Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/10/2024, 17:56

General

  • Target

    893913ff4387fefdd328d30c720c9b30ea7b34fb3c3d481cfba2791f2ade6a38N.dll

  • Size

    240KB

  • MD5

    b78dcb131cb6e40c10a1bc4d43e9b8f0

  • SHA1

    3c5935fcde6ef32e939243482601b53e8994391e

  • SHA256

    893913ff4387fefdd328d30c720c9b30ea7b34fb3c3d481cfba2791f2ade6a38

  • SHA512

    79373831f69ea93aa755be4ecece1d77d4d9606cc54f489c8ea9141057f4ef52fdf9531668196e73d15f96ab3f6aee64804d8f0e0d66f06158b80c515a633304

  • SSDEEP

    6144:xKZp3KNjVGvYMPXyX7MGoFlNWeqm7GGJWnA:xCxKNjcHPyYD/We28qA

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Ramnit family
  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 30 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\893913ff4387fefdd328d30c720c9b30ea7b34fb3c3d481cfba2791f2ade6a38N.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4780
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\893913ff4387fefdd328d30c720c9b30ea7b34fb3c3d481cfba2791f2ade6a38N.dll,#1
      2⤵
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3660
      • C:\Windows\SysWOW64\rundll32mgr.exe
        C:\Windows\SysWOW64\rundll32mgr.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of UnmapMainImage
        • Suspicious use of WriteProcessMemory
        PID:2452
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2704
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2704 CREDAT:17410 /prefetch:2
            5⤵
            • System Location Discovery: System Language Discovery
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:1468

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

          Filesize

          471B

          MD5

          3c368a68cd68a8dbb557088be01b35c7

          SHA1

          44d06c93fecdb6bd5dbd84e565b68d4f95be42a1

          SHA256

          6a1c84b1e2ae6a619c05fbc48f3441b0421ebab39aef41a3ebd22f0eb005143b

          SHA512

          3d19c390990bb1d1a41060a36574ec856e2cb3ddbbf226c837ba4aa75c8c32b004e27b3cea29805558fd02a84a0889df95e0b71a64c15f12621173611bab8157

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

          Filesize

          404B

          MD5

          2d00b82b761dd316e7552d65e901c74d

          SHA1

          d8b749c8d64ff7ad27c9f2b258aa43124451a74b

          SHA256

          3b37abf4a38ba470abce9888d5a7aef493453f1f0b992b4ae4866988992bb6ba

          SHA512

          24c9b1ac27f8faaea0fe5c4f76071c21aa57e0480a7669719330ececc40823e84b096537d3b1afb9df860ca2850b9a53e44cd97ce3398981edf00d75acec370a

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8R55UT9S\suggestions[1].en-US

          Filesize

          17KB

          MD5

          5a34cb996293fde2cb7a4ac89587393a

          SHA1

          3c96c993500690d1a77873cd62bc639b3a10653f

          SHA256

          c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

          SHA512

          e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

        • C:\Windows\SysWOW64\rundll32mgr.exe

          Filesize

          121KB

          MD5

          a93af43a801ff05f44ff97cb95cd886c

          SHA1

          7b19ee2905cc330bda0dfa0fb089085ebaacf5e3

          SHA256

          50063bef074ba3c8708974907de35e78f60471f167f0934fa579a03d7ddef779

          SHA512

          5620ee938a3a60bd63eb6df36f74e0e67d9fb881ab787d917db0a84e0e3741627105da957a4e45ab3056620717315566dd3a5641118be4ca6f6a6a6a9f1dbc8d

        • memory/2452-16-0x0000000000400000-0x000000000041A000-memory.dmp

          Filesize

          104KB

        • memory/2452-21-0x0000000077E82000-0x0000000077E83000-memory.dmp

          Filesize

          4KB

        • memory/2452-14-0x0000000000400000-0x000000000041A000-memory.dmp

          Filesize

          104KB

        • memory/2452-13-0x0000000000400000-0x000000000041A000-memory.dmp

          Filesize

          104KB

        • memory/2452-8-0x0000000000400000-0x000000000041A000-memory.dmp

          Filesize

          104KB

        • memory/2452-17-0x0000000000400000-0x000000000041A000-memory.dmp

          Filesize

          104KB

        • memory/2452-4-0x0000000000400000-0x0000000000432000-memory.dmp

          Filesize

          200KB

        • memory/2452-19-0x0000000077E82000-0x0000000077E83000-memory.dmp

          Filesize

          4KB

        • memory/2452-22-0x0000000000401000-0x0000000000405000-memory.dmp

          Filesize

          16KB

        • memory/2452-12-0x0000000000400000-0x000000000041A000-memory.dmp

          Filesize

          104KB

        • memory/2452-18-0x0000000000060000-0x0000000000061000-memory.dmp

          Filesize

          4KB

        • memory/2452-9-0x0000000000400000-0x000000000041A000-memory.dmp

          Filesize

          104KB

        • memory/2452-7-0x0000000000400000-0x000000000041A000-memory.dmp

          Filesize

          104KB

        • memory/2452-6-0x0000000000401000-0x0000000000405000-memory.dmp

          Filesize

          16KB

        • memory/2452-10-0x0000000000400000-0x0000000000432000-memory.dmp

          Filesize

          200KB

        • memory/2452-11-0x00000000001B0000-0x00000000001B1000-memory.dmp

          Filesize

          4KB

        • memory/3660-1-0x0000000010000000-0x000000001003E000-memory.dmp

          Filesize

          248KB