Analysis

  • max time kernel
    73s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    03/10/2024, 22:01

General

  • Target

    76bed869ea5c171ad0dd786c3b75ff8c5290934fabf9a3c3ac5b977935a2acebN.dll

  • Size

    258KB

  • MD5

    fe245609196ce4266a2e2105b6bafac0

  • SHA1

    8f878a52f96c493a2cd3924fd87f2e867cc3ca2d

  • SHA256

    76bed869ea5c171ad0dd786c3b75ff8c5290934fabf9a3c3ac5b977935a2aceb

  • SHA512

    7267e1db624800c1c1ac5c7db4a02ddb7a0ac9d148af2b232c0c5ce85bd90fb96c060d9b7f064fed1aa547b1eebab4fb2b6c9d54d9b47c6455cb82a4d3c0277d

  • SSDEEP

    3072:rwDmd9B62lcxtzCqc5ZyTvmhRQnuWAs4Jln5jX8KSOmBeMrm9slo0aof87:f98xtzM5QrmhR/Vln5jMKayuGPe87

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 5 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\76bed869ea5c171ad0dd786c3b75ff8c5290934fabf9a3c3ac5b977935a2acebN.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2148
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\76bed869ea5c171ad0dd786c3b75ff8c5290934fabf9a3c3ac5b977935a2acebN.dll,#1
      2⤵
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2184
      • C:\Windows\SysWOW64\rundll32mgr.exe
        C:\Windows\SysWOW64\rundll32mgr.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2844
        • C:\Windows\SysWOW64\rundll32mgr.exe
          "C:\Windows\SysWOW64\rundll32mgr.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2684
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 100
            5⤵
            • Program crash
            PID:2672

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Users\Admin\AppData\Local\Temp\~TMEBD5.tmp

          Filesize

          1.2MB

          MD5

          d124f55b9393c976963407dff51ffa79

          SHA1

          2c7bbedd79791bfb866898c85b504186db610b5d

          SHA256

          ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef

          SHA512

          278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06

        • \Users\Admin\AppData\Local\Temp\~TMEC43.tmp

          Filesize

          1.1MB

          MD5

          9b98d47916ead4f69ef51b56b0c2323c

          SHA1

          290a80b4ded0efc0fd00816f373fcea81a521330

          SHA256

          96e0ae104c9662d0d20fdf59844c2d18334e5847b6c4fc7f8ce4b3b87f39887b

          SHA512

          68b67021f228d8d71df4deb0b6388558b2f935a6aa466a12199cd37ada47ee588ea407b278d190d3a498b0ef3f5f1a2573a469b7ea5561ab2e7055c45565fe94

        • \Windows\SysWOW64\rundll32mgr.exe

          Filesize

          148KB

          MD5

          a758bae992041958e59e16e303fccb6e

          SHA1

          ed836b5a0d9af7107b86969691078bf9eebf9a3c

          SHA256

          393f0b4ef739ec6b1f6eb242586d40e7d927211d6c6100fa1f3642a76a83b615

          SHA512

          8e4efadbe72e6a6eec55a81d075fc903c32f46ca950989c7029c3df3bb6a7adef97d69bbc5d93fff38dc5aed18fa011efbb31d39f440f2003b73ff5a280bf48a

        • memory/2184-2-0x00000000627F0000-0x0000000062835000-memory.dmp

          Filesize

          276KB

        • memory/2184-1-0x00000000627F0000-0x0000000062835000-memory.dmp

          Filesize

          276KB

        • memory/2184-10-0x00000000001C0000-0x0000000000212000-memory.dmp

          Filesize

          328KB

        • memory/2684-33-0x000000007734F000-0x0000000077351000-memory.dmp

          Filesize

          8KB

        • memory/2684-41-0x0000000074DD0000-0x0000000074EE0000-memory.dmp

          Filesize

          1.1MB

        • memory/2684-21-0x0000000000400000-0x0000000000463000-memory.dmp

          Filesize

          396KB

        • memory/2684-26-0x0000000000400000-0x0000000000463000-memory.dmp

          Filesize

          396KB

        • memory/2684-44-0x0000000074DD0000-0x0000000074EE0000-memory.dmp

          Filesize

          1.1MB

        • memory/2684-30-0x0000000000400000-0x0000000000463000-memory.dmp

          Filesize

          396KB

        • memory/2684-25-0x0000000000400000-0x0000000000463000-memory.dmp

          Filesize

          396KB

        • memory/2684-24-0x0000000000400000-0x0000000000463000-memory.dmp

          Filesize

          396KB

        • memory/2684-17-0x0000000000400000-0x0000000000463000-memory.dmp

          Filesize

          396KB

        • memory/2684-42-0x0000000000400000-0x0000000000463000-memory.dmp

          Filesize

          396KB

        • memory/2684-34-0x0000000077350000-0x0000000077351000-memory.dmp

          Filesize

          4KB

        • memory/2684-35-0x0000000077350000-0x0000000077352000-memory.dmp

          Filesize

          8KB

        • memory/2684-40-0x0000000074E64000-0x0000000074E65000-memory.dmp

          Filesize

          4KB

        • memory/2684-19-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

        • memory/2844-12-0x0000000000020000-0x0000000000023000-memory.dmp

          Filesize

          12KB

        • memory/2844-11-0x0000000000400000-0x0000000000452000-memory.dmp

          Filesize

          328KB

        • memory/2844-29-0x0000000000400000-0x0000000000452000-memory.dmp

          Filesize

          328KB