Analysis

  • max time kernel
    121s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    17-11-2024 17:26

General

  • Target

    48aae57de96ff91ead77f712d678b53f42dd341f178ef09eab2b300ef72ebe8cN.dll

  • Size

    435KB

  • MD5

    300da4b40f93a3084c788e6847cdb460

  • SHA1

    7c4c23125f87c549ffaee06ff30dc23d0ffc6348

  • SHA256

    48aae57de96ff91ead77f712d678b53f42dd341f178ef09eab2b300ef72ebe8c

  • SHA512

    36c3bd98eed3a37e48baf27575bf35c375f0d3b7509ee03b85c67b974b712deef10eb0f93c94225f7758e1af3111a65eecabdce9b531490a355b8f2881b9921f

  • SSDEEP

    6144:AmxIbni2hn/hZm8XqyQFAal+BtsnA6C4Xqu4G/LzliJacgQIxr:Axni2h/hZm8XqyQFAu+nGA+xiJ3gQ

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Ramnit family
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\48aae57de96ff91ead77f712d678b53f42dd341f178ef09eab2b300ef72ebe8cN.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2464
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\48aae57de96ff91ead77f712d678b53f42dd341f178ef09eab2b300ef72ebe8cN.dll,#1
      2⤵
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2100
      • C:\Windows\SysWOW64\rundll32Srv.exe
        C:\Windows\SysWOW64\rundll32Srv.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2604
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2184
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2488
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2488 CREDAT:275457 /prefetch:2
              6⤵
              • System Location Discovery: System Language Discovery
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:2844
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 224
        3⤵
        • Program crash
        PID:2436

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9568f6d877b8cc28bc4802b6dfb79b28

    SHA1

    04e9035689e242fe635a448e09715e9ac6f0590b

    SHA256

    27ff3399192e76a9105967bd6eebbc1506bee3580e55e7abd2213fd11667293a

    SHA512

    ec5055aaaa8918008d37b09397930a2adf41d095c1206cf2db02a7fd40037175d14e6a030a429a71461121319870794f68fdc191500f2d1bbd8ac1af315ff23a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    291027a1fae91054d2713a15d75c745e

    SHA1

    c7e65ecc900d13b2af28967e2613ffeef417745a

    SHA256

    e3f718c624ad0cc847e9a1c9736f1e9ce55e6d4a42242a0f4e483ba6a2f36ee5

    SHA512

    3760ac18bf993237aa8070d6078d15533d88a4786eab34943e0b5e14b4d58117a5efc253a443590531116de4b26be10930310abc414ecb7b96f333085074325e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    84b267f51a3bc13943fd7b0274509072

    SHA1

    71252fe07e36529010866b81a60509df73049ee3

    SHA256

    4ef14260c3f92cf0069da9799fd3a98f8a067e5407658388a76162539f220e9d

    SHA512

    6d44df741b374040833e073339cbb544ac86f45da1f852a42ef63c0bf6605765ae9efc9d18728c9fd63a2799b2d1919e35fc3492e85b9ce9f87c0d45c0edc647

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    cf317ec64c1c29e354bdc8316ea92ea7

    SHA1

    eded6e60d5de0eeb57d360deef7d1477130ed3e1

    SHA256

    5cffceccb7eaea36c30d0bab2bd808579b8ee0ec63e6b2981e04bb3198310cfd

    SHA512

    25f0d07bb470dec5f950330d0cc7b2147c25ef73883daf3a74dc8cc109c3b9372b6a987cbe90e04683f89d2390504d77f0a15a55127222793114351a85e9866a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9158682a3c51a16050cdd26cbea3ec24

    SHA1

    3f0931512b9e06bc831f54047773db41a802c225

    SHA256

    724c8eaad4a18ec86c596fb0dbf8d89a75598843d2412b16c65b45629a429aaf

    SHA512

    cbf1706f7fb540d582808bd2b2550456d7658452b4d1d91222a08193081c161f37258a54dc10ee61689aa58c4dea04bb30d262857af435a65a70ed84b079e9d8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b9b2514e3737b8b64f0ea7fec1380517

