Analysis

  • max time kernel
    121s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    17-11-2024 23:53

General

  • Target

    57ab704203849ad443945971dea28a91ce28e37fbef35d9f600bbe9b29c6bce0.dll

  • Size

    392KB

  • MD5

    c8b1323d25f830e843d3016523d9e339

  • SHA1

    0e1adba87f601360722c5a9ca2166ec274d1bf6f

  • SHA256

    57ab704203849ad443945971dea28a91ce28e37fbef35d9f600bbe9b29c6bce0

  • SHA512

    24bfbcd7a94dca2e11f41eafaf5f9279070388d16ddb83a81c5a3a2c0662e5ae6c4451dd656642b14dff9eafc006d783312fe833a88f1fe88e4bf6a217925c27

  • SSDEEP

    12288:1Cce1t4O1NOtOPGfqfo5s6tUk/H+d5zmqU9wST:1Cl1tbMner696a

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Ramnit family
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\57ab704203849ad443945971dea28a91ce28e37fbef35d9f600bbe9b29c6bce0.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2096
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\57ab704203849ad443945971dea28a91ce28e37fbef35d9f600bbe9b29c6bce0.dll,#1
      2⤵
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1780
      • C:\Windows\SysWOW64\rundll32Srv.exe
        C:\Windows\SysWOW64\rundll32Srv.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1932
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2076
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1692
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1692 CREDAT:275457 /prefetch:2
              6⤵
              • System Location Discovery: System Language Discovery
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:2276

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    dd23657c326c2dac3cbad92e1de4c78c

    SHA1

    b801324636bfa0c8cc20652a2af9b9a1d617ee5c

    SHA256

    e6d192b9249fb64ff7114d05ec998f191917de5ef051935a257d4c76cc548f07

    SHA512

    d3083833c85facdd8fc00f984c9453ed9db32f14ebabcd80b68dd46ada40369472aa2fd5807072657321a10c55d82993a899ebeead949299f8653d8c7580a85b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c7353441796f732dcaa7864c097b1f9b

    SHA1

    276e17d96144d3720c5abe51390eef9b7f9dffaa

    SHA256

    313a7f6f1a7b0eed9158cf4ac892d0bd7db024dd8acb76f51f8b5ad663f4f978

    SHA512

    2218f3c0f486ba10de5b3e1b93618612aa5f11e1b13c28096af88d9c850e4dddce1d791f41d07f0efa9683da14a8f74e05cf00b48c05fa09df6c7612dc8d3e30

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    09465ede8090466832843da821bc6232

    SHA1

    6a418eb3a96a6c1d69996495a9f4120502c05722

    SHA256

    05a50b7a5d69ef0e7e5792ed92e22961b7af445c994ea4e751e2698bec180204

    SHA512

    43ed5054eaab1716f3a9bc7f539bb2d8f65573fe0b10e02c530258e223c7d0d75f4f159756669ce4425dc88617087f61bc37120f4c6a51026c621be2abd17090

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    4c5aa8650fd14b353af5bacd26f6dde8

    SHA1

    b67a977a1512f9443ef2335327cfecdb6c42e8e6

    SHA256

    7f818a6045d1f27e8564821a9e69288022199e89e76947c23c46bf92e7267c03

    SHA512

    8b239647fbca44964502126418b6b38c1512c2deeca85817b7a34ec907008696498e5c8e84d1f79434ee821666ff25fecbf144bd87b46ab9d29d182190e18330

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    5fe8ee13931b0bd4fa97d5962a843440

    SHA1

    e03e83819289f10a842f44db43b35696a9e99640

    SHA256

    4a8d8882cc7b5b1cb894a2c1169fc8efe304407b7e9b449111a529416665b966

    SHA512

    c2a82c26b025240849963ea9b1d0f0e9ef51a9cd7d82f098d063765ae8aeeca0cea64b93449289ba2112a25c73df23e05271e11a90d20c967e9810613de800ca

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    810b9c51cd0e749a5d9f31fa3d516f40

