Analysis

  • max time kernel
    81s
  • max time network
    106s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-06-2024 03:31

General

  • Target

    d0f205847003aab8bdb5dfc2f138a497ec56a5ab0e184bda67efebaeefa1a862.dll

  • Size

    677KB

  • MD5

    a4de91735cad51050bc92815bee5d1aa

  • SHA1

    382dcb85639c2c8282780fb2b53f47147bda7005

  • SHA256

    d0f205847003aab8bdb5dfc2f138a497ec56a5ab0e184bda67efebaeefa1a862

  • SHA512

    e6090d8694c83f9afc333844b74be3572ed8f65229ba980abf85ad4cbffd05cdc94db455656282b45451083e2e5f2d4c399df6ba5409577ad2fe025abe2fc3f3

  • SSDEEP

    6144:/NIQzLZN4k3WvmRPLx+xXqOkyWh9ZN/c4bsXdHtVHs7ZYkJH1:/NIyZN4+Wv4PLq6Okrh9ZN/hs9DsdY41

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • UPX dump on OEP (original entry point) 10 IoCs
  • Executes dropped EXE 2 IoCs
  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Program crash 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\d0f205847003aab8bdb5dfc2f138a497ec56a5ab0e184bda67efebaeefa1a862.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3200
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\d0f205847003aab8bdb5dfc2f138a497ec56a5ab0e184bda67efebaeefa1a862.dll,#1
      2⤵
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:4912
      • C:\Windows\SysWOW64\rundll32mgr.exe
        C:\Windows\SysWOW64\rundll32mgr.exe
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Suspicious use of UnmapMainImage
        • Suspicious use of WriteProcessMemory
        PID:2556
        • C:\Program Files (x86)\Microsoft\WaterMark.exe
          "C:\Program Files (x86)\Microsoft\WaterMark.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of UnmapMainImage
          • Suspicious use of WriteProcessMemory
          PID:3472
          • C:\Windows\SysWOW64\svchost.exe
            C:\Windows\system32\svchost.exe
            5⤵
              PID:2904
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2904 -s 204
                6⤵
                • Program crash
                PID:4744
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe"
              5⤵
              • Modifies Internet Explorer settings
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:3940
              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3940 CREDAT:17410 /prefetch:2
                6⤵
                • Modifies Internet Explorer settings
                • Suspicious use of SetWindowsHookEx
                PID:1356
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe"
              5⤵
              • Modifies Internet Explorer settings
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:1192
              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1192 CREDAT:17410 /prefetch:2
                6⤵
                • Modifies Internet Explorer settings
                • Suspicious use of SetWindowsHookEx
                PID:4692
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4912 -s 608
          3⤵
          • Program crash
          PID:3460
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4912 -ip 4912
      1⤵
        PID:2448
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2904 -ip 2904
        1⤵
          PID:4184

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{1580C91B-27A3-11EF-9519-5ABC67A14C95}.dat

          Filesize

          3KB

          MD5

          ac64751a513a4951f741986ae8f2eb37

          SHA1

          972b7df70e8fea1490726f7766e4019f63c2d624

          SHA256

          43b09f29cbe78cb5d9ceb517f1dd08162218d421448fa5decb7f0ecb9288cea4

          SHA512

          6b72b7bb317f78399b7b9a260b4db9abc8871db170178d28b8c56a81b1de61fbb67a1f5dc0e392ada10e3c68fa20d45c2912368ab2f649a0de663f0628baf5a6

        • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{15858DEC-27A3-11EF-9519-5ABC67A14C95}.dat

          Filesize

          5KB

          MD5

          4d70946c281275ef314e353f83923880

          SHA1

          56ebe79fcdc34b84f2261406c547845c01b9a967

          SHA256

          2468c92d76e77c3db8df6183987b8af8b19be90a8ed30bc398c6557767bf41bd

          SHA512

          d95776e65d6d5247cb2b3bdf5e9fc604b877dd9c546c6e7c46bb519e0b0717a4686cb0f74f4211508242701fd76aa7dd02a12533257ee89d0d858659d3438951

        • C:\Windows\SysWOW64\rundll32mgr.exe

          Filesize

          92KB

          MD5

          8499caf4ab80f33508daa32513cc1c7e

          SHA1

          d252d6bad7adce4ffe5c2795fb1e5e6fcca7cbd2

          SHA256

          22a4a2fab776db0d00df29a577b354ba8d775c434b1e88ce4835c6f2e5b4cbd1

          SHA512

          cea57e7540550dc1a88933f5e37a473266892a00da754e8d86519cda4a15cde78915cfe619f9b52d48569627ee8fec51eba4b64bf5ca316874c970113e8a0873

        • memory/2556-12-0x0000000000400000-0x0000000000421000-memory.dmp

          Filesize

          132KB

        • memory/2556-4-0x0000000000400000-0x0000000000426000-memory.dmp

          Filesize

          152KB

        • memory/2556-11-0x0000000000400000-0x0000000000421000-memory.dmp

          Filesize

          132KB

        • memory/2556-6-0x0000000000400000-0x0000000000421000-memory.dmp

          Filesize

          132KB

        • memory/2556-7-0x0000000000400000-0x0000000000421000-memory.dmp

          Filesize

          132KB

        • memory/2556-8-0x0000000000400000-0x0000000000421000-memory.dmp

          Filesize

          132KB

        • memory/2556-9-0x0000000000400000-0x0000000000421000-memory.dmp

          Filesize

          132KB

        • memory/2556-10-0x0000000000400000-0x0000000000421000-memory.dmp

          Filesize

          132KB

        • memory/2556-13-0x0000000002850000-0x0000000002851000-memory.dmp

          Filesize

          4KB

        • memory/2904-32-0x0000000000B30000-0x0000000000B31000-memory.dmp

          Filesize

          4KB

        • memory/2904-33-0x0000000000B10000-0x0000000000B11000-memory.dmp

          Filesize

          4KB

        • memory/3472-26-0x00000000008E0000-0x00000000008E1000-memory.dmp

          Filesize

          4KB

        • memory/3472-27-0x0000000000400000-0x0000000000421000-memory.dmp

          Filesize

          132KB

        • memory/3472-29-0x0000000000400000-0x0000000000426000-memory.dmp

          Filesize

          152KB

        • memory/3472-30-0x0000000000400000-0x0000000000421000-memory.dmp

          Filesize

          132KB

        • memory/3472-36-0x0000000077BC2000-0x0000000077BC3000-memory.dmp

          Filesize

          4KB

        • memory/3472-35-0x0000000000070000-0x0000000000071000-memory.dmp

          Filesize

          4KB

        • memory/3472-31-0x0000000077BC2000-0x0000000077BC3000-memory.dmp

          Filesize

          4KB

        • memory/3472-40-0x0000000000400000-0x0000000000421000-memory.dmp

          Filesize

          132KB

        • memory/4912-34-0x0000000010000000-0x00000000100AF000-memory.dmp

          Filesize

          700KB

        • memory/4912-3-0x0000000010000000-0x00000000100AF000-memory.dmp

          Filesize

          700KB