Malware Analysis Report

2024-12-07 02:47

Sample ID 241115-nv55catdnr
Target 2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidar
SHA256 6fc0f0accd057d316f624a79820c8404b4234c60598cc52bad15de295232fdb6
Tags
ramnit banker bootkit discovery persistence spyware stealer trojan upx worm
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

6fc0f0accd057d316f624a79820c8404b4234c60598cc52bad15de295232fdb6

Threat Level: Known bad

The file 2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidar was found to be: Known bad.

Malicious Activity Summary

ramnit banker bootkit discovery persistence spyware stealer trojan upx worm

Ramnit

Ramnit family

Executes dropped EXE

Loads dropped DLL

Writes to the Master Boot Record (MBR)

UPX packed file

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Browser Information Discovery

System Location Discovery: System Language Discovery

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Enumerates system info in registry

Suspicious use of FindShellTrayWindow

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-15 11:44

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-15 11:44

Reported

2024-11-15 11:46

Platform

win7-20241010-en

Max time kernel

135s

Max time network

131s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidar.exe"

Signatures

Ramnit

trojan spyware stealer worm banker ramnit

Ramnit family

ramnit

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidar.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Users\Admin\AppData\Local\Temp\2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidarSrv.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\pxD604.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidarSrv.exe N/A
File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Users\Admin\AppData\Local\Temp\2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidarSrv.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidarSrv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Microsoft\DesktopLayer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidar.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e78a69453f00554b9c7935775bae7b960000000002000000000010660000000100002000000002ed3f445ec9efea2c88e8a76be06488e83dbad90d726412c19172a05f693e0e000000000e8000000002000020000000ae3ae0ff68ec2cf529a5d8f21ce7c0a8b4db64657cd662d3d9401cd5af2438c39000000032716cdb9b4ffb93846916644b0bfa408d7ecb641e98f7af6e6adeae518e5b8e3711e968e8d95454788640ad2d6a9244f1d9fe5cf0135e1d02f7b62b18336f8e922c5bf5c18a79923f2c72cf80687ed0bcbb80e0f9d633aca2f490b3d676e3e500d231af211c4bf6f268ba52d2252feb717c45731da35673c7d4f45c7a63cfc3bf1befacb3a61dabe87a63c1d514125440000000c6ab4ab79b4d7be427fd2cc3de8cdb8f0fdfa1e8015a9fe5437b6cfcb11ab466697358b8c419018e919672d232a736346e61a7fddc54ceeb5292f711a3341f4c C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ECDD6041-A346-11EF-AB56-7227CCB080AF} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e78a69453f00554b9c7935775bae7b96000000000200000000001066000000010000200000001649d12b37cbe54a33a7b7cf822f2ed8e8a497e4e4fba8b6d7ef4f37416ae8dd000000000e8000000002000020000000ccafda6d78750c1353aa7b7b09d4916c478a9390f23f1312c431fade6c85713f2000000089a7f68c778179369b83d5cd90327717bdc43df8a54958a6497727771e64e4a9400000006d6da8c33848ba82265792e8254c221a3df41df9a71f0042d32fc4306d43164cbc5eb109de2633b16aa991cccddc55fdf8ae3622affd93ee293507c0e6c5044f C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20b51acb5337db01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "437832917" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidar.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2292 wrote to memory of 2508 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidar.exe C:\Users\Admin\AppData\Local\Temp\2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidarSrv.exe
PID 2292 wrote to memory of 2508 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidar.exe C:\Users\Admin\AppData\Local\Temp\2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidarSrv.exe
PID 2292 wrote to memory of 2508 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidar.exe C:\Users\Admin\AppData\Local\Temp\2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidarSrv.exe
PID 2292 wrote to memory of 2508 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidar.exe C:\Users\Admin\AppData\Local\Temp\2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidarSrv.exe
PID 2508 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidarSrv.exe C:\Program Files (x86)\Microsoft\DesktopLayer.exe
PID 2508 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidarSrv.exe C:\Program Files (x86)\Microsoft\DesktopLayer.exe
PID 2508 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidarSrv.exe C:\Program Files (x86)\Microsoft\DesktopLayer.exe
PID 2508 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidarSrv.exe C:\Program Files (x86)\Microsoft\DesktopLayer.exe
PID 2520 wrote to memory of 2388 N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2520 wrote to memory of 2388 N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2520 wrote to memory of 2388 N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2520 wrote to memory of 2388 N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2388 wrote to memory of 2796 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2388 wrote to memory of 2796 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2388 wrote to memory of 2796 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2388 wrote to memory of 2796 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2388 wrote to memory of 3028 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2388 wrote to memory of 3028 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2388 wrote to memory of 3028 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2388 wrote to memory of 3028 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidar.exe

