ramnit | d46b1c21c4acb2e49fb8d024501ccef602361ac5915e00b3143a1899419ba17e

Analysis

max time kernel
150s
max time network
147s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-11-2024 04:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d46b1c21c4acb2e49fb8d024501ccef602361ac5915e00b3143a1899419ba17e.dll
Size

284KB
MD5

be7a6dc894be83d9b5d6c87d5457af6e
SHA1

874488c410c4b3c1d21bcd4a1e61f1f68596349f
SHA256

d46b1c21c4acb2e49fb8d024501ccef602361ac5915e00b3143a1899419ba17e
SHA512

ab3534e496331b96c857891114af9bd364a2b4f750140aa7fb72deb581aecdabfa3d77c057d1d982850333759490c8980937534c8c2cd162c5a0aca4cde4c32a
SSDEEP

6144:dMqWfdNAFK/p8O456wg+RFxj3OWmgvWruTyOQMYp:GqWfdNAIpV45a+FxLmb5MYp

Score

10^/10

ramnit banker discovery persistence spyware stealer trojan upx worm

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe"	svchost.exe

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Ramnit family
ramnit

Executes dropped EXE 6 IoCs

pid	Process
2656	rundll32mgr.exe
2544	rundll32mgrmgr.exe
2700	WaterMark.exe
2896	WaterMark.exe
2752	WaterMarkmgr.exe
1384	WaterMark.exe

Loads dropped DLL 12 IoCs

pid	Process
1992	rundll32.exe
1992	rundll32.exe
2656	rundll32mgr.exe
2656	rundll32mgr.exe
2656	rundll32mgr.exe
2544	rundll32mgrmgr.exe
2544	rundll32mgrmgr.exe
2656	rundll32mgr.exe
2896	WaterMark.exe
2896	WaterMark.exe
2752	WaterMarkmgr.exe
2752	WaterMarkmgr.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe
File created	C:\Windows\SysWOW64\rundll32mgrmgr.exe	rundll32mgr.exe
File created	C:\Windows\SysWOW64\dmlconf.dat	svchost.exe
File opened for modification	C:\Windows\SysWOW64\dmlconf.dat	svchost.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2656-37-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2656-35-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2544-28-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2544-27-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2544-26-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2544-25-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2544-53-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2656-52-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1384-130-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/2752-111-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1384-134-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2700-181-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2896-182-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\unpack200.exe	svchost.exe
File opened for modification	C:\Program Files\Windows Journal\NBMapTIP.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\cpu.html	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Aero.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\axvlc.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_output\libyuv_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Services.Design.resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libnsc_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libinflate_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi422_yuy2_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libadjust_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\t2k.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.IO.Log.Resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\librtpvideo_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\text_renderer\libfreetype_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libvcd_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_srt_plugin.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Help\1028\hxdsui.dll	svchost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nssckbi.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libtimecode_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\misc\libaddonsfsstorage_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\TipBand.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\msadcs.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\JAWTAccessBridge-64.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\kcms.dll	svchost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\mozwer.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\Microsoft.Ink.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\MSOINTL.DLL	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSSOAP30.DLL	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\jpeg.dll	svchost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\lgpllibs.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\services_discovery\libmediadirs_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE	svchost.exe
File opened for modification	C:\Program Files\Windows Media Player\WMPDMC.exe	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\settings.html	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\settings.html	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jfr.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2ssv.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\Microsoft.Build.Conversion.v3.5.resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_concat_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libanaglyph_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libmono_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Defender\MpOAV.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\java.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dt_socket.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\about.html	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.Speech.resources.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\UIAutomationTypes.resources.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Conversion.v3.5.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libdemux_stl_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_gather_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\oledb32r.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Net.Resources.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\settings.html	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\dicjp.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jfxmedia.dll	svchost.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaterMark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaterMarkmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32mgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32mgrmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaterMark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaterMark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2896	WaterMark.exe
2896	WaterMark.exe
2700	WaterMark.exe
2700	WaterMark.exe
2896	WaterMark.exe
2700	WaterMark.exe
2896	WaterMark.exe
2700	WaterMark.exe
2896	WaterMark.exe
2700	WaterMark.exe
2896	WaterMark.exe
2700	WaterMark.exe
2700	WaterMark.exe
2896	WaterMark.exe
2700	WaterMark.exe
2896	WaterMark.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1992	rundll32.exe
Token: SeDebugPrivilege	2896	WaterMark.exe
Token: SeDebugPrivilege	2700	WaterMark.exe
Token: SeDebugPrivilege	1040	svchost.exe
Token: SeDebugPrivilege	1352	svchost.exe

Suspicious use of UnmapMainImage 6 IoCs

pid	Process
2544	rundll32mgrmgr.exe
2656	rundll32mgr.exe
2896	WaterMark.exe
2700	WaterMark.exe
2752	WaterMarkmgr.exe
1384	WaterMark.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 1992	2496	rundll32.exe	30
PID 2496 wrote to memory of 1992	2496	rundll32.exe	30
PID 2496 wrote to memory of 1992	2496	rundll32.exe	30
PID 2496 wrote to memory of 1992	2496	rundll32.exe	30
PID 2496 wrote to memory of 1992	2496	rundll32.exe	30
PID 2496 wrote to memory of 1992	2496	rundll32.exe	30
PID 2496 wrote to memory of 1992	2496	rundll32.exe	30
PID 1992 wrote to memory of 2656	1992	rundll32.exe	31
PID 1992 wrote to memory of 2656	1992	rundll32.exe	31
PID 1992 wrote to memory of 2656	1992	rundll32.exe	31
PID 1992 wrote to memory of 2656	1992	rundll32.exe	31
PID 2656 wrote to memory of 2544	2656	rundll32mgr.exe	32
PID 2656 wrote to memory of 2544	2656	rundll32mgr.exe	32
PID 2656 wrote to memory of 2544	2656	rundll32mgr.exe	32
PID 2656 wrote to memory of 2544	2656	rundll32mgr.exe	32
PID 2544 wrote to memory of 2896	2544	rundll32mgrmgr.exe	34
PID 2544 wrote to memory of 2896	2544	rundll32mgrmgr.exe	34
PID 2544 wrote to memory of 2896	2544	rundll32mgrmgr.exe	34
PID 2544 wrote to memory of 2896	2544	rundll32mgrmgr.exe	34
PID 2656 wrote to memory of 2700	2656	rundll32mgr.exe	33
PID 2656 wrote to memory of 2700	2656	rundll32mgr.exe	33
PID 2656 wrote to memory of 2700	2656	rundll32mgr.exe	33
PID 2656 wrote to memory of 2700	2656	rundll32mgr.exe	33
PID 2896 wrote to memory of 2752	2896	WaterMark.exe	35
PID 2896 wrote to memory of 2752	2896	WaterMark.exe	35
PID 2896 wrote to memory of 2752	2896	WaterMark.exe	35
PID 2896 wrote to memory of 2752	2896	WaterMark.exe	35
PID 2896 wrote to memory of 1492	2896	WaterMark.exe	36
PID 2896 wrote to memory of 1492	2896	WaterMark.exe	36
PID 2896 wrote to memory of 1492	2896	WaterMark.exe	36
PID 2896 wrote to memory of 1492	2896	WaterMark.exe	36
PID 2896 wrote to memory of 1492	2896	WaterMark.exe	36
PID 2896 wrote to memory of 1492	2896	WaterMark.exe	36
PID 2896 wrote to memory of 1492	2896	WaterMark.exe	36
PID 2896 wrote to memory of 1492	2896	WaterMark.exe	36
PID 2896 wrote to memory of 1492	2896	WaterMark.exe	36
PID 2896 wrote to memory of 1492	2896	WaterMark.exe	36
PID 2700 wrote to memory of 2628	2700	WaterMark.exe	37
PID 2700 wrote to memory of 2628	2700	WaterMark.exe	37
PID 2700 wrote to memory of 2628	2700	WaterMark.exe	37
PID 2700 wrote to memory of 2628	2700	WaterMark.exe	37
PID 2700 wrote to memory of 2628	2700	WaterMark.exe	37
PID 2700 wrote to memory of 2628	2700	WaterMark.exe	37
PID 2700 wrote to memory of 2628	2700	WaterMark.exe	37
PID 2700 wrote to memory of 2628	2700	WaterMark.exe	37
PID 2700 wrote to memory of 2628	2700	WaterMark.exe	37
PID 2700 wrote to memory of 2628	2700	WaterMark.exe	37
PID 2752 wrote to memory of 1384	2752	WaterMarkmgr.exe	38
PID 2752 wrote to memory of 1384	2752	WaterMarkmgr.exe	38
PID 2752 wrote to memory of 1384	2752	WaterMarkmgr.exe	38
PID 2752 wrote to memory of 1384	2752	WaterMarkmgr.exe	38
PID 2700 wrote to memory of 1352	2700	WaterMark.exe	40
PID 2896 wrote to memory of 1040	2896	WaterMark.exe	39
PID 2700 wrote to memory of 1352	2700	WaterMark.exe	40
PID 2700 wrote to memory of 1352	2700	WaterMark.exe	40
PID 2896 wrote to memory of 1040	2896	WaterMark.exe	39
PID 2700 wrote to memory of 1352	2700	WaterMark.exe	40
PID 2700 wrote to memory of 1352	2700	WaterMark.exe	40
