Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    17-11-2024 17:15

General

  • Target

    48aae57de96ff91ead77f712d678b53f42dd341f178ef09eab2b300ef72ebe8cN.dll

  • Size

    435KB

  • MD5

    300da4b40f93a3084c788e6847cdb460

  • SHA1

    7c4c23125f87c549ffaee06ff30dc23d0ffc6348

  • SHA256

    48aae57de96ff91ead77f712d678b53f42dd341f178ef09eab2b300ef72ebe8c

  • SHA512

    36c3bd98eed3a37e48baf27575bf35c375f0d3b7509ee03b85c67b974b712deef10eb0f93c94225f7758e1af3111a65eecabdce9b531490a355b8f2881b9921f

  • SSDEEP

    6144:AmxIbni2hn/hZm8XqyQFAal+BtsnA6C4Xqu4G/LzliJacgQIxr:Axni2h/hZm8XqyQFAu+nGA+xiJ3gQ

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Ramnit family
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\48aae57de96ff91ead77f712d678b53f42dd341f178ef09eab2b300ef72ebe8cN.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2488
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\48aae57de96ff91ead77f712d678b53f42dd341f178ef09eab2b300ef72ebe8cN.dll,#1
      2⤵
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3028
      • C:\Windows\SysWOW64\rundll32Srv.exe
        C:\Windows\SysWOW64\rundll32Srv.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2684
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2760
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2664
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2664 CREDAT:275457 /prefetch:2
              6⤵
              • System Location Discovery: System Language Discovery
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:2564

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    6a33f54b31bf8be9e015f70f86e7c62b

    SHA1

    c2f6bd6d66a7b42bb3dc55c21473d495b913a7e3

    SHA256

    165862c052532474c241cc723158c16a710dc41a6df458002d10719ee26ebac7

    SHA512

    71d127b3257fcec44b7bb222dbc07dcca8165f4659e95eefe1809c0c83900ac8daec5065cb487f322519dbdff624e7e727f1290a4eefbb711c6ad806a9bc4ef1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    37f96e0ed2751f2722db4faf1e3f581e

    SHA1

    7d82cbfa7b0f35a30878b7a1f1b14277b33d330d

    SHA256

    94344a681d57afc833cc659d2297767da8d418658fda598a51623a2fda2cea11

    SHA512

    7650715fd03831e3a9314fef520f50edf637f48a3d5d3e1088a77a9afed699bb3edf501cd1f8046d11a26c0c91ed26c676121768e692bdb1a2d9f22add6accdc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    6a5140719067f5952b7d3c1e98df59db

    SHA1

    be8d6d0dd23fa2733165bcd4bb809d562dc4b35e

    SHA256

    09446edf6fdc869de02a659688bfac6b50c85fbdbf260b93c1e35178be968bfa

    SHA512

    850f560aca37a44b3b5f61c23f7682986c06557429210a522bbda22fadd3cafc1ee87dc8ccb9f7d000f96b610f4281392cfb7ff33f99c29441d2bccba4dde69d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    aa35043729baff1ef207d2d5322ad1d0

    SHA1

    bdacf28dac232371c014ba36f19ed9f241198290

    SHA256

    bca2e5672623c19cffa948a9d924f78e6d73058d584cc79fc792fabb91b1bc86

    SHA512

    a689cea24e86ff25fe463ec4710ff4f2aa3a516c1177c12a0459fd693b2ba3887bf96e63d8e59f5a31a0b079d4a1604a7179d4950ffd29c24f8c150a71c25dd9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2be0ac59d5238c4451f10dcd3a648c6c

    SHA1

    94316b6e0dc0f4e521296ce20270eb778f824f8f

    SHA256

    c98474dc4b9f0892cf06678075657ce2642213a0c84783f2e364ed155dd0a01f

    SHA512

    70f61a35f41ecf271b396bb01f418adaf1fb3a6084010f0fae593e42d94775ebd0af134e0659ebeb3789632cf996f8b05bbb65e9df9661cfeeb9ced0c76abbe6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    95d2de73b491b0fe7f7f0bd9e6e590a0