    SHA1

    24e7377e6ec00cf056eedbad66b8b691e82fc75b

    SHA256

    0f147df527c6417c078bb63ce126ebaa8c6795359471130048c0ad44f5bf33c6

    SHA512

    c527c0d44cdfed7754af9b1100d7613315791f6aeaae579b38316b4ed629fcde573bb5b532779c09f26c6be20dc19334314a000b5735903ca099dc4c1a001546

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    625be29a43b5464d14aee58645aa54bf

    SHA1

    78c87dc984ef7879d6e159ede88f762c55429fad

    SHA256

    69e772ad110e783442e05a4667f557fb1e49afa1392c981b218e2d8055acf06e

    SHA512

    8fb6436196f7a90cf3e3e54e34611ed34793ff1d7d7a9fa793e6b87a2f63fe034168cb3610a0f141c0a38810e97c96db56bdbed37bbff3292690b2162c5fcfb4

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    15141c5f16bc304fc70d0c2b4fb145d7

    SHA1

    e49e648279828ff40dc2441829ff0b85a02c430a

    SHA256

    435b055912e59deec76ab503c77a688f1eba2f46f7fffe6c968da6b66eaef0a8

    SHA512

    aa86827388a1d7776d7b65079763a59600913b8b5e79ea7f9fb23fe948a0e2084b87d1fb3d77b5ea5f56e4740dba43ee87ce7614d5ce505940b09579ee5ebc7f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2d6101301d3057ee08d81ebef169d3dd

    SHA1

    fefa6cf14444f3712b6ef6d1db79fb359d80e6d3

    SHA256

    7877d8ffdb9079369869e97bb2cf80813770701d6dccf476ce05e421a6684984

    SHA512

    cb0bb457f28b6b281fcc05b563a94ecb9e64c70a15aa8d2d3302700a91c4ec0ddaecd3716b8b979d6d24b430e48315fef35509c0a3f2bd167e12bfa100810925

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    de98e6dc02817d1b21844726ec4fa800

    SHA1

    644bce07199cd622c6800da96a6ace8a2ab38d52

    SHA256

    b2c8d3972f897207e824d9855327df62ca6bcc519b765e3d4e7a944ceb64e0e5

    SHA512

    868fe08d73f3db8e1d2d0e7f270e39d7fa4ef5860f0066eb43914e3e9d043c742b032aafd945046babacc8adc511905f5543e784a18148d607e3d82a0d335da8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    cfdef869b163f2d7737fc291e2d2ffbb

    SHA1

    341af5bec2b1dc4379766cc49c8c49f7977a57bb

    SHA256

    0ebc228d665b2e718445ea2acb0f8f4b425eb1fa253b63056f0417ac41303da2

    SHA512

    834506b84c32b2d9833da8449e373d0c5d42c415d926e669092ea6ff5366087286c85540e6709439132a53bd1c1f83c311fd80e1ab40f9f75c2f666ba4578d5d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2ece86fd16351cc3846ebdd6a3bba0dd

    SHA1

    428e34c66eb8d886428bc2860c14b754acfed481

    SHA256

    4ec130542cfdc9ac6337d5fedd2f53da961fa8c778d348fe48f415d2aeebdba7

    SHA512

    82310fcab8b83f765b299a83a40ec8454d1d51dc13e6202658096b5edd3fddb015c87b256cf1d9463c2ce413aad0a5ef56ba5dd4717cb53a0d380b811873b0fb

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    3ce5715cbcf8f64f26329797e228bb04

    SHA1

    acf8c54bdb4c79482f40f1ef697d62a1a5ca1c60

    SHA256

    79c9928987fa06ff509806c0205485873f8bfa3e57be325c5c6f001b0bbf87de

    SHA512

    453a02059fcd7734253cbfa4289c6d04df14658b57795db9cbe87d8c00ebd693443c2d01ca0d7c5eb41f0383291daf4b23cc45d0c3e80a2c95b1745ba2ad7cd5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    be254d9135acbe6e86264ed664fc7f78

