ramnit | 6fc0f0accd057d316f624a79820c8404b4234c60598cc52bad15de295232fdb6

Analysis

max time kernel
135s
max time network
131s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
15-11-2024 11:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidar.exe
Size

3.6MB
MD5

4ba94831a2abd837a22db12c9ae27920
SHA1

d34f7d3591d5224c362fe88626a57b6c64dcd042
SHA256

6fc0f0accd057d316f624a79820c8404b4234c60598cc52bad15de295232fdb6
SHA512

396a6bf67ff20fcb4c088567d4a6f6d28feabe77178f5824fde4c580664352dc3d5ac8cc32e047141a54f18eed7754585d94d25b0c1f54dd217a2746fd0082d6
SSDEEP

98304:1HtK2afnf1W7ojMl9b52e4UF4qFmLSYYWo4r8eJZNKDQT:7ava9sU5ZWo4r8eJDKU

Score

10^/10

ramnit banker bootkit discovery persistence spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Ramnit family
ramnit

Executes dropped EXE 2 IoCs

pid	Process
2508	2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidarSrv.exe
2520	DesktopLayer.exe

Loads dropped DLL 2 IoCs

pid	Process
2292	2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidar.exe
2508	2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidarSrv.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidar.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2508-12-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2508-15-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/files/0x000d000000012257-13.dat	upx
behavioral1/memory/2520-24-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2520-26-0x0000000000400000-0x000000000042E000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidarSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxD604.tmp	2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidarSrv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidarSrv.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidarSrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopLayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidar.exe

Modifies Internet Explorer settings 1 TTPs 37 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e78a69453f00554b9c7935775bae7b960000000002000000000010660000000100002000000002ed3f445ec9efea2c88e8a76be06488e83dbad90d726412c19172a05f693e0e000000000e8000000002000020000000ae3ae0ff68ec2cf529a5d8f21ce7c0a8b4db64657cd662d3d9401cd5af2438c39000000032716cdb9b4ffb93846916644b0bfa408d7ecb641e98f7af6e6adeae518e5b8e3711e968e8d95454788640ad2d6a9244f1d9fe5cf0135e1d02f7b62b18336f8e922c5bf5c18a79923f2c72cf80687ed0bcbb80e0f9d633aca2f490b3d676e3e500d231af211c4bf6f268ba52d2252feb717c45731da35673c7d4f45c7a63cfc3bf1befacb3a61dabe87a63c1d514125440000000c6ab4ab79b4d7be427fd2cc3de8cdb8f0fdfa1e8015a9fe5437b6cfcb11ab466697358b8c419018e919672d232a736346e61a7fddc54ceeb5292f711a3341f4c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ECDD6041-A346-11EF-AB56-7227CCB080AF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e78a69453f00554b9c7935775bae7b96000000000200000000001066000000010000200000001649d12b37cbe54a33a7b7cf822f2ed8e8a497e4e4fba8b6d7ef4f37416ae8dd000000000e8000000002000020000000ccafda6d78750c1353aa7b7b09d4916c478a9390f23f1312c431fade6c85713f2000000089a7f68c778179369b83d5cd90327717bdc43df8a54958a6497727771e64e4a9400000006d6da8c33848ba82265792e8254c221a3df41df9a71f0042d32fc4306d43164cbc5eb109de2633b16aa991cccddc55fdf8ae3622affd93ee293507c0e6c5044f	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20b51acb5337db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "437832917"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2520	DesktopLayer.exe
2520	DesktopLayer.exe
2520	DesktopLayer.exe
2520	DesktopLayer.exe
2388	iexplore.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2388	iexplore.exe
2292	2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidar.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2292	2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidar.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
2292	2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidar.exe
2292	2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidar.exe
2292	2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidar.exe
2388	iexplore.exe
2388	iexplore.exe
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE
3028	IEXPLORE.EXE
3028	IEXPLORE.EXE
3028	IEXPLORE.EXE
3028	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2508	2292	2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidar.exe	31
PID 2292 wrote to memory of 2508	2292	2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidar.exe	31
PID 2292 wrote to memory of 2508	2292	2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidar.exe	31
PID 2292 wrote to memory of 2508	2292	2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidar.exe	31
PID 2508 wrote to memory of 2520	2508	2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidarSrv.exe	32
PID 2508 wrote to memory of 2520	2508	2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidarSrv.exe	32
PID 2508 wrote to memory of 2520	2508	2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidarSrv.exe	32
PID 2508 wrote to memory of 2520	2508	2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidarSrv.exe	32
PID 2520 wrote to memory of 2388	2520	DesktopLayer.exe	33
PID 2520 wrote to memory of 2388	2520	DesktopLayer.exe	33
PID 2520 wrote to memory of 2388	2520	DesktopLayer.exe	33
PID 2520 wrote to memory of 2388	2520	DesktopLayer.exe	33
PID 2388 wrote to memory of 2796	2388	iexplore.exe	34
PID 2388 wrote to memory of 2796	2388	iexplore.exe	34
PID 2388 wrote to memory of 2796	2388	iexplore.exe	34
PID 2388 wrote to memory of 2796	2388	iexplore.exe	34
PID 2388 wrote to memory of 3028	2388	iexplore.exe	36
PID 2388 wrote to memory of 3028	2388	iexplore.exe	36
PID 2388 wrote to memory of 3028	2388	iexplore.exe	36
PID 2388 wrote to memory of 3028	2388	iexplore.exe	36

