Analysis

  • max time kernel
    119s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    17-11-2024 22:14

General

  • Target

    34e2fa0170520b2cdc3c4be6b9fefd38f1831dbc7a4895aad21d0f62c8011401.dll

  • Size

    386KB

  • MD5

    82abd01725164feaf5a6bfe8045b7a6d

  • SHA1

    a5ac20e7d5244b96b706d2fcce7e99d32d8d3f19

  • SHA256

    34e2fa0170520b2cdc3c4be6b9fefd38f1831dbc7a4895aad21d0f62c8011401

  • SHA512

    8eef13c5b09353b269babc2c279a0be4871c2f8a87dc61dde1f69c0cdcf177a1dea8ef28a718b2337199bc9f519e06eeb046be075e7423d1732c4a711f1b3a39

  • SSDEEP

    6144:IGSwpABH88cUQcGsJCsC8c4N9brdu5AqbdyGaeapaqaew3tacgQIxrL:ILnxhcUwiCsnc4N9brIt3gQu

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Ramnit family
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\34e2fa0170520b2cdc3c4be6b9fefd38f1831dbc7a4895aad21d0f62c8011401.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1852
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\34e2fa0170520b2cdc3c4be6b9fefd38f1831dbc7a4895aad21d0f62c8011401.dll,#1
      2⤵
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2736
      • C:\Windows\SysWOW64\rundll32Srv.exe
        C:\Windows\SysWOW64\rundll32Srv.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2496
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2028
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2880
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2880 CREDAT:275457 /prefetch:2
              6⤵
              • System Location Discovery: System Language Discovery
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:2768

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7c7bf05ad4138c2b654a9f3fb955e6ac

    SHA1

    7d66a517494a6bc56f655ba2e455a0a82d978154

    SHA256

    e7958c4f5bd3a7e6adec44b1eca438cb9f8d0dd21a62d0a9e1a9442adb3c09f0

    SHA512

    c2a13f23563950ec588fd9d96f3c6d463fff54506cf2e08973b8a0d4230998f526d00da76b15631572aa73781e32dcaa42692275eb78839e53b6ef46241c5b0b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    58cb82180cd2d91adfe4289f31c67056

    SHA1

    4452bde898c43101f6d75e5eae6c32113adf0766

    SHA256

    f9b79ce98e3a85cbeaa3a2b5ffba02300c8b3b973bd3d3d072a578e0e70800c4

    SHA512

    081a0602d5ab4519f187dcf22ced8ade4f99f46f34d5ed12724a2714cc956630458c7e2bb7e3232de5f72588aa5948b95a0833da60424f669f35a78a9d257bc1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    be5227300b0c50665c4876bdb4f424d5

    SHA1

    8e73f8faa57fa802e2137a02befad5016ee793fb

    SHA256

    f8ccb4c0bebf6d4a3bc3d100f26a5310b8f9f93fcc9232d11bd45086d07d90b5

    SHA512

    955b8e0b83ad249821a0085b068f3af0413d1417f2022f7506cbcc5e0e147e8b8f0f424613290eec4611b55b22b02f9d659dc6421ce52344ad9669ec929f12c7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c78c9e782e689c26c84da27640ef1af5

    SHA1

    913e362ad61eefc52c237d0bd0f8e636fa922c17

    SHA256

    8d135e206fac59b4417213db859b4e1d6a865156bb7f40e80f35f7a864bd60ed

    SHA512

    28aa795f063843856d8d736b59c532e001c246d1a676d9e0e0a5e66cbf4c12fa908f4bfb0d0ecb65b025ed0138d5ea60d215d154ef27e1e579cc5e5cd4e6020b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c8b429dbf44ea1cd813d6a25c69c73b0

    SHA1

    61679d0cfa5a021f3597a0d62451eb1246ecfc21

    SHA256

    534936759efac1bd7e1399012b28f69b0ea9ef79f913c227baa8d53588d6f1c3

    SHA512

    17088c41dac3a9165806fe4dd2699b7fd8052d97840a7097ad673d8abe3343ec5cb980ad9941c12c5f588199105d1af094104224f6e89cde22b2b5f538895341