"C:\Users\Admin\AppData\Local\Temp\2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidar.exe"

C:\Users\Admin\AppData\Local\Temp\2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidarSrv.exe

C:\Users\Admin\AppData\Local\Temp\2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidarSrv.exe

C:\Program Files (x86)\Microsoft\DesktopLayer.exe

"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2388 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2388 CREDAT:275461 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.bing.com udp
US 8.8.8.8:53 ssd-life.com udp
GB 145.239.252.65:80 ssd-life.com tcp
GB 145.239.252.65:80 ssd-life.com tcp
GB 145.239.252.65:443 ssd-life.com tcp
US 8.8.8.8:53 e6.o.lencr.org udp
GB 88.221.135.113:80 e6.o.lencr.org tcp
GB 145.239.252.65:443 ssd-life.com tcp
GB 145.239.252.65:443 ssd-life.com tcp
GB 145.239.252.65:443 ssd-life.com tcp
GB 145.239.252.65:443 ssd-life.com tcp
GB 145.239.252.65:443 ssd-life.com tcp
US 8.8.8.8:53 diginotion.com udp
US 23.239.13.102:443 diginotion.com tcp
US 23.239.13.102:443 diginotion.com tcp
US 23.239.13.102:443 diginotion.com tcp
US 23.239.13.102:443 diginotion.com tcp
US 23.239.13.102:443 diginotion.com tcp
US 23.239.13.102:443 diginotion.com tcp
US 23.239.13.102:443 diginotion.com tcp
US 23.239.13.102:443 diginotion.com tcp
US 8.8.8.8:53 www.microsoft.com udp
GB 95.100.245.144:80 www.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

memory/2292-4-0x0000000000400000-0x0000000000AE2000-memory.dmp

memory/2508-12-0x0000000000400000-0x000000000042E000-memory.dmp

memory/2508-15-0x0000000000400000-0x000000000042E000-memory.dmp

memory/2508-14-0x0000000000230000-0x000000000023F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidarSrv.exe

MD5 ff5e1f27193ce51eec318714ef038bef
SHA1 b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256 fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512 c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

C:\Users\Admin\AppData\Local\Temp\laD5E5.tmp

MD5 efcad9828a2eb5d476e6d83261322778
SHA1 30508791e0e5f57e2826d9803b387a17da5bfbe8
SHA256 b75e4a842e13e09999531a71691439423cd99c26e0be5bedd1714539073ca58c
SHA512 6dcb5c00d99aefcf3e104ff8dd768bac782421e859deb06a7b0fa5c388bcffe309d9f47285bbdbde373066f64824e5a9654646c7a19d7a44940af94db5c38452

memory/2292-9-0x0000000000250000-0x000000000027E000-memory.dmp

memory/2520-24-0x0000000000400000-0x000000000042E000-memory.dmp

memory/2520-26-0x0000000000400000-0x000000000042E000-memory.dmp

memory/2520-23-0x00000000002D0000-0x00000000002D1000-memory.dmp

memory/2292-41-0x0000000000250000-0x000000000027E000-memory.dmp

memory/2292-44-0x0000000000400000-0x0000000000AE2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\CabF8A4.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\TarF962.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3ee000c514673f10e239a5a1dc03879d
SHA1 f4d59ae8b5facb5627dda382bfda50095d009574
SHA256 a34b02cadab08ca8dc7d95234ba6d1ef23c058fbd79563875be9bcb71a5afccd
SHA512 debf3cd5142e92642045b529f93f0b5b19bf561bcd75eccd9f704c9bd556a78ecb00341ed6485cc4962b6893ffa341be2a9f2ec62e9e460c7e01c86317bb27ca

