Analysis

  • max time kernel
    68s
  • max time network
    70s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    17-11-2024 18:06

General

  • Target

    75fd4cbb5b6de86d6da35a7bd8b243e06bd93116936d63917ff046434ffaf0b4.dll

  • Size

    143KB

  • MD5

    33d18de91aa5961da674b83976fa73ad

  • SHA1

    15ecb46e555d2516456b684da14800190fca78e3

  • SHA256

    75fd4cbb5b6de86d6da35a7bd8b243e06bd93116936d63917ff046434ffaf0b4

  • SHA512

    50e46686468b57497270429dd8260029d5420c9a254e08fa367b6298c8e315804f0037dc06946240b0234c3fe49bece4fe19ef77e414af42e52be09e23b74ea3

  • SSDEEP

    3072:x5Np2dlUX0+Cx17F8QRJZKmOK3outK2laPEbsQIxrDfd:PFwT7SMJMzUoSracgQIxrB

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Ramnit family
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\75fd4cbb5b6de86d6da35a7bd8b243e06bd93116936d63917ff046434ffaf0b4.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2536
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\75fd4cbb5b6de86d6da35a7bd8b243e06bd93116936d63917ff046434ffaf0b4.dll,#1
      2⤵
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1872
      • C:\Windows\SysWOW64\rundll32Srv.exe
        C:\Windows\SysWOW64\rundll32Srv.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2984
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2532
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2540
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2540 CREDAT:275457 /prefetch:2
              6⤵
              • System Location Discovery: System Language Discovery
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:2708
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1872 -s 248
        3⤵
        • Program crash
        PID:2648

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Microsoft\DesktopLayer.exe

    Filesize

    55KB

    MD5

    ff5e1f27193ce51eec318714ef038bef

    SHA1

    b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

    SHA256

    fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

    SHA512

    c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ff59285634829f2e45e05aa85fd3b7bb

    SHA1

    f8b7c99f3f956592fdc9053972bba6a46981ea46

    SHA256

    0507a3c6aa8577048600767b01ad5c8d9cfe73cc02f3e75b74806d1c054f5b62

    SHA512

    26985cf1d1c82ed582300c86099aab14d10b191c6f75b2ad9751f9cd67fa8e60205eae388624f16d96038da5c5bfbb9e3f58a6bf7292c8feb29e45b5adc205ce

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    03ee04e8412800cd95b6fe2e7bc29709

    SHA1

    155e0542b1da3a2f426fe8c72e225c8178af9789

    SHA256

    9acf7fcc9c346808ad31b1645238df4768b0ce3fceb9bf1688d29c88f1708a8f

    SHA512

    b04d4d206e0198517f68340c3329e10bc9a1b657109ab52fe1491b97ded506f5db4a68acb0c81f781774d522b8d5db47f08b011474108acf12b41bf1877220c1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    701e4ccfaa6afa6d9cbdc3e31bfb6010

    SHA1

    d6da1ee172f173e27242033ee7096fedf0732012

    SHA256

    6d8b52b0a73fb9ba97d9914e5a1ca4182fffd2fff4b0665175361d2b07403367

    SHA512

    a8077c84fea75d2533c4013ed1793f15d68081703a1cf4aaec600aa0c8ee930d64fa3a529afd87abd49d1518f36c5bc5ab8cb0f0a1fd33affbfa3dd8382e9698

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    81b9049a2e87f5c78ab1bff50a561a7d

    SHA1

    ea596b27f8e21d442e1a6cab5132f2443e4c2876

    SHA256

    08d69a89d7032b2e93debd0916d0d4908733795057b302b4bc7384b3a655b3f5

    SHA512

    4ab6092fa2f431748706cb2bf51514d3bf79d891eea855300f0a13fda0929a58de9be4fccc99f23985fb4664966e7d65eefc2e51c634ef255d4b14d38b4bc48e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    be4442a853fd2be21360892b9ff43b71

    SHA1

    3f9188c863c5d6bdaeecbca00511b46dcd5e0910

    SHA256

    d2d4f61242a1eaa2a46fd9fa915231787897f57be2dabe8cd78c3b8a56fe67ed

    SHA512

    bf3544cb0df90b6f08524cfbd6b8019b29914b5b02df614d91aa161696e8cabd31e849059ec7a32a5f074d18e59a110f0c6f179b3eb85065afdb4408e86bc46c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d0954e65c673d85e54f5bae646c81186

    SHA1

    88d0c353ea3ed163b362d7072fda61e7f6af8209

    SHA256

    59ddb1ffc3615ed0c3e04038ab0921288c6f53a7fbca0a9e840e7f0fa132b695

    SHA512

    16a9f56ddf7c6db49df18bd3abac6b2a0bd9d87e92d67d38b6b7948a20c8c2ec46c991cb4f3caeb4c6e381f4ae31e65b526a12f6c44b497e78d1006eab3791d1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2c370f5e4530d8213799c6c33ed78a62

    SHA1

    97391cbfb9fcc219ef6334a80ec9e9d3cd985712

    SHA256

    224051a28c691b121e0dbf8c29ba8a7979dff410f56a995da125931bdd979c76

    SHA512

    359cc262d1cc23cea56747d38a2e2dea1437011feee3e45233dc283604a12383a31ec52c773efffacb7274f8f91adf0308ed609feacd410d468a631461d5ed8c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    61e7163de0eb46374df84a3c18572414

    SHA1

    82a13f100027e3138ae1421b367e73dbc0f1e94f

    SHA256

    c28029ae239e7977f7d2f0f4b25ed29fd83e6e69c24009882149fc8afedf478b

    SHA512

    0791afffcebb0dd9b5921aac477ecbd1147884a3cabd53e0d8ec3945e22ee049a2c9c5f698504807c0977c7a0e69afe62f2203aa0085c6e9ebf2fbe950e13768

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    816a44c571cbabf9138a1eb64d756383

    SHA1

    64e15f530e381946b010fc6e5a8674458add177a

    SHA256

    afc381056c8786b65c32d2dd6a156a1e875c56bba6fb00d9128a546f7bac9a99

    SHA512

    f70701835ca210440718cbdd652d54a43ff966026e502d7bd2011eabff48e93b073210e6cc4f21301b8e6bad072cf0ac9156bf8c431fadc480331ce9eb65d7a7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    79b7a6d44f495e39775a13111beee0e7

    SHA1

    fb5ecac4d2b881999ce6e4c8ad2824dfbadaf64f

    SHA256

    7e36a48537fb5ba68cb7d1ccdd7ab7b4329eb15022c88192deb29f417bae6697

    SHA512

    1340742dd844d75b9c79cd4ba13e6a585758903b4c4c704731dd0f8aeacc41dd70d4449b7b8476c4e96a73203d1a707a1097896a285db8583fd8b1c2d5d59d1b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7e02a61b4220bec494c1f2515a7442ab

    SHA1

    10b3ea232d19d3283e342a8d6c86f906ae471a81

    SHA256

    90e803f8c792de47bd378eb6ae97e18edd1e42adfecd5deb8fbc6fd79c3ada1e

    SHA512

    b4314c4a6b3ccea2d88a5b8f71093c118af83487744c028b073864fc29c4224d692b571503558280a1bde2b1e7dd0c8cd9bcce64d110abac96a662c52a58d656

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    cfe6034f6923365c24a6d30ef5fc6dec

    SHA1

    7c527e874eaff7b181b6c3daf40bf673bd13cf81

    SHA256

    d6fe7411617f970de9f077441958bc8eb1127292b70370e40f096941e8a2e902

    SHA512

    fcc6afcfac222f5a582fe295d5dee4de85128557202d6c4d0fc00e7c807c089217124a8e33e6ef84ce810c551e846d177b00b2ac10c389c19b938ed1dc1a4660

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    be14f6e3d365448bd879b66e747764e7

    SHA1

    837a74c688f74d83356c7823139debe8faa53c50

    SHA256

    77c9d4d4b29d0eab12c5cb552872847fffef1d7226b19d9e05ab1f02e37bfa47

    SHA512

    a407e5fa6ed5d39483e99cb645417ff58832644dc78b5b5313741f01e79f8633a1894ec8464b34db50e7c3abb27ec1a62bd964d2d274d4ed05892e81a8081c6e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    bef876c46680bcec0bc2d4879b9cc43a

    SHA1

    9406a1e8d1403866db7a6afeccaaebf4f6e2d1ab

    SHA256

    716118c62871519361c53b9ca17d7c20518ffc57d6cb7c5bf7b1dab5a29b316b

    SHA512

    44d9e45277a04997c808463ac6adf037dee46b04861ce1dd9c54a7c4f30b152be732afaa45e8a504ddcb5797867900f13bb2ffb776a2c9556602abe8d884465c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    4778b71e56242185728a9842ffe99a31

    SHA1

    6b62f587fac1d67ade4d3181f8ebafce754de93a

    SHA256

    c39a8df1373d65f02d071c0dd0fb68f4bfee1315f36551c7a00bd67f4d92fc1e

    SHA512

    2a340c2b836463636e5be6d3f47347276e026e952454762ef42c83c114ee2dfebdcc5c35b515feb7858cf9cf9dd6b3177b8dd9124d9ad94283edfd7319e47eb2

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    707d37669f3e966fe360a67aa81d0737

    SHA1

    11e685db5c08a31427f1603cf8e877305ab662ee

    SHA256

    e0448d5b9e356536703114880180c5ceb3dab7ae048ead0e1afda8b0b9f371df

    SHA512

    ebc13a3914ff69d6449d0c67aefe9d4f690589eda3ea87f42844c2f06098601f91b9229e5453fdd7dd5b683e50b542617dc640f9c26906a208e8ca89b3ff17dc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b1baab4eca76f993633e38998de24831

    SHA1

    77d976fb44912e10f8ec14f6d6f89a6757435412

    SHA256

    29299dede67704cbb6a29cbece3b7a3150eccfe56a60bbccda0fb385efef9925

    SHA512

    12c78c0fac7088ea5c818ec6468e3cef14a4160244e5064fa269142a3cd5cc31bf00fc7b6e33506ba999b066517d62c3edb4ee2d327bbfc2a39ff04452db8eee

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7706e548b367f7a873e0637fc86fb1f2

    SHA1

    4a610bf496928f741daa10b9d75c74e0ebe9446d

    SHA256

    574acbecfe03df2317fe1565a884cf483dffa762775dc1b175bfe6806271bee2

    SHA512

    337a2095bc8b1dba4c74ceb80a611d09f5eec356fe6983b74786681bea578f28b221ed0ecf216030eece81f79c541abb0be2d4683e5cd77ad553ce37667a92f6

  • C:\Users\Admin\AppData\Local\Temp\CabDECD.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarDFBB.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • memory/1872-13-0x0000000010009000-0x000000001000A000-memory.dmp

    Filesize

    4KB

  • memory/1872-7-0x0000000010000000-0x000000001004C000-memory.dmp

    Filesize

    304KB

  • memory/1872-10-0x0000000010000000-0x000000001004C000-memory.dmp

    Filesize

    304KB

  • memory/1872-14-0x0000000010000000-0x000000001004C000-memory.dmp

    Filesize

    304KB

  • memory/1872-0-0x0000000010000000-0x000000001004C000-memory.dmp

    Filesize

    304KB

  • memory/1872-2-0x0000000010000000-0x000000001004C000-memory.dmp

    Filesize

    304KB

  • memory/1872-15-0x00000000001E0000-0x000000000020E000-memory.dmp

    Filesize

    184KB

  • memory/2532-25-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2532-21-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2532-23-0x0000000000250000-0x0000000000251000-memory.dmp

    Filesize

    4KB

  • memory/2984-11-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2984-12-0x0000000000230000-0x000000000023F000-memory.dmp

    Filesize

    60KB