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ff9236b26f3fa9c573a66f9122f4e53c

    SHA1

    05706d53a0c328538e3228ff042a3b87381019e1

    SHA256

    e35fb8e0da47c308fbfa0be50fc54769b3cf7a95b87ca15166074cfbcd59c71b

    SHA512

    b41f43271c29eaf9e29fff118c2d755a487f5a7f7375cfaecffd8a83c97984fa696f98dadb0af31a38ba2f30392e536bfb72651bdda4c697eb2223c3b0083927

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c9e2a4fdb5c0314f372ad2bbbb05f4c3

    SHA1

    7f318b61a84f4fc5091d77c24d109ef25732db19

    SHA256

    3746ad716ef0e81ef0340d2df436c9ab97bd3ea260453e446db69a97ee3a028e

    SHA512

    03697655310a84a7c6f03f2e7a232dc38f3efb48f371f4f85d592b453dba8ae30265ca60b92f2228920f6cd10f6edf4652b57d0cb04dbc7027323e7cfd98879a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    0c6cbca40c1f0b3098ffaa507af7d340

    SHA1

    4f0df2f3a319cf78d38e2da6e5a0b89f2f64cb9a

    SHA256

    1a48856c25d20614396dd6722ced45c1292b1efd6e7c75d7f1be3bdf61638ba9

    SHA512

    ab3455eb5dd4163d628eee2cd99425f64013ead265215ddb532bf11932546fd0ba0c70677385a5cbc890204fd4331100969d151a54e56688f8cf7ce5d0c27231

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ca00e105b40459636ae97dfad6d377c4

    SHA1

    708b3d88eecc1779471693abdc68b3148f3c1a36

    SHA256

    03fe164dd50ad725b918991fcbdeb2db58eabf51c548a0806c9dc84d85d3a47a

    SHA512

    d8fcde11b86b105cc620816cef50ea2812e1be1944278de9c3375a5fd812b8b7f8fa3ae1b85c98c8491ba62de2a74fffe8799d7a762a17d48948b570f7820414

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    aea6e55fe7f1a8f54c0bbd0867718c1b

    SHA1

    3a5c878172f66643b6ccedc522773127f495dfb6

    SHA256

    60b0e051032f837452d1f96030d84dc74a5a604fe956c875ea76423713c8a637

    SHA512

    e218e2d7efb3c3925479f9126b4ba384100c90f51179915417d62e8bb2ad633e1d18302b2e7b71b52f3107efa54d981c08c5c820dc17739b467a60f0935dde0f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ef79466e586e0671b374d53c212d1afb

    SHA1

    b2ac4e00485ae2b0c7aa4c913320a01239b49a7d

    SHA256

    b170fa3142f92bd10b7edbcf2f9c2eaa5fdf7ed1981cfe5c22d39f57e6fa5ddc

    SHA512

    4091c0d137254a6a6045bf0bcc0d7f6057ce7f754612e9d2b21162b3224330ac8dd004888944cb86fafb0965e705004fc556c2cdcad4727ee143fa742fda7a54

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a76a3e83c94a25421ef6fc6a0ab4d10b

    SHA1

    c970a5b26b1d8956482b4cbc905645658a831548

    SHA256

    dd4191cf484447a659247f8e51842db3362274aba68992f7e09e3552d0f6695f

    SHA512

    1a09027c5e0c3efbef430f91c1564ededb3e092c4f78fb70405a36f585b83d62aa8b246fba03becd02c2d90a6ec304eb1035840a6868716742c6db0a48bb12a0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    553b0c72fae898503c11e0876a3f43ce

    SHA1

    ef5f15dd92834a587aaf8e96f9541de4494c07b4

    SHA256

    8600c5fed80cce120df6f3dc48118ef61d6acf1058bde94713f520afe34c3885

    SHA512

    e4cbc36202e8d4a4a10f9401f6578361b20b3df55e983c864e15d9f3e942d70df712d306ecb7a6e4d1cb381bea331c825f18a1e1a5911c680d88609af6e87670