C:\Users\Admin\AppData\Local\Temp\2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidar.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Users\Admin\AppData\Local\Temp\2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidarSrv.exe
  C:\Users\Admin\AppData\Local\Temp\2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidarSrv.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2508
- - C:\Program Files (x86)\Microsoft\DesktopLayer.exe
    "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2520
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      Modifies Internet Explorer settings
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2388
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2388 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2796
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2388 CREDAT:275461 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:3028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
9499ebbc1c35fa4d1a9a6e4dc7e2897f

SHA1
b4b2c0fd8897bbf017bae992630d97d5e8a10c27

SHA256
e47b1efa6a0a90fe5dd93105a9c397731448a1aabb83deab5cafecda1aea12e5

SHA512
ff0697fa3d771b0780d1f7b41de38160c6f5766ba2ec388953023bd8ca4261bd11c2c22ad9bc6a73a148c71928f9e30aaba3578f82e9a524ad91a1e44be810c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
78dfec88ee3b68f9bb287852f87a0e18

SHA1
f2a7a0bacfbbfed0c933e05d2ff96f0acb1c931c

SHA256
fb8590a220b4be98d126de41e96d0512ed103ce2a51f2697f6475e66c34dfeb7

SHA512
bffba154eab9eda02f23205a6212a7dd1408fcc14a1ea5608ed1145ff02c315ddbe724dafe774e819387e95cf5a1f25b3723a13dee0c7ff5f73964cdf0ae9b64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9cdcc7d1804ca9fde5f49b7b8fbef60a

SHA1
d57458b62bb97836dad91cd236afcd423b396a41

SHA256
8ed4166fc3d9fc7f7cec40dbc49b1a50f2527e0bb2cde94bc4d438f5b35f5148

SHA512
7d7ad8f7e1ddd1c52b5db911b039b88217734253df0d794a16db86f1ccc8bf7f5d8ca97f99672c99b3fab7aa86e3d14f722f5c78d43e82f2e9948f20f7a7e637

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
765ff75715c9da30b2c226a1ce023a10

SHA1
af680328e323b3c116f2928d5f79d173bef67c19

SHA256
487aaa57294e4f9c02027631b4b4d0c89bc8e14c164cfe8a0b6f728f05d4b249

SHA512
5bf79c8df3f9bdc3b1b672e5d445cb17e4f929a30ab49c08a94d3291e48136f11a0a001cce1fa6b1f7a0e5f24de7c703b8048533221a355298bdb24b1255a1de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
834fd5dd67651f4fd00301955aa89880

SHA1
a0de8cb7cfe283a38c99fdbce783fce457b69893

SHA256
ff31d9d9d2246442cba9d55119461f284879c01f4d6d2e77564bf5384b516545

SHA512
37aeccff276dc52c1541ac6f4af462960e5c571c8fddd04a4a8a831f1b5e9a3ae2d836047466bf30e52ce6ecdf7e6423c29b67911be6a0c9e219b69b32f85b4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3875235c5f104badeb98ab5222f577af

SHA1
ab0cd6ce9a391a9c8ca3848e4c0ad7727a0ba1f9

SHA256
b14ec231701b0ba5b43f0cb825bf71d355da19ae4663848ab4a7bd5cfc7f10a6

SHA512
cc359c2d3d72bdbe401c552b362f32bfdb67f3035be78c456f7f4a5753186f7acc4b9ffea89039d15729dcd584c770a453c1398db85859e3012e1eb78b078407

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a58ebc8ecb0de690b33f32edde302b8a

SHA1
9f03c98ab51530b3af9644d5fedf3777ee3352b8

SHA256
f6ee3526ddc4aa76f91c65c0890772b9e7b2f3fe4bdb17a14cce46adb857baf1

SHA512
9c9ac1b951c739fdecea9cada6667dd7244ea663a3e517679996d41b7cc35d7a6cc8506f2b4afde7b439f989ea7e4fb1335210a6b9a1b7c0acce1248e6b0f0fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7878510e81893498338a057e28413b85

