08a8be2ce29c5c34825ab7cac0345

  • SHA256

    bc8f1f867b2e6c7d90ee8db77ce5e6e7bb14fabbe9cf4b53092b8915c59eb572

  • SHA512

    b61458a57d3d911b47fa00812602c91c1bcf1f8559d7c36ac1a440ca5f651a1f315e9aaea3d01316a5566c60d826afbcf03b91ff86480538ceb585b4cdfd1287

  • SSDEEP

    12288:Fd4V2aZv2JArDRsYoQyErEjWiB26w8CXlYiCDXfL10u5Tu0X:Fd4rZiwDRsYP7rECiBrwllYTDjuu5y0

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • UPX dump on OEP (original entry point) 7 IoCs
  • Executes dropped EXE 2 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Program crash 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 30 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\bc8f1f867b2e6c7d90ee8db77ce5e6e7bb14fabbe9cf4b53092b8915c59eb572.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4724
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\bc8f1f867b2e6c7d90ee8db77ce5e6e7bb14fabbe9cf4b53092b8915c59eb572.dll,#1
      2⤵
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:3760
      • C:\Windows\SysWOW64\rundll32Srv.exe
        C:\Windows\SysWOW64\rundll32Srv.exe
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:3200
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4120
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2824
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2824 CREDAT:17410 /prefetch:2
              6⤵
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:1688
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3760 -s 608
        3⤵
        • Program crash
        PID:1348
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3760 -ip 3760
    1⤵
      PID:3836

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

      Filesize

      471B

      MD5

      ba5c07e84aaf8703c7f383a82d696ce7

      SHA1

      f51fbe8032555f84974ed041a09cc6211d8ee0af

      SHA256

      088079d3c0c9b9117e2427529a2e6ddd19bd694d1180dabf72cb80dfad1fbad3

      SHA512

      987db2bb8c1a95f754c724f5921152a3e1f6a4ca7b7c79f7b927eca93e9251e73eb91d8a972c094061a8dbfb6ad82e5133ed64ffb7d9c9de946b705f4081d31f

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

      Filesize

      404B

      MD5

      5dfaa62da176a6a869d77122cf106e5f

      SHA1

      37c73985b318d9f74ec30d03acb3cf143cac67f1

      SHA256

      22a060752fcd40a892ca514f92d08682d2500e35ffda05ee9f84d78af0c2cf42

      SHA512

      611b18c3cb99c803d006406eaf9f5c3049daf7d37d2e49835a4d8cfb6ece220ad9438806e8f9c9cbcaa56fa14bd1ca2ef26546a11cd527a26f37b6bceaa81f7a

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TF1TYUIH\suggestions[1].en-US

      Filesize

      17KB

      MD5

      5a34cb996293fde2cb7a4ac89587393a

      SHA1

      3c96c993500690d1a77873cd62bc639b3a10653f

      SHA256

      c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

      SHA512

      e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

    • C:\Windows\SysWOW64\rundll32Srv.exe

      Filesize

      55KB

      MD5

      ff5e1f27193ce51eec318714ef038bef

      SHA1

      b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

      SHA256

      fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

      SHA512

      c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

    • memory/3200-4-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/3200-7-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/3200-6-0x00000000004C0000-0x00000000004CF000-memory.dmp

      Filesize

      60KB

    • memory/3760-2-0x0000000010000000-0x00000000100BA000-memory.dmp

      Filesize

      744KB

    • memory/3760-17-0x0000000010000000-0x00000000100BA000-memory.dmp

      Filesize

      744KB

    • memory/4120-13-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/4120-15-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/4120-14-0x0000000000490000-0x0000000000491000-memory.dmp

      Filesize

      4KB