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9b6db447c399e55e44816b8b23c5bcbc

    SHA1

    962dd3d3555f0060646abb7ba1a87884826765b7

    SHA256

    f5127bc26f6d1cf34cbb73d1e448ceabb0bfb2c6b6dcc389af117639e750df2e

    SHA512

    ae11091712226b465f5bfa072dc9dbcd347908d9fc7fb7774e0d04e1c99b60608dddaae55412bd3a3bc8946c6be52e03b265a1c8cf601d9debc58792a6077e9d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    34213aa5155ff859e66b75a4661ef76f

    SHA1

    562d6c1c0159c2b8eb71c8aee4aa332bfc5aef69

    SHA256

    0b9bb16c251ff4a7634c8787149c558f83f661b7c1a4fee69d841c3fb1941a31

    SHA512

    83bb5ebc0b59ff2f8c131d93173f4e32a3aaaac6987cdfd6f362f6adbb911ef545a0edec40222d6b9adecb736c0dc7c921864c76c359c8f22fd3e1c9bc88db0d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    f8fe33ea59493f8d2a3a633f83d0a1b1

    SHA1

    00719f1740b0b4e00c68f49f39dcd94e85df924e

    SHA256

    04e93ee1d886c9f9209f84226c8a51d74aefbb672f0b7d38e68920ee0f9c10cf

    SHA512

    0e8542692902db0f0ee408d1c65b964716ef5e9b1a059be48338db9ca733dc229bbd91d5685d38f99cc56f40aec592ddb244c07c35a5ee3fed91c61d6cce6545

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d73b71304c79516f79e993a52cf297d6

    SHA1

    e4bd2aa7689da3974e4f063cb6dd18963d86abd4

    SHA256

    9d76fb54277c5a7c084095bc9a3ac206042114019dc3f73401dde51e65a405f4

    SHA512

    41a681ce1bf7a6886fb9a33c0f5f3b4dde37ffa5d404098c0710496bbfff731adb0aa2862f3f5c240195fe87fca7a892519b945eee19908d6f27e76ef12441b4

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a7cfe3f21af0324d915bdc55dba5d571

    SHA1

    367bef2e599244e5fc7376eac9d858e42092af25

    SHA256

    141a0057ff79883797d8a14e211a085e425fcfb978870f828ad81b25d5e252c6

    SHA512

    f3b9b081043d2cac3cd143e61a3ba5b9343724bf720b0e79009efc8398368cfe8f419108a66b2988c06881212a82f6d285ec430990bc73b757be767afdc71fad

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2b74a2bfd07ead03e2fb26205d5c8f98

    SHA1

    24c687a35a194d2e20d4b26fba93015b3886c4c7

    SHA256

    f11836165ef5ecf858bc5ceb5ddff9a4b9647b36a46cff622f7b679302408e0b

    SHA512

    26190f0313e7e876932d453145fc8f850e6ecc1c822f24e273aa7c1619e5ffca243d7d616182de8f8714ed692c6336888dac9f309f4dab5998554de192a977f0

  • C:\Users\Admin\AppData\Local\Temp\Cab95CB.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar96AA.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • \Windows\SysWOW64\rundll32Srv.exe

    Filesize

    55KB

    MD5

    ff5e1f27193ce51eec318714ef038bef

    SHA1

    b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

    SHA256

    fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

    SHA512

    c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

  • memory/2028-17-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2028-16-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2028-21-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2028-20-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

  • memory/2028-18-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2028-23-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2496-8-0x0000000000230000-0x000000000023F000-memory.dmp

    Filesize

    60KB

  • memory/2496-9-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2496-13-0x0000000000240000-0x000000000026E000-memory.dmp

    Filesize

    184KB

  • memory/2736-2-0x0000000000120000-0x000000000014E000-memory.dmp

    Filesize

    184KB