Analysis

  • max time kernel
    112s
  • max time network
    114s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/10/2024, 17:51

General

  • Target

    893913ff4387fefdd328d30c720c9b30ea7b34fb3c3d481cfba2791f2ade6a38N.dll

  • Size

    240KB

  • MD5

    b78dcb131cb6e40c10a1bc4d43e9b8f0

  • SHA1

    3c5935fcde6ef32e939243482601b53e8994391e

  • SHA256

    893913ff4387fefdd328d30c720c9b30ea7b34fb3c3d481cfba2791f2ade6a38

  • SHA512

    79373831f69ea93aa755be4ecece1d77d4d9606cc54f489c8ea9141057f4ef52fdf9531668196e73d15f96ab3f6aee64804d8f0e0d66f06158b80c515a633304

  • SSDEEP

    6144:xKZp3KNjVGvYMPXyX7MGoFlNWeqm7GGJWnA:xCxKNjcHPyYD/We28qA

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Ramnit family
  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\893913ff4387fefdd328d30c720c9b30ea7b34fb3c3d481cfba2791f2ade6a38N.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:832
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\893913ff4387fefdd328d30c720c9b30ea7b34fb3c3d481cfba2791f2ade6a38N.dll,#1
      2⤵
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:812
      • C:\Windows\SysWOW64\rundll32mgr.exe
        C:\Windows\SysWOW64\rundll32mgr.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of UnmapMainImage
        • Suspicious use of WriteProcessMemory
        PID:1340
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:5012
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5012 CREDAT:17410 /prefetch:2
            5⤵
            • System Location Discovery: System Language Discovery
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:2520

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

          Filesize

          471B

          MD5

          3c368a68cd68a8dbb557088be01b35c7

          SHA1

          44d06c93fecdb6bd5dbd84e565b68d4f95be42a1

          SHA256

          6a1c84b1e2ae6a619c05fbc48f3441b0421ebab39aef41a3ebd22f0eb005143b

          SHA512

          3d19c390990bb1d1a41060a36574ec856e2cb3ddbbf226c837ba4aa75c8c32b004e27b3cea29805558fd02a84a0889df95e0b71a64c15f12621173611bab8157

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

          Filesize

          404B

          MD5

          9bf3d9bb6c89d918c82a2b0c9a9e0133

          SHA1

          4b5173531d918ab33f40e18598ec68d280822112

          SHA256

          d76404d59d9bc26aa99909c963cf16352f047a7b2d431c27bc971b558ea935e6

          SHA512

          e1b0ff0054720a89cca8f57985a1bf6efe15c5ff8dcbaf25ee537fc91f7e4533de2e034c7a00d314ab6e70e9de60f1b977536099c30c2f93febe82b8b87dcad5

        • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver13A2.tmp

          Filesize

          15KB

          MD5

          1a545d0052b581fbb2ab4c52133846bc

          SHA1

          62f3266a9b9925cd6d98658b92adec673cbe3dd3

          SHA256

          557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

          SHA512

          bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0GUUC90F\suggestions[1].en-US

          Filesize

          17KB

          MD5

          5a34cb996293fde2cb7a4ac89587393a

          SHA1

          3c96c993500690d1a77873cd62bc639b3a10653f

          SHA256

          c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

          SHA512

          e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

        • C:\Windows\SysWOW64\rundll32mgr.exe

          Filesize

          121KB

          MD5

          a93af43a801ff05f44ff97cb95cd886c

          SHA1

          7b19ee2905cc330bda0dfa0fb089085ebaacf5e3

          SHA256

          50063bef074ba3c8708974907de35e78f60471f167f0934fa579a03d7ddef779

          SHA512

          5620ee938a3a60bd63eb6df36f74e0e67d9fb881ab787d917db0a84e0e3741627105da957a4e45ab3056620717315566dd3a5641118be4ca6f6a6a6a9f1dbc8d

        • memory/812-1-0x0000000010000000-0x000000001003E000-memory.dmp

          Filesize

          248KB

        • memory/1340-11-0x0000000000400000-0x000000000041A000-memory.dmp

          Filesize

          104KB

        • memory/1340-7-0x0000000000400000-0x000000000041A000-memory.dmp

          Filesize

          104KB

        • memory/1340-19-0x0000000077832000-0x0000000077833000-memory.dmp

          Filesize

          4KB

        • memory/1340-16-0x0000000000400000-0x000000000041A000-memory.dmp

          Filesize

          104KB

        • memory/1340-17-0x0000000000060000-0x0000000000061000-memory.dmp

          Filesize

          4KB

        • memory/1340-13-0x0000000000400000-0x000000000041A000-memory.dmp

          Filesize

          104KB

        • memory/1340-9-0x0000000000400000-0x000000000041A000-memory.dmp

          Filesize

          104KB

        • memory/1340-18-0x0000000077832000-0x0000000077833000-memory.dmp

          Filesize

          4KB

        • memory/1340-6-0x0000000000400000-0x000000000041A000-memory.dmp

          Filesize

          104KB

        • memory/1340-20-0x0000000000400000-0x000000000041A000-memory.dmp

          Filesize

          104KB

        • memory/1340-14-0x0000000000400000-0x000000000041A000-memory.dmp

          Filesize

          104KB

        • memory/1340-12-0x00000000006B0000-0x00000000006B1000-memory.dmp

          Filesize

          4KB

        • memory/1340-8-0x0000000000400000-0x000000000041A000-memory.dmp

          Filesize

          104KB

        • memory/1340-4-0x0000000000400000-0x0000000000432000-memory.dmp

          Filesize

          200KB