SHA1
d6c3e2be2115e6a3ec3f9019b9ec9369575f613f

SHA256
1d5020da055533c366188bbbf33f4fcc6d83c90b30576e9cde85472d727ac1da

SHA512
841ab9f25caf2bb516bc52d32ae3347de96c89febe0b32e777c38b375d4a2acef85dbd1d7537b935db5eb4407fa67e8b10af76556651cb6ecd73e8c1036e8fa6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7772721ad933973f49c0d8edcd7a120c

SHA1
53d19f5b2f8115a3e0a9c79a70762875c4a56658

SHA256
c4c2cb1e6e85eea1e5c6e551fd21ad9b5234720c19fb6a181433777b2e9a1036

SHA512
7a4348e4d758b87685ae19a545b606635468daffe21311b129b3fd5bfa8d8bb68febb67a7b910c73b636979253bb69ef003032bd6838596754f1e7180c658505

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d67355c824a4c68ef6b00946e816dc09

SHA1
6ea09e2b5a93c6664828e629bbeaa0249a174fe2

SHA256
f5cd6b7f8de026da43d92e4936e06b8e689a788cc244612a149a51a8e0b2ed51

SHA512
9500436866d766181eafbc037e0d19aaef9333f9c18146c88fd805bc7bb25c5779d3cc2a0bd8cae1a7d7ed3dd8fba6c39dda1d33751336b7fa2089ad9e71e349

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
814b171ba8e5161059e3534bc0a4100e

SHA1
e829b6ae1bc4d72b4a0bf494bd7ea91dad3323e0

SHA256
2e8147d6eb26509a8e4924a2bac30659b9b4e991c468f7adbe6b06725a28fd42

SHA512
31554bbd32f34f20399ae004773f119887b98afd11a44ff6d53b7b735eee33a259f367b58531898ac512c32b56d11de8085f264834caf88d61d5a7928fad8546

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49e7a49cefb9fb9ee5cb0d87b0a807bc

SHA1
6428bc39a357d28824fe0b2aab444b6abba0abda

SHA256
5bd412a7b12d74a267fde101f089997f7d35159bb5438b301240ec36230f7a91

SHA512
5479ecdea7ba3f330f338746c472d2b3ac2b2df0c2ec05b99399315b8e4141f9bd2b6e522e7e3d60c6794c5c277043d0a8ace6794319dfa846cf8de13728b714

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
90f26e26a48101258296840387158681

SHA1
4d207bd4928e935a1e3d54950859a5cbf1a091af

SHA256
3ba62b6aaf547c71869e299ca776d84c7563da4cc9d6067b508da96467c6cdf8

SHA512
4c94dc31d1dfe306d695781152ec9ef4004f556dbd84ffc9573943c9266ed5efa5803584a7241c4345f77616edad05a85852132c61272b459aef604d3feec8e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4bdeb85b1be19ae567830cd1344f4d51

SHA1
12a78a8d21c3fb98a89dfd470abf4a67ab07f463

SHA256
b0cb0a5547cae18e96f3fb80dd009a869c1807e80fd31e3b953723aad3beaf46

SHA512
e206995d8269420e51e4fea8423b64536ff6c6f41852fd9f5614db765fa5f72fadb379024513844cddb3ce24f9b10f03b600fd840143f172dca805b0ed5ed096

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fb1642d83c4c84cb7208fcc13d907eaa

SHA1
59d220137b7699771929523553a6fdadd6df8b5f

SHA256
66f79e1b08d22191e8a8299936752f8ee3252e7cadd2712ae13bd456b6127214

SHA512
f1e8fe4e5dd2c753674279e76f2cb1748b22b0b996d990f122569acf8d51fec6f77eddd64e40edd78e6aafa2940e315557288683a5d6888c6c58b4bc4362fe5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5fa9bf1b7ca0fb0fc2179b3cc5ad4f80

SHA1
a2a5049da72c0e1eb96e6a74f184e3d9482cfe2b

SHA256
357ddbef9e935316c4f5d426b2f6933ce99dfa85d6e86064cde4dd33f19d1535

SHA512
032194ede1b8c5ce88e80659bb0fa7ac7a00da0218f9495b1a1d1674710cc22805ff0d76e7228eaea3606a0745fa81a25c96d64baa9160ae9712cd1a3151e6d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ee000c514673f10e239a5a1dc03879d

SHA1
f4d59ae8b5facb5627dda382bfda50095d009574

SHA256
a34b02cadab08ca8dc7d95234ba6d1ef23c058fbd79563875be9bcb71a5afccd

SHA512
debf3cd5142e92642045b529f93f0b5b19bf561bcd75eccd9f704c9bd556a78ecb00341ed6485cc4962b6893ffa341be2a9f2ec62e9e460c7e01c86317bb27ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0fa66f90e59a4a6fca6f9fd0af3db42d

