Analysis

  • max time kernel
    150s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    04/10/2024, 23:16

General

  • Target

    6e20f9687cd7e6e2e7cc956a4f834e079b9cfb53d7db3776f99b0fd4b3fcb196.exe

  • Size

    272KB

  • MD5

    0dafdcef4ed05d008c7fde7bc21daf75

  • SHA1

    18ae591bd31256514b073a22be27c91d0532547b

  • SHA256

    6e20f9687cd7e6e2e7cc956a4f834e079b9cfb53d7db3776f99b0fd4b3fcb196

  • SHA512

    01cf7cedd294e605bc687947f9aea1335addf5593c055d1ee82a7f754fce7280848d5de0862fdde226f6fa83e605571d12686d47bd7fa89c68bcb753f5f6f60a

  • SSDEEP

    3072:YNZEITsAQlhWCcC6uYnF9uAzX/0faAbPy8psrs1BN2JZBS7BtRJQZfwM+ZgAqrPW:0bsAKDSruAj0fasyM34BSvG+Zgfb2CE

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Drops file in System32 directory 2 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 37 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\System32\smss.exe
    \SystemRoot\System32\smss.exe
    1⤵
      PID:256
    • C:\Windows\system32\csrss.exe
      %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
      1⤵
        PID:332
      • C:\Windows\system32\wininit.exe
        wininit.exe
        1⤵
          PID:380
          • C:\Windows\system32\services.exe
            C:\Windows\system32\services.exe
            2⤵
              PID:472
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k DcomLaunch
                3⤵
                  PID:604
                  • C:\Windows\system32\DllHost.exe
                    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                    4⤵
                      PID:2032
                    • C:\Windows\system32\wbem\wmiprvse.exe
                      C:\Windows\system32\wbem\wmiprvse.exe
                      4⤵
                        PID:2236
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k RPCSS
                      3⤵
                        PID:680
                      • C:\Windows\System32\svchost.exe
                        C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
                        3⤵
                          PID:752
                        • C:\Windows\System32\svchost.exe
                          C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
                          3⤵
                            PID:824
                            • C:\Windows\system32\Dwm.exe
                              "C:\Windows\system32\Dwm.exe"
                              4⤵
                                PID:1168
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k netsvcs
                              3⤵
                                PID:868
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k LocalService
                                3⤵
                                  PID:972
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k NetworkService
                                  3⤵
                                    PID:280
                                  • C:\Windows\System32\spoolsv.exe
                                    C:\Windows\System32\spoolsv.exe
                                    3⤵
                                      PID:548
                                    • C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
                                      3⤵
                                        PID:1076
                                      • C:\Windows\system32\taskhost.exe
                                        "taskhost.exe"
                                        3⤵
                                          PID:1116
                                        • C:\Windows\system32\svchost.exe
                                          C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
                                          3⤵
                                            PID:2752
                                          • C:\Windows\system32\sppsvc.exe
                                            C:\Windows\system32\sppsvc.exe
                                            3⤵
                                              PID:2064
                                          • C:\Windows\system32\lsass.exe
                                            C:\Windows\system32\lsass.exe
                                            2⤵
                                              PID:488
                                            • C:\Windows\system32\lsm.exe
                                              C:\Windows\system32\lsm.exe
                                              2⤵
                                                PID:496
                                            • C:\Windows\system32\csrss.exe
                                              %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
                                              1⤵
                                                PID:388
                                              • C:\Windows\system32\winlogon.exe
                                                winlogon.exe
                                                1⤵
                                                  PID:428
                                                • C:\Windows\Explorer.EXE
                                                  C:\Windows\Explorer.EXE
                                                  1⤵
                                                    PID:1200
                                                    • C:\Users\Admin\AppData\Local\Temp\6e20f9687cd7e6e2e7cc956a4f834e079b9cfb53d7db3776f99b0fd4b3fcb196.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\6e20f9687cd7e6e2e7cc956a4f834e079b9cfb53d7db3776f99b0fd4b3fcb196.exe"
                                                      2⤵
                                                      • Loads dropped DLL
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:1544
                                                      • C:\Users\Admin\AppData\Local\Temp\6e20f9687cd7e6e2e7cc956a4f834e079b9cfb53d7db3776f99b0fd4b3fcb196mgr.exe
                                                        C:\Users\Admin\AppData\Local\Temp\6e20f9687cd7e6e2e7cc956a4f834e079b9cfb53d7db3776f99b0fd4b3fcb196mgr.exe
                                                        3⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:2120
                                                        • C:\Program Files (x86)\Microsoft\WaterMark.exe
                                                          "C:\Program Files (x86)\Microsoft\WaterMark.exe"
                                                          4⤵
                                                          • Executes dropped EXE
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:2664
                                                          • C:\Windows\SysWOW64\svchost.exe
                                                            C:\Windows\system32\svchost.exe
                                                            5⤵
                                                            • Modifies WinLogon for persistence
                                                            • Drops file in System32 directory
                                                            • Drops file in Program Files directory
                                                            • System Location Discovery: System Language Discovery
                                                            PID:1304
                                                          • C:\Windows\SysWOW64\svchost.exe
                                                            C:\Windows\system32\svchost.exe
                                                            5⤵
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:1364

                                                  Network

                                                        MITRE ATT&CK Enterprise v15

                                                        Replay Monitor

                                                        Loading Replay Monitor...