    SHA1

    a25ffd9c7a086c415ee903af9e1ab71f13afe03a

    SHA256

    3f182a724e269a0f41a2408d43d5bca830f76bbf823b3b3bdaff8e8c32057e9a

    SHA512

    a1621ece4ac1d30bf73e3db26514a64e023274923a7c78ee1cb56274c35323dcf7b10102acb070a3f5ac9b807cf05af4be055876e6914939c6376c0f60951436

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c8b00189b099f5e8ffdcf0e7357df8fa

    SHA1

    3ba86390c8a7580a306e530c1938302fbe575459

    SHA256

    9f574a509a0015f80457a947b24904ed24721bd3af14746f4a7ac7f80ed5c578

    SHA512

    a029f51eb8e18c87a615700c2da1794d178e0052886838e2fecbbc6bdafd07b84041ab311f5d4fb3023398a33ab17602486dcb75a4687c2367acd40a14376770

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    efb878fbc923e1673836b850c80a1748

    SHA1

    294d42bcf6cb22170b23a28b0fef7bfa8de9b82e

    SHA256

    48e8b4dec6c21ceae76ad9f808b56d46418ee87d5fa4993787a8084ab7a6b07b

    SHA512

    4ffe0621046356f2af4d76dca4f9e57f3f6b07a5011393f340289fdf779abfc9a79fba2c687e6296fc55a5e36a322dbeb60fa0290fd475b23569a21c288be457

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    08ebb3cca2438ae73c8090a678d07161

    SHA1

    4208b8f767aa9409ce367a3f2a6adf2bf4054ac1

    SHA256

    2d27deb1b530026be994b3106b0796b84dc91f8ae8f413a0f542de7b6b7bf596

    SHA512

    e6192dfb66702f06c1430f36b486e30de4389a5ef2374df8417bdf7159d2094d974625febe331a2ae654e62b6c248d0c34c9477e589706b62877b932a898faa6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    68c8b1f215af3df24b1f9aec0157d1d8

    SHA1

    9a3e0190976b0e4bacd96ad52207a1a00501f66a

    SHA256

    b4b362d8302bae93be641344b0f9affec4311632c8556dc1b46cde0db43be899

    SHA512

    4c4cc138d831bd85f2be650c42c746e9832342dc3e36c49f4add1f6de1e612a5484ea0b07de52b560f77430b0de8c1128a20cc655956c382eb2ec655c640de0b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7b62bd86ba57639567209c152f429eb8

    SHA1

    dd50d44ecc489ec8a5baf54c9ed84738208aeb75

    SHA256

    bae7d86498ac75836b1fef7ec6b7367a88f5f7b5c2bcb75371f9327a81e7dfaa

    SHA512

    2ea677b186d393ce775d5820f97301352e23f51490ac786ae834b8b10371eccf3f4fc5bab68b8431df3d880f218d5e26703dcd6ce270396cd9883c2dea361c26

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    41b614129736e05353f325735d8c4e80

    SHA1

    bd9101e75a011df3e6e35926a78bca344d2c0b1b

    SHA256

    a1103d31e025136f9e72e787a74224fe4d83329b8e0f15f7747effecfa308e5d

    SHA512

    2edd311c0fcdcf40c7f8f235d908f1f0cbd3d79640dbabffe268f893082b8c8e60d6532b71ae14613163f29733ced5412f94acbf7a48df2be92718294fa8cc19

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c9c7af9c113d4c23f599f08e5b1147d0

    SHA1

    46c195d63ac514f129bc97af49fe5d93aa4660e7

    SHA256

    59bb0728d531a60c9340bd1a1f0f51eecd4e1addc08e2f08ef50835d94e36ec6

    SHA512

    bba8ea11e93342cf4fcbfbf093773355406ac21d5c74328a7fbb1c72fd7ef282cfdead772da48b8a6749ccb862d87ed99924e172c9b759a5cfd185d58343e94c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ef37ae578f749fe33947d8962f18787e