    SHA1

    e4a8932b00e909fda6d8dc8672d9e143b87fd4d3

    SHA256

    700ecb88d29fe46e3c05cedee5aecec0a11ff34379d6e4bb7d5091867d66f120

    SHA512

    03d4d8b97ab9b19999a272a44e8b8c56642fb396f2a06aefa60c180332c4f9096d72128cff5bb91b2019fe09f822b00f356bf2b56959e70a79dfb2421ef954fb

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2e58ac362efa8b8630f1f1a9dadc8601

    SHA1

    7a71db5e4086eb583e88c7fe336d037eed31aa14

    SHA256

    27e35c11f33a80d5dafa2048317f69d49d73440486024bd8f820aef803e25b18

    SHA512

    d242a1d66e6e3d53bf936a043d92f556c0438afaca323bb70c8e22646a5c086269b5304e4e03521371c36446079285a0eb62174572b3a26caf1223806e151fb0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    561bca9aab0e9a417f2a44d56159a4c1

    SHA1

    d712fadea209ab5c7d1b45191bb7aec0c3c17e78

    SHA256

    4fe43dff96de82090acf4d592ebd05dfbe5fa0ad5a79bee48c3b510a488457ab

    SHA512

    2987022641ce4982145633e595e40d3da9715eecdb55199da49a83495303ce7f760fcf2d5d247c845905de9d128ed17562f019b054b3b08a7e1422ceae1ae2b5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    f0709d5f76612d0b30c5ec10214e94c8

    SHA1

    49873b940fa1dac2bc8eab8614f6838862045634

    SHA256

    16c69f260f07a9c4aee38090ae4d15863bf55d8b1924fde193f85fee7867d95d

    SHA512

    c2e0809bd83d584a56a29a04a07584cdf91d19208400a24a84b5e243429ab6d65876005e4716c4c0ba0a421cb16895e4f1f4ca34e21625beff1f5b1ff4d7ae04

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    6fc59f4467a36bdde500459075a87e57

    SHA1

    9ddbf93781e4e4dec2f325d23325779ec272646f

    SHA256

    cf93adc2ec184b33f4ebba8b1b5f9167bef4cd96d68d7bf35b9ab3c206032a62

    SHA512

    9b87099bcf3b486557d999aecaafa9d92951b3ccf1ffaee78552d25e424a19fd6f04a135ca90fa7225ba3cd861b3593078e7525377b9a8bcae9ab616c6f9215b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ee1dd19b1f4609f7e53ffd9828491c20

    SHA1

    3680de163ec75212f4689d889e99f66bd2cf38db

    SHA256

    b9788d691c8297db69e82540c36201798e1b282a3eaf56aa9323203e546eaa7d

    SHA512

    430bfbba5bc33c69466cec6d7a88e69c59a6dec114f14f11e6de7c9d15ae43d95584a448d35cac798e1691f077b3ceb874fa6af69b7c72fe809f7fd36246a55f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    fc1bde473d3b7b36b7aca799d6a06c64

    SHA1

    5d1729b10fe9f04fea65d2f6ac2a01e01181a26e

    SHA256

    801f08472fdf7ab3a43f6f89f0fcf9c384f301d7a501b5bc7211c5adcc5501ab

    SHA512

    8a06095364d9ea046bac52424e7af688d52334d61eef6809a8d60080ee420702a58dcb06aec3d1817ac1d79d74c6c013016905415c26c33599a98657890491cb

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c7025863ecb17ad2b10baa0415c9e0b8

    SHA1

    834a5c7e91e92deb144e9d4696e0f80cdbc53658

    SHA256

    f399252580c87309fb0fab02332e66890b7bfea351ef4021de71be7bd2163619

    SHA512

    ac41e5eab7facfbedb41807136c596be81db3c315ba0d384b4032529aede9071e9de83393c827edf88e6596c0a46f50bb488c36a91214b868428cdfc57472279