    SHA1

    e274368b89cb3ede367775da95062bf6383cddaf

    SHA256

    6637d69f953709e7f033ef66181357055bb6206ad8c6300f18fcb54db93979ae

    SHA512

    cd750dcfcc91a1d85be2c7fd80c1f76b4662a1715927c69dde5f53ca39e789b194e3951d248518ead130a0f0c3b0ebed2fc1128bffecfe84502a52d68f8b4f31

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    36e38ceb7eb1240a9683c7c7c374bc3a

    SHA1

    d34cfe529e0ab18d4fe9f63212c8b6849729c955

    SHA256

    244844085f9f580aa4a4f34f40d73fb803fca3e643559b589903a169b4cf22f4

    SHA512

    027b5cf3a3c6df00c11d764577c60553029a073fa243f30164edb0837d96c170afec1c317da69e3de1c23727c62406cf6c96fc8d2c14fa88ff17fb74377867d8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    bb170af5c796d5742cc0acfebd1c0acc

    SHA1

    bd998a5325775223848a93dcc11082c5f9734510

    SHA256

    5133e3a3fe096247c276e82127e20e8a732ab418c69d5ea77012d9afeadad747

    SHA512

    da7f4a0bc2b4280178fc825152381bf85e9fbf6d3efc3d211a45416564f92bf9f4b1f702249a2245d3fab910d13451a57cd190bed83895e23ff239c623d0c01f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    aee64de022cca92249d3d9f96f3f32c3

    SHA1

    806b530cb682fde3273e2a414c046da61f9a4b46

    SHA256

    1db9184a7e6ab23f028f5fbb472a8dc5fd37b8fca4ec6b6fa01d8ec3bf1a7b99

    SHA512

    01b3def4bc29ff231887844bfc7454492dcd70f35dc1bcedf47363127c5043e9207e86b12806804d8571e505e53e1f269fd28329497de5350417ef98deb71361

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    be3530711a19aa475c929f50a6f62984

    SHA1

    b88698c21cee888d56c5efd79f55f7b6a377d9ec

    SHA256

    52186a1e28a3747ce8b25e73b035d2636a1ab03592fd9f1db07e7ba5bc30c68a

    SHA512

    c48987497035c41b35ffcfbe2f3eede585ab003243251074bc1ccf5c8dd490ee53820309f6d70eab6285a8603065d7ee4fc94a7fdbd36d4a76b585b0f215e019

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    01e350b115033b4102b9207190c2fed7

    SHA1

    efcf5c5ee9be15212595afaca5b3512704174957

    SHA256

    1349a00d1c72513c00c38ccb2e83cad61daadf0a97e4a241c672984769105d12

    SHA512

    614608b96c85515580a891643d480547a56e9d54974f05b96fcb40d5e4c032eea5546577674d64964bd1a95bd8f00dd8b1f533b6875922f8fb37c3284da48180

  • C:\Users\Admin\AppData\Local\Temp\CabBD4A.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarBDBA.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • C:\Windows\SysWOW64\rundll32Srv.exe

    Filesize

    55KB

    MD5

    ff5e1f27193ce51eec318714ef038bef

    SHA1

    b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

    SHA256

    fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

    SHA512

    c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

  • memory/1780-1-0x0000000015000000-0x0000000015070000-memory.dmp

    Filesize

    448KB

  • memory/1780-4-0x0000000015000000-0x0000000015070000-memory.dmp

    Filesize

    448KB

  • memory/1780-10-0x0000000000210000-0x000000000023E000-memory.dmp

    Filesize

    184KB

  • memory/1780-21-0x0000000015000000-0x0000000015070000-memory.dmp

    Filesize

    448KB

  • memory/1932-9-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/1932-8-0x0000000000230000-0x000000000023F000-memory.dmp

    Filesize

    60KB

  • memory/2076-18-0x00000000001D0000-0x00000000001D1000-memory.dmp

    Filesize

    4KB

  • memory/2076-20-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB