Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
01-11-2024 16:23
General
-
Target
2024-11-01_11e7b8e829e762907a4b18ba6674b31b_mafia_ramnit.exe
-
Size
1.2MB
-
MD5
11e7b8e829e762907a4b18ba6674b31b
-
SHA1
e4b6838aebc9f5fc10047e8d4c59106c52754e1b
-
SHA256
08112a21af245b130c3cac6617cd5a89e8d1e9631e0bc45c381da9515e9dce3c
-
SHA512
44960b4113c67767f25d038ac7c1eed3017d72fa440ffcd2f329eb7ec27f926e15ec4f15b53e5402104c4cc8c1767a436978451ef20e8efd44494dd9d2d461f2
-
SSDEEP
24576:2h2bNeMrpYdvrqUGvUk5jxHJ/6+85kKLj8TjWoY0eClVy23c9oMI8rFi2Pdr7R58:AcNTmRqUGvUk5jxHJ/6+85kKLj8TjW04
Malware Config
Signatures
-
Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
-
Ramnit family
-
Executes dropped EXE 2 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 32 IoCs
-
Modifies registry class 30 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-01_11e7b8e829e762907a4b18ba6674b31b_mafia_ramnit.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-01_11e7b8e829e762907a4b18ba6674b31b_mafia_ramnit.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-11-01_11e7b8e829e762907a4b18ba6674b31b_mafia_ramnitSrv.exeC:\Users\Admin\AppData\Local\Temp\2024-11-01_11e7b8e829e762907a4b18ba6674b31b_mafia_ramnitSrv.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4792 CREDAT:17410 /prefetch:25⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
471B
MD58fcd2801947deaf151e983830331290b
SHA1f51696d3d1486f78df561246375818a3313af27e
SHA256c8feb01b063e3ce5afab5464e537832b1adcd0558e164f3854e0de456dbb3571
SHA512531fd2ef45fb40ada3439c743b1ef1b80108dfaa61289eb959d9a73d70390de24382584eb24f52b6b5b42dd81ae39bc41a80429b59d7a97e7ac66a922e290e19
-
Filesize
404B
MD5d6a1997e8e19f7d63fd984f241cbec58
SHA1da22ace1ec55e1d2cfab0b8b043ccb9ee7a2341a
SHA2561220f73051848e7c17e80c2cc002c15e5467a2ccf0ecc793f079488df4b0bc01
SHA512b42f81ac1c18c9ac2d7e6e1ee7513b9c0c845be64477b7d910a1c79a045518047eb6a78528c43a8d739f57be71c460dface47ed9a630b09345ca97a793097ae6
-
Filesize
15KB
MD51a545d0052b581fbb2ab4c52133846bc
SHA162f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA256557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
SHA512bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
Filesize
4KB
-
Filesize
184KB
-
Filesize
184KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
60KB
-
Filesize
184KB
-
Filesize
184KB