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 78dfec88ee3b68f9bb287852f87a0e18
SHA1 f2a7a0bacfbbfed0c933e05d2ff96f0acb1c931c
SHA256 fb8590a220b4be98d126de41e96d0512ed103ce2a51f2697f6475e66c34dfeb7
SHA512 bffba154eab9eda02f23205a6212a7dd1408fcc14a1ea5608ed1145ff02c315ddbe724dafe774e819387e95cf5a1f25b3723a13dee0c7ff5f73964cdf0ae9b64

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9cdcc7d1804ca9fde5f49b7b8fbef60a
SHA1 d57458b62bb97836dad91cd236afcd423b396a41
SHA256 8ed4166fc3d9fc7f7cec40dbc49b1a50f2527e0bb2cde94bc4d438f5b35f5148
SHA512 7d7ad8f7e1ddd1c52b5db911b039b88217734253df0d794a16db86f1ccc8bf7f5d8ca97f99672c99b3fab7aa86e3d14f722f5c78d43e82f2e9948f20f7a7e637

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 765ff75715c9da30b2c226a1ce023a10
SHA1 af680328e323b3c116f2928d5f79d173bef67c19
SHA256 487aaa57294e4f9c02027631b4b4d0c89bc8e14c164cfe8a0b6f728f05d4b249
SHA512 5bf79c8df3f9bdc3b1b672e5d445cb17e4f929a30ab49c08a94d3291e48136f11a0a001cce1fa6b1f7a0e5f24de7c703b8048533221a355298bdb24b1255a1de

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 834fd5dd67651f4fd00301955aa89880
SHA1 a0de8cb7cfe283a38c99fdbce783fce457b69893
SHA256 ff31d9d9d2246442cba9d55119461f284879c01f4d6d2e77564bf5384b516545
SHA512 37aeccff276dc52c1541ac6f4af462960e5c571c8fddd04a4a8a831f1b5e9a3ae2d836047466bf30e52ce6ecdf7e6423c29b67911be6a0c9e219b69b32f85b4d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3875235c5f104badeb98ab5222f577af
SHA1 ab0cd6ce9a391a9c8ca3848e4c0ad7727a0ba1f9
SHA256 b14ec231701b0ba5b43f0cb825bf71d355da19ae4663848ab4a7bd5cfc7f10a6
SHA512 cc359c2d3d72bdbe401c552b362f32bfdb67f3035be78c456f7f4a5753186f7acc4b9ffea89039d15729dcd584c770a453c1398db85859e3012e1eb78b078407

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a58ebc8ecb0de690b33f32edde302b8a
SHA1 9f03c98ab51530b3af9644d5fedf3777ee3352b8
SHA256 f6ee3526ddc4aa76f91c65c0890772b9e7b2f3fe4bdb17a14cce46adb857baf1
SHA512 9c9ac1b951c739fdecea9cada6667dd7244ea663a3e517679996d41b7cc35d7a6cc8506f2b4afde7b439f989ea7e4fb1335210a6b9a1b7c0acce1248e6b0f0fb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7878510e81893498338a057e28413b85
SHA1 d6c3e2be2115e6a3ec3f9019b9ec9369575f613f
SHA256 1d5020da055533c366188bbbf33f4fcc6d83c90b30576e9cde85472d727ac1da
SHA512 841ab9f25caf2bb516bc52d32ae3347de96c89febe0b32e777c38b375d4a2acef85dbd1d7537b935db5eb4407fa67e8b10af76556651cb6ecd73e8c1036e8fa6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7772721ad933973f49c0d8edcd7a120c
SHA1 53d19f5b2f8115a3e0a9c79a70762875c4a56658
SHA256 c4c2cb1e6e85eea1e5c6e551fd21ad9b5234720c19fb6a181433777b2e9a1036
SHA512 7a4348e4d758b87685ae19a545b606635468daffe21311b129b3fd5bfa8d8bb68febb67a7b910c73b636979253bb69ef003032bd6838596754f1e7180c658505