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    818a90518eee7d1b918c9e5e14c1e19c

    SHA1

    a6c0f9bcc565a5331fabe2b1b11b7f0e5803210b

    SHA256

    d22eeb26577d1dc43fbd6a1fe60e430df24588a01f3e1f038227edac5f115c0e

    SHA512

    6b2bcc8cfa7ba8adb39ad13a5930b553a93885c432fc0fce7559fa6f7e5c83cbf4cacf2b1882249f7f80e63d836b37e12875861ac1e617e897c5486a224f75e0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7a91125735f9cfc2e450cd9c1289b6db

    SHA1

    502b69541b575872791a775a9a3a7a5a1d483151

    SHA256

    f6a5757601cea829a77d0c659d01c3ac82c6f3245aa143f9a4bd4c4278dbfdef

    SHA512

    36475b09a1c4a744179988582993797a148dc072f65e4b3c6ebcdef59c53b5bf478204bdc7933bcd76cd6f9d93a58ba8bfcaac2007d2b8d4c2d9b4ca9a047a74

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    300feca8f8ac559a3c027939772b48a6

    SHA1

    71583f1cca34e21574bf01599481c4163db70685

    SHA256

    b5d8e9cac1fcb8b37d31bba9aec216c714680ae7394864414a37c633d2214242

    SHA512

    1e0116bf5506eb5a39cca4f70c9cee1cba6eed625dfa816dc75fd3fe8d0228f770354a6e2d4dbde91b852f42e304d894f2a993d2a6241d7282fbfe71ccd98796

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    39845ebcb2e5fdaeea9c27fa9f58bd28

    SHA1

    ec54934ddafe50b97151d511f1201717cb911b5d

    SHA256

    e6d20d973d21f6025222f53c314d06976dbaa2baeee53e3d2e7d54ca10744967

    SHA512

    4bed1bff8c170932151ed7fd77b736e7598317f85092626d21fa3c03564a0beaf8e005d0fecb2e40993d341e782bdf9e68f86a4cf1739960e272604779099219

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b36d975e11059e004684e2254f145761

    SHA1

    88dc49e25ee0d927365103b986c9a9dea0eaa20a

    SHA256

    382dd12ce1c06c9b1c7be4388ac149c78d630b459ec80b38d4c3a89d35d22102

    SHA512

    0dcbad3fabab4bef0d1647d3a7190ca1aac5f0ed139aa3a5ff2f273f269f7418c242e14c7736c0333421bb9288d7406e64692186f5efd59a9cdb7207b7a0fda9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    4528ecdb6fdca41e6d7b9a2fb06161df

    SHA1

    673891b1e3576b35d16322d211aa559b35103246

    SHA256

    4dfc2de97a96808fcd9345c3f1f288f0250638f08e77044d692804e2db1b0782

    SHA512

    20c7cc07784c41bb62667476c8c986ea097931d02487182a65ae8cefb0af040ecb4cecc3b42a3657d23fbc0bdf7255a0c7d100a04b965bad6d3d13939ff0361d

  • C:\Users\Admin\AppData\Local\Temp\Cab3CA5.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar3D35.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • \Windows\SysWOW64\rundll32Srv.exe

    Filesize

    55KB

    MD5

    ff5e1f27193ce51eec318714ef038bef

    SHA1

    b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

    SHA256

    fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

    SHA512

    c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

  • memory/2684-9-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2684-12-0x0000000000240000-0x000000000026E000-memory.dmp

    Filesize

    184KB

  • memory/2760-18-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2760-17-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2760-19-0x00000000002C0000-0x00000000002C1000-memory.dmp

    Filesize

    4KB

  • memory/3028-0-0x0000000000170000-0x00000000001E4000-memory.dmp

    Filesize

    464KB

  • memory/3028-3-0x0000000000230000-0x000000000025E000-memory.dmp

    Filesize

    184KB