    SHA1

    59cb732031b57489eab430cabf8a77873195c611

    SHA256

    534da1a69663887b57e2879229f6ade2ef25940c80bb413666d05a693b38ea94

    SHA512

    a15f1a3e489de57c9828b6b1a9be2471038caeeaf755a9b966fbd3e533e8cad95ea514aeea4aacab298b8865784012a02e508959186062c3339d46239afa325e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b0de8790ce20d1e08d7e424cbc5ce026

    SHA1

    f9df5fd43a048e8568a66b426eed6a07e89120dd

    SHA256

    180455893c86bcaeff146fd73ed045bb1dbf3b6b669dfe1995f54450d26c074d

    SHA512

    cd279df27527fa08e77297f993ec87a7423236bd7a36e6fb50306e3a1bd047f7d87f0fec585d409e473958d18afd00005814c1cb432bda2bdae3ad3560d80356

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7ab3799313f0ee7937e782f973c0d31a

    SHA1

    eb22bdac3cb4f6c0230e5b804a5cd1b3c7e4285c

    SHA256

    749563577ffb86b85cc74e67397ef9602e8e62c860bd9e88728256d5ea2b029f

    SHA512

    efa7c784cf3e22774f28db5f678a3574b5872f922ad2e4bdd95c1ffa9435b68f747a1bf43aca288ceb8b79f2251b42f993e43ede6db28401af00d8de0ff3ce6a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    0c68ea1f829c58bf5aeda7d3b7be38d7

    SHA1

    64b7dfaa4485e2892cb4b39040b5d339ae4c6821

    SHA256

    e9d6529e7cb912eb6bd3d3b9e7a613cc393167d74f9767d20f6ba02ddd730cc0

    SHA512

    0761431df1226be277244d8d76a78e695b44bbd02f1a26df6930f3f3493e57f793037c98ff1f0d6d0f7210f2ace379043700e5f1a5da4513d45f999b1816cbce

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b3c67cfe4301e339c20962437e29a3da

    SHA1

    5ab79ea6b384e02a625017cdd2e067eaadb148c5

    SHA256

    86b1817bc2a3ad7856a1f7c2adb81cc83471e30f3e6a71d1e5814872fa473b09

    SHA512

    6483ac53b332d036df44b167db3ded9317266670f63ead8c12a6401413feb3c91a883aad98bc23897a78db5b31d34f2cd527407bf9686ef12dfec72f485a3798

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e9e4fa5209dc12e4828530c5dec6f230

    SHA1

    25e275dcfcc458b29ce3b4123a9d292f400230a8

    SHA256

    a83e111e4675408e926dc22faceabd7976b43e7f6ed0405267c735e4c2b416ab

    SHA512

    98b9effd8dec372ea6e11af72a339db1b5bb3fe7c85104d199eda5eed95b0766a68bdbc17cee51027849755bc7d4d683194a10157a3a37c6035d15f81edd9b74

  • C:\Users\Admin\AppData\Local\Temp\CabBEFE.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarBFAF.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • C:\Windows\SysWOW64\rundll32Srv.exe

    Filesize

    55KB

    MD5

    ff5e1f27193ce51eec318714ef038bef

    SHA1

    b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

    SHA256

    fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

    SHA512

    c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

  • memory/2100-23-0x0000000000920000-0x0000000000994000-memory.dmp

    Filesize

    464KB

  • memory/2100-6-0x00000000009A0000-0x00000000009CE000-memory.dmp

    Filesize

    184KB

  • memory/2100-0-0x0000000000920000-0x0000000000994000-memory.dmp

    Filesize

    464KB

  • memory/2184-19-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2184-18-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

  • memory/2184-22-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2184-20-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2604-7-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2604-11-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2604-10-0x00000000003D0000-0x00000000003DF000-memory.dmp

    Filesize

    60KB