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d67355c824a4c68ef6b00946e816dc09
SHA1 6ea09e2b5a93c6664828e629bbeaa0249a174fe2
SHA256 f5cd6b7f8de026da43d92e4936e06b8e689a788cc244612a149a51a8e0b2ed51
SHA512 9500436866d766181eafbc037e0d19aaef9333f9c18146c88fd805bc7bb25c5779d3cc2a0bd8cae1a7d7ed3dd8fba6c39dda1d33751336b7fa2089ad9e71e349

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VUUZQMCA\cropped-android-chrome-256x256-1-32x32[1].png

MD5 f2da1f88e64b24cd39beb299e3496f0b
SHA1 8889e0b48a75188bce45aaa442690203b853af31
SHA256 5b6f1d684cf0946af6904d138331165f473d67dd2791bb5877118c106854078c
SHA512 8e942b83478e308759f4d2de24cca01b0f2acf42c896fa6522cb3c8a98b23afd7be39fbeb220ecc8816b44499e0b2c3360f312d0cd0b5816f66f372093898ad2

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\z8d0nzh\imagestore.dat

MD5 614ab9b6fef5cc0907bbbd1a50ba0ee5
SHA1 1ac1e9fbfbd49f99a1575f88c67d311af123b8ba
SHA256 949332577db4e956ebe7ddace9e178bd4e7534d3bbb0dce0724ecb8546c5370c
SHA512 0084e9463fd7f8f794e489787db7373d34dd3458e8cb9c1ae4ac971afeade3d4f92f6374f5e84c8517265083cdffb3b3e7ea7ee3565f257f49e9c0644c488224

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 814b171ba8e5161059e3534bc0a4100e
SHA1 e829b6ae1bc4d72b4a0bf494bd7ea91dad3323e0
SHA256 2e8147d6eb26509a8e4924a2bac30659b9b4e991c468f7adbe6b06725a28fd42
SHA512 31554bbd32f34f20399ae004773f119887b98afd11a44ff6d53b7b735eee33a259f367b58531898ac512c32b56d11de8085f264834caf88d61d5a7928fad8546

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 49e7a49cefb9fb9ee5cb0d87b0a807bc
SHA1 6428bc39a357d28824fe0b2aab444b6abba0abda
SHA256 5bd412a7b12d74a267fde101f089997f7d35159bb5438b301240ec36230f7a91
SHA512 5479ecdea7ba3f330f338746c472d2b3ac2b2df0c2ec05b99399315b8e4141f9bd2b6e522e7e3d60c6794c5c277043d0a8ace6794319dfa846cf8de13728b714

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 5ccc1f17e4f5612b0b423b4c654f1811
SHA1 60ec6fe1283d243766a387a47cb6dc8ecf13e45d
SHA256 9a8fd3caabf9dbc0807cc1019be099b85ffe0bb20c10a572eac2cf635323ab2b
SHA512 c96a1c98fc6fad33487d32a704a2a2b517f2405662b072307a37ac57b0e856a981fcee26269565ebd30542826cb18494631aa75d72b3cbdf44bddc9d0e0b2b14

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 90f26e26a48101258296840387158681
SHA1 4d207bd4928e935a1e3d54950859a5cbf1a091af
SHA256 3ba62b6aaf547c71869e299ca776d84c7563da4cc9d6067b508da96467c6cdf8
SHA512 4c94dc31d1dfe306d695781152ec9ef4004f556dbd84ffc9573943c9266ed5efa5803584a7241c4345f77616edad05a85852132c61272b459aef604d3feec8e2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4bdeb85b1be19ae567830cd1344f4d51
SHA1 12a78a8d21c3fb98a89dfd470abf4a67ab07f463
SHA256 b0cb0a5547cae18e96f3fb80dd009a869c1807e80fd31e3b953723aad3beaf46
SHA512 e206995d8269420e51e4fea8423b64536ff6c6f41852fd9f5614db765fa5f72fadb379024513844cddb3ce24f9b10f03b600fd840143f172dca805b0ed5ed096

