Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
08/08/2024, 20:37
Behavioral task
behavioral1
Sample
rameater.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
rameater.exe
-
Size
1.6MB
-
MD5
d8f49772ad5995534a0a1890a5c25d9c
-
SHA1
bb8bcb70c6870741ea9687fd262618597a87e2ea
-
SHA256
d5e74ad32c497ff7347561674d2eb03a5d493fbdd933fc9b623a987207748937
-
SHA512
f4185836a62e73c517b12ae68af026ddc3c2994956ecbe41098885f56198a212e73621baadfcb60427fe54dc0fed8c76c03117ad581c82a138c96337a6e14814
-
SSDEEP
24576:b5WfQ4b7d78vy6TozJK9dBCYmYmC7VpaQk0bITxpXYyTweBtm5oS7F7mwgBj3okF:bgnp8a6UzSACVQGSvXDTwekoS5mxLF
Score
1/10
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 29 IoCs
pid Process 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2560 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2560 taskmgr.exe Token: SeSystemProfilePrivilege 2560 taskmgr.exe Token: SeCreateGlobalPrivilege 2560 taskmgr.exe -
Suspicious use of FindShellTrayWindow 39 IoCs
pid Process 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe -
Suspicious use of SendNotifyMessage 39 IoCs
pid Process 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\rameater.exe"C:\Users\Admin\AppData\Local\Temp\rameater.exe"1⤵PID:2236
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2560
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\rameater.exe"C:\Users\Admin\AppData\Local\Temp\rameater.exe"1⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\rameater.exe"C:\Users\Admin\AppData\Local\Temp\rameater.exe"1⤵PID:1708