                                                        Downloads

                                                        • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

                                                          Filesize

                                                          148KB

                                                          MD5

                                                          6f4527567d51a76653c53bb6b7ddb825

                                                          SHA1

                                                          d63a4c65d0594d450130946f8620cc1621c8a689

                                                          SHA256

                                                          ae34e0e853f03abe57973833725b39c91e4c6d9a899325fcb375b4a474b49b5e

                                                          SHA512

                                                          19b9e677c3ca8582e046481a1f85524454b873d3e598949d31007e8413ad127dd8c72c3b8af379f54a736fd220acd3acaead6f0ef327a8326746ea69658fdcce

                                                        • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

                                                          Filesize

                                                          144KB

                                                          MD5

                                                          4e0ed4bde124b256e3a9155e3eee1044

                                                          SHA1

                                                          1f2ef73fac0571966a3e3ec550082c850a05ad6a

                                                          SHA256

                                                          6900dbb3954f4715aa6e63084bbe8e9ca709b09f6138eca4d044b6587f9e29b8

                                                          SHA512

                                                          4704bad4ae859a2b593f52fe1385e336fb57ba40dbeab597c8c68dcf05d4040501e2808b5eb550816a7f80e715c68be4d2d24b5d1fb585549b611df2249008cb

                                                        • \Users\Admin\AppData\Local\Temp\6e20f9687cd7e6e2e7cc956a4f834e079b9cfb53d7db3776f99b0fd4b3fcb196mgr.exe

                                                          Filesize

                                                          67KB

                                                          MD5

                                                          ba4610e9ca3ebf61ec5800955a797c13

                                                          SHA1

                                                          66fd641b894b56c212275eb62a45b667e6f0f78b

                                                          SHA256

                                                          6eb6cb7e312086b243a1606c4df19a98e1711f3de8fe96866abbd95ba0b51ff8

                                                          SHA512

                                                          cf832767a0dbf8468623b840baa578448174eff472653080d2f2123f2e514ab454e9ddabc98c827a4469760f4f22ed2ffcba71368fb11779aea2d72545776c26

                                                        • memory/1304-35-0x00000000000E0000-0x00000000000E1000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/1304-333-0x0000000020010000-0x0000000020022000-memory.dmp

                                                          Filesize

                                                          72KB

                                                        • memory/1304-49-0x0000000020010000-0x0000000020022000-memory.dmp

                                                          Filesize

                                                          72KB

                                                        • memory/1304-42-0x0000000020010000-0x0000000020022000-memory.dmp

                                                          Filesize

                                                          72KB

                                                        • memory/1304-36-0x00000000000C0000-0x00000000000C1000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/1304-37-0x0000000020010000-0x0000000020022000-memory.dmp

                                                          Filesize

                                                          72KB

                                                        • memory/1304-41-0x00000000000D0000-0x00000000000D1000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/1304-31-0x00000000000C0000-0x00000000000C1000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/1304-29-0x0000000020010000-0x0000000020022000-memory.dmp

                                                          Filesize

                                                          72KB

                                                        • memory/1304-44-0x0000000020010000-0x0000000020022000-memory.dmp

                                                          Filesize

                                                          72KB

                                                        • memory/1364-72-0x0000000020010000-0x000000002001B000-memory.dmp

                                                          Filesize

                                                          44KB

                                                        • memory/1364-69-0x0000000020010000-0x000000002001B000-memory.dmp

                                                          Filesize

                                                          44KB

                                                        • memory/1364-70-0x0000000020010000-0x000000002001B000-memory.dmp

                                                          Filesize

                                                          44KB

                                                        • memory/1364-71-0x00000000001B0000-0x00000000001B1000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/1364-56-0x0000000020010000-0x000000002001B000-memory.dmp

                                                          Filesize

                                                          44KB

                                                        • memory/1364-68-0x00000000001A0000-0x00000000001A1000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/1364-66-0x0000000020010000-0x000000002001B000-memory.dmp

                                                          Filesize

                                                          44KB

                                                        • memory/1364-62-0x0000000020010000-0x000000002001B000-memory.dmp

                                                          Filesize

                                                          44KB

                                                        • memory/1364-74-0x0000000077CC0000-0x0000000077CC1000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/1544-4-0x00000000002F0000-0x0000000000333000-memory.dmp

                                                          Filesize

                                                          268KB

                                                        • memory/1544-26-0x00000000002F0000-0x0000000000333000-memory.dmp

                                                          Filesize

                                                          268KB

                                                        • memory/1544-335-0x0000000000400000-0x0000000000448000-memory.dmp

                                                          Filesize

                                                          288KB

                                                        • memory/1544-1-0x0000000000400000-0x0000000000448000-memory.dmp

                                                          Filesize

                                                          288KB

                                                        • memory/2120-14-0x0000000000400000-0x0000000000443000-memory.dmp

                                                          Filesize

                                                          268KB

                                                        • memory/2120-10-0x0000000000400000-0x0000000000443000-memory.dmp

                                                          Filesize

                                                          268KB

                                                        • memory/2120-13-0x0000000000220000-0x0000000000221000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/2664-54-0x0000000077CBF000-0x0000000077CC0000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/2664-73-0x0000000000400000-0x0000000000443000-memory.dmp

                                                          Filesize

                                                          268KB

                                                        • memory/2664-67-0x0000000000400000-0x0000000000443000-memory.dmp

                                                          Filesize

                                                          268KB

                                                        • memory/2664-53-0x00000000002B0000-0x00000000002B1000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/2664-24-0x0000000000400000-0x0000000000443000-memory.dmp

                                                          Filesize

                                                          268KB

                                                        • memory/2664-577-0x0000000077CBF000-0x0000000077CC0000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/2664-580-0x0000000000400000-0x0000000000443000-memory.dmp

                                                          Filesize

                                                          268KB

                                                        • memory/2664-27-0x0000000000400000-0x0000000000443000-memory.dmp

                                                          Filesize

                                                          268KB

                                                        • memory/2664-25-0x00000000002A0000-0x00000000002A1000-memory.dmp

                                                          Filesize

                                                          4KB