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fb1642d83c4c84cb7208fcc13d907eaa
SHA1 59d220137b7699771929523553a6fdadd6df8b5f
SHA256 66f79e1b08d22191e8a8299936752f8ee3252e7cadd2712ae13bd456b6127214
SHA512 f1e8fe4e5dd2c753674279e76f2cb1748b22b0b996d990f122569acf8d51fec6f77eddd64e40edd78e6aafa2940e315557288683a5d6888c6c58b4bc4362fe5b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5fa9bf1b7ca0fb0fc2179b3cc5ad4f80
SHA1 a2a5049da72c0e1eb96e6a74f184e3d9482cfe2b
SHA256 357ddbef9e935316c4f5d426b2f6933ce99dfa85d6e86064cde4dd33f19d1535
SHA512 032194ede1b8c5ce88e80659bb0fa7ac7a00da0218f9495b1a1d1674710cc22805ff0d76e7228eaea3606a0745fa81a25c96d64baa9160ae9712cd1a3151e6d0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0fa66f90e59a4a6fca6f9fd0af3db42d
SHA1 5b91e388b1f8864148287bfc9ebcbe52ceed6ec6
SHA256 2847d2ae95319d3d60c0f49af35b38578eb00e4a83c6ceffb952a2eb7a2163fd
SHA512 2b7df47d9e95da1ffbdefb03a182543fbbb094b06dc85375238c10674592344fdc289656fffe09a64b359e60a595fab3c4ba7f48ae1c0fe0d1914951e1d175f4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6dc6dd80203339c7c1e40db229a3775a
SHA1 7d27917320e067c700352d96b00b02bba3d095a0
SHA256 9333c09274649abd045af620af6c8110c3d8b452a8007c0bca2a55c6d04abf52
SHA512 460fda1eb6196cfc6fa71408138aadab228f9d07dd2019a1dad310aff13b059a5775976b8cbd5fc367a34ed003b76c6c3949f9fca7b90b62dd07f11a67ddb3c5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 9499ebbc1c35fa4d1a9a6e4dc7e2897f
SHA1 b4b2c0fd8897bbf017bae992630d97d5e8a10c27
SHA256 e47b1efa6a0a90fe5dd93105a9c397731448a1aabb83deab5cafecda1aea12e5
SHA512 ff0697fa3d771b0780d1f7b41de38160c6f5766ba2ec388953023bd8ca4261bd11c2c22ad9bc6a73a148c71928f9e30aaba3578f82e9a524ad91a1e44be810c4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 469908cd72d3ae42c175f3c7061512b2
SHA1 bce624a9012323dd5d40626b7015a3079ebd488c
SHA256 531558036deaa2d90dee75a69bf9c935c8ed9fd229d80033ef6c02f93e643872
SHA512 7459febe9ef431e305283eb2ea8b1897ab3210f54e970d2057626dfe55e38acf6729de0639c4cd1a92396879b8ddf2af8a1ac19901d362ce1d350a6c54787a72

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 08d4e6ef799996c725a7afb58b464575
SHA1 2acd66e40804e92904f577e9248bd24eb88ef0db
SHA256 a4171690db227303d1cc7e01a729c46eae58a8f844143e40874ac64b5f1c468b
SHA512 14e9a3d0b37892d6240be0c0fd3beccbd8c0c6b104b4ac9b9ccc6920b1cc36b79310e02c7f5d60b7b90c0d180e2d23e15b744ed64d3f2f9bbd83f2557bdd7f1e

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-15 11:44

Reported

2024-11-15 11:46

Platform

win10v2004-20241007-en

Max time kernel

141s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidar.exe"

Signatures

Ramnit

trojan spyware stealer worm banker ramnit

Ramnit family

ramnit

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidar.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Microsoft\px9A8A.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidarSrv.exe N/A
File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Users\Admin\AppData\Local\Temp\2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidarSrv.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Users\Admin\AppData\Local\Temp\2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidarSrv.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidar.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidarSrv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Microsoft\DesktopLayer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "438436022" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31143763" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Internet Explorer\VersionManager C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31143763" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{EC2A9AE7-A346-11EF-BEF1-FAA11E730504} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3231878079" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31143763" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Internet Explorer\VersionManager C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3231888102" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3235137982" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidar.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidar.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2084 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidar.exe C:\Users\Admin\AppData\Local\Temp\2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidarSrv.exe
PID 2084 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidar.exe C:\Users\Admin\AppData\Local\Temp\2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidarSrv.exe
PID 2084 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidar.exe C:\Users\Admin\AppData\Local\Temp\2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidarSrv.exe
PID 2836 wrote to memory of 4292 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidarSrv.exe C:\Program Files (x86)\Microsoft\DesktopLayer.exe
PID 2836 wrote to memory of 4292 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidarSrv.exe C:\Program Files (x86)\Microsoft\DesktopLayer.exe
PID 2836 wrote to memory of 4292 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidarSrv.exe C:\Program Files (x86)\Microsoft\DesktopLayer.exe
PID 4292 wrote to memory of 4124 N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 4292 wrote to memory of 4124 N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 4124 wrote to memory of 2628 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 4124 wrote to memory of 2628 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 4124 wrote to memory of 2628 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2084 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidar.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2084 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidar.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1688 wrote to memory of 2348 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1688 wrote to memory of 2348 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1688 wrote to memory of 2664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1688 wrote to memory of 2664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1688 wrote to memory of 2664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1688 wrote to memory of 2664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1688 wrote to memory of 2664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1688 wrote to memory of 2664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1688 wrote to memory of 2664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1688 wrote to memory of 2664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1688 wrote to memory of 2664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1688 wrote to memory of 2664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1688 wrote to memory of 2664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1688 wrote to memory of 2664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1688 wrote to memory of 2664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1688 wrote to memory of 2664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1688 wrote to memory of 2664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1688 wrote to memory of 2664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1688 wrote to memory of 2664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1688 wrote to memory of 2664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1688 wrote to memory of 2664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1688 wrote to memory of 2664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1688 wrote to memory of 2664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1688 wrote to memory of 2664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1688 wrote to memory of 2664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1688 wrote to memory of 2664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1688 wrote to memory of 2664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1688 wrote to memory of 2664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1688 wrote to memory of 2664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1688 wrote to memory of 2664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1688 wrote to memory of 2664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1688 wrote to memory of 2664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1688 wrote to memory of 2664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1688 wrote to memory of 2664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1688 wrote to memory of 2664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1688 wrote to memory of 2664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1688 wrote to memory of 2664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1688 wrote to memory of 2664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1688 wrote to memory of 2664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1688 wrote to memory of 2664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1688 wrote to memory of 2664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1688 wrote to memory of 2664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1688 wrote to memory of 3712 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1688 wrote to memory of 3712 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1688 wrote to memory of 2776 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1688 wrote to memory of 2776 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1688 wrote to memory of 2776 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1688 wrote to memory of 2776 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1688 wrote to memory of 2776 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1688 wrote to memory of 2776 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1688 wrote to memory of 2776 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidar.exe

"C:\Users\Admin\AppData\Local\Temp\2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidar.exe"

C:\Users\Admin\AppData\Local\Temp\2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidarSrv.exe

C:\Users\Admin\AppData\Local\Temp\2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidarSrv.exe

C:\Program Files (x86)\Microsoft\DesktopLayer.exe

"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4124 CREDAT:17410 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://ssd-life.com/eng/why-ssd-not-found.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xcc,0x10c,0x7ff8156846f8,0x7ff815684708,0x7ff815684718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,1493699758245966477,17563382069565482284,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,1493699758245966477,17563382069565482284,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,1493699758245966477,17563382069565482284,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1500 /prefetch:8

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1493699758245966477,17563382069565482284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1493699758245966477,17563382069565482284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1493699758245966477,17563382069565482284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2028 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,1493699758245966477,17563382069565482284,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5828 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,1493699758245966477,17563382069565482284,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5828 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1493699758245966477,17563382069565482284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1493699758245966477,17563382069565482284,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3584 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1493699758245966477,17563382069565482284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1493699758245966477,17563382069565482284,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,1493699758245966477,17563382069565482284,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4764 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 ssd-life.com udp
GB 145.239.252.65:80 ssd-life.com tcp
GB 145.239.252.65:80 ssd-life.com tcp
GB 145.239.252.65:443 ssd-life.com tcp
US 8.8.8.8:53 65.252.239.145.in-addr.arpa udp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
GB 145.239.252.65:443 ssd-life.com udp
US 8.8.8.8:53 cdn-cookieyes.com udp
US 104.22.59.91:443 cdn-cookieyes.com tcp
US 8.8.8.8:53 91.59.22.104.in-addr.arpa udp
US 8.8.8.8:53 234.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 227.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 log.cookieyes.com udp
IE 18.202.75.95:443 log.cookieyes.com tcp
US 8.8.8.8:53 cdn.jsdelivr.net udp
US 8.8.8.8:53 region1.analytics.google.com udp
US 8.8.8.8:53 stats.g.doubleclick.net udp
US 8.8.8.8:53 www.google.co.uk udp
US 151.101.129.229:443 cdn.jsdelivr.net tcp
US 216.239.34.36:443 region1.analytics.google.com tcp
US 216.239.34.36:443 region1.analytics.google.com tcp
GB 142.250.179.227:443 www.google.co.uk tcp
BE 64.233.167.155:443 stats.g.doubleclick.net tcp
US 8.8.8.8:53 72.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 95.75.202.18.in-addr.arpa udp
US 8.8.8.8:53 51.201.222.52.in-addr.arpa udp
US 8.8.8.8:53 229.129.101.151.in-addr.arpa udp
US 8.8.8.8:53 36.34.239.216.in-addr.arpa udp
US 8.8.8.8:53 155.167.233.64.in-addr.arpa udp
US 8.8.8.8:53 227.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 226.21.18.104.in-addr.arpa udp
US 8.8.8.8:53 mc.yandex.ru udp
RU 93.158.134.119:443 mc.yandex.ru tcp
RU 93.158.134.119:443 mc.yandex.ru tcp
RU 93.158.134.119:443 mc.yandex.ru tcp
US 104.22.59.91:443 cdn-cookieyes.com tcp
US 8.8.8.8:53 mc.webvisor.org udp
US 8.8.8.8:53 mc.yandex.com udp
RU 93.158.134.119:443 mc.yandex.com tcp
US 8.8.8.8:53 119.134.158.93.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 www.cookieyes.com udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 161.19.199.152.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp

Files

memory/2084-0-0x0000000000400000-0x0000000000AE2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\2024-11-15_4ba94831a2abd837a22db12c9ae27920_icedid_ramnit_vidarSrv.exe

MD5 ff5e1f27193ce51eec318714ef038bef
SHA1 b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256 fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512 c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

memory/2836-7-0x0000000000400000-0x000000000042E000-memory.dmp

memory/2836-5-0x0000000000400000-0x000000000042E000-memory.dmp

memory/4292-21-0x0000000000400000-0x000000000042E000-memory.dmp

memory/4292-20-0x0000000000520000-0x0000000000521000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\la9A9A.tmp

MD5 efcad9828a2eb5d476e6d83261322778
SHA1 30508791e0e5f57e2826d9803b387a17da5bfbe8
SHA256 b75e4a842e13e09999531a71691439423cd99c26e0be5bedd1714539073ca58c
SHA512 6dcb5c00d99aefcf3e104ff8dd768bac782421e859deb06a7b0fa5c388bcffe309d9f47285bbdbde373066f64824e5a9654646c7a19d7a44940af94db5c38452

memory/4292-19-0x0000000000400000-0x000000000042E000-memory.dmp

memory/4292-18-0x0000000000400000-0x000000000042E000-memory.dmp

memory/2084-39-0x0000000000400000-0x0000000000AE2000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 a0486d6f8406d852dd805b66ff467692
SHA1 77ba1f63142e86b21c951b808f4bc5d8ed89b571
SHA256 c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be
SHA512 065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

\??\pipe\LOCAL\crashpad_1688_MJNZFCRYCEXSBITS

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 dc058ebc0f8181946a312f0be99ed79c
SHA1 0c6f376ed8f2d4c275336048c7c9ef9edf18bff0
SHA256 378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a
SHA512 36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 6d03c490d03465d78d61dbf0e176bb09
SHA1 59535175043cb5fab575005c385abac1034d5339
SHA256 02168948c86b2b219cae3cba794be43459aa87d1d292545b428dfa001c676c8a
SHA512 87690c501d7797e491f83990a0c40936099bd5d0d445881520bada63553cb1e4393bc04d195db1e07d53acc260a483e50f61dc3a57028750cea6d8229a973d19

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 5cb2ef00194555bfb9636572af50705a
SHA1 11660ca44df27452f963d69ba7b937ee3276c153
SHA256 6a344906c6c96b9281ae869b25ef475bb3eb48cf721c938deea364d63be60ef5
SHA512 d15438a77374caa147af028f151cda3a2031cf11833ca2faf189af727ea89856368093abbad3c1773a6ce3159745329a5c65bd202528942df0a7439ef88cb050

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 83c8d6a92c65a5770e0b2e383c541c07
SHA1 01d06126d3e90f0e47f84a17c0e8f0603d78a685
SHA256 ff98137d97ac6d51a888708a4236579aa12346307a336e7f5a22080b080071f3
SHA512 e285386b3b862f754b8d6e3c94190086a63c53c96bff8c522039273ad26ee9b3d4e30bfebeb4223d6bdeaa9f986da75b66f4b9838fafe13225bbff38717bca82

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

MD5 4716dbab6f2ab2afcbaf76db5f0b38c9
SHA1 9ff921c8611055814c46c2f6040cc4212879907b
SHA256 14e6269329dc675b9c53db477169c352464cdcbf50d9653a22620720fcfd6573
SHA512 3ceb67375c9023369d37b78cc52157c6c3c540b3aef9dc470ccd562b9046a3883fc27a7f193550230987927db461d7e7b0a8cddfec12f45817268499bb78d02d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

MD5 2ad3d32556d2745760f87fc75d18f397
SHA1 b0d58ac18591a90123b44526ac531d00ad674fcc
SHA256 854d4efa0eb6f9e5744e8ddbdc1c8aca01aa508f35316ecfcb1436e71f7efe54
SHA512 813b853d33ecf16341c3014c5be515462d709921ddb12631d76901b4718fe7f60653d6cfbfdf811d6c7f714a44f7c11a074edf904cb28111db4468fe7660a01d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 f550433d005be59785454dd4ba658e49
SHA1 37da14d0a9ec7406f52518fda1cfae14d14d6b2e
SHA256 430c561ab4a9e1e2813839a07af50cff0271a4fdc4e6836b4ddcad16016fef18
SHA512 f330a551b4ba524be5992d7d64f3f7cb85d185241b71f78ea3e39ac2d203497d8ade29b1bfa15ab828b989aceb2ea62289344b38e5da90012c052ee59a18ff1e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 c7a88352abb4ec6db5f4189bc77f0934
SHA1 5fb4f080e5f358ad931bf565d1f495b374759d7b
SHA256 b987ff77c14888801c337d5da8ef14ef6c37b44ce843df14e4d4dbd273f7e24b
SHA512 74df8d220b3b56a379b03bf4682b32a8b7d8d7d7ae64477c6dd83269c68bb54fdbc6a9929ba97a2bc62f6d749b047ad6de9448c230869565443cc913bd106af3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582d83.TMP

MD5 f23ed5662a3ba73740ac922bc4b1c806
SHA1 e32e691b4382e741e52d5948b90f7121c7ad53e3
SHA256 054d4b469992273652e5568e5c923ddac4caae60045c83cbf514f0684d411326
SHA512 39210d0ee19b50eac08897c7ff1c981d82c92a9185fc99713d6c110ac66696189f2b86cbe2189b99044abf7ca0a52e4a7436389dc5b17f91b7fd8ae24d407c96

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0GUUC90F\suggestions[1].en-US

MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 ec3fd13d2e74572d22ac4798add2eaa6
SHA1 ee03e0ab3fb6bb255acc0b523395fc4f6519a320
SHA256 c70052ab06dd4857108f1ea2c9581ddb0586da522a84d0de1e326bd9ed727034
SHA512 ccade02918a978a705198843a02f494ce5c6cc778c93da359a06aa85cb2819703db25b610d1aac072c02a6143bd95b01d1b2f1b3172fff1784e9d2a8b37efff5