SHA1
5b91e388b1f8864148287bfc9ebcbe52ceed6ec6

SHA256
2847d2ae95319d3d60c0f49af35b38578eb00e4a83c6ceffb952a2eb7a2163fd

SHA512
2b7df47d9e95da1ffbdefb03a182543fbbb094b06dc85375238c10674592344fdc289656fffe09a64b359e60a595fab3c4ba7f48ae1c0fe0d1914951e1d175f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6dc6dd80203339c7c1e40db229a3775a

SHA1
7d27917320e067c700352d96b00b02bba3d095a0

SHA256
9333c09274649abd045af620af6c8110c3d8b452a8007c0bca2a55c6d04abf52

SHA512
460fda1eb6196cfc6fa71408138aadab228f9d07dd2019a1dad310aff13b059a5775976b8cbd5fc367a34ed003b76c6c3949f9fca7b90b62dd07f11a67ddb3c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
469908cd72d3ae42c175f3c7061512b2

SHA1
bce624a9012323dd5d40626b7015a3079ebd488c

SHA256
531558036deaa2d90dee75a69bf9c935c8ed9fd229d80033ef6c02f93e643872

SHA512
7459febe9ef431e305283eb2ea8b1897ab3210f54e970d2057626dfe55e38acf6729de0639c4cd1a92396879b8ddf2af8a1ac19901d362ce1d350a6c54787a72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
08d4e6ef799996c725a7afb58b464575

SHA1
2acd66e40804e92904f577e9248bd24eb88ef0db

SHA256
a4171690db227303d1cc7e01a729c46eae58a8f844143e40874ac64b5f1c468b

SHA512
14e9a3d0b37892d6240be0c0fd3beccbd8c0c6b104b4ac9b9ccc6920b1cc36b79310e02c7f5d60b7b90c0d180e2d23e15b744ed64d3f2f9bbd83f2557bdd7f1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
5ccc1f17e4f5612b0b423b4c654f1811

SHA1
60ec6fe1283d243766a387a47cb6dc8ecf13e45d

SHA256
9a8fd3caabf9dbc0807cc1019be099b85ffe0bb20c10a572eac2cf635323ab2b

SHA512
c96a1c98fc6fad33487d32a704a2a2b517f2405662b072307a37ac57b0e856a981fcee26269565ebd30542826cb18494631aa75d72b3cbdf44bddc9d0e0b2b14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\z8d0nzh\imagestore.dat

Filesize
1019B

MD5
614ab9b6fef5cc0907bbbd1a50ba0ee5

SHA1
1ac1e9fbfbd49f99a1575f88c67d311af123b8ba

SHA256
949332577db4e956ebe7ddace9e178bd4e7534d3bbb0dce0724ecb8546c5370c

SHA512
0084e9463fd7f8f794e489787db7373d34dd3458e8cb9c1ae4ac971afeade3d4f92f6374f5e84c8517265083cdffb3b3e7ea7ee3565f257f49e9c0644c488224

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VUUZQMCA\cropped-android-chrome-256x256-1-32x32[1].png

Filesize
793B

MD5
f2da1f88e64b24cd39beb299e3496f0b

SHA1
8889e0b48a75188bce45aaa442690203b853af31

SHA256
5b6f1d684cf0946af6904d138331165f473d67dd2791bb5877118c106854078c

SHA512
8e942b83478e308759f4d2de24cca01b0f2acf42c896fa6522cb3c8a98b23afd7be39fbeb220ecc8816b44499e0b2c3360f312d0cd0b5816f66f372093898ad2

Download Submit
C:\Users\Admin\AppData\Local\Temp\2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidarSrv.exe

Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF8A4.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF962.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\laD5E5.tmp

Filesize
44KB

MD5
efcad9828a2eb5d476e6d83261322778

SHA1
30508791e0e5f57e2826d9803b387a17da5bfbe8

SHA256
b75e4a842e13e09999531a71691439423cd99c26e0be5bedd1714539073ca58c

SHA512
6dcb5c00d99aefcf3e104ff8dd768bac782421e859deb06a7b0fa5c388bcffe309d9f47285bbdbde373066f64824e5a9654646c7a19d7a44940af94db5c38452

Download Submit
memory/2292-44-0x0000000000400000-0x0000000000AE2000-memory.dmp

Filesize
6.9MB

Download
memory/2292-41-0x0000000000250000-0x000000000027E000-memory.dmp

Filesize
184KB

Download
memory/2292-4-0x0000000000400000-0x0000000000AE2000-memory.dmp

Filesize
6.9MB

Download
memory/2292-9-0x0000000000250000-0x000000000027E000-memory.dmp

Filesize
184KB

Download
memory/2508-15-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2508-12-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2508-14-0x0000000000230000-0x000000000023F000-memory.dmp

Filesize
60KB

Download
memory/2520-24-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2520-26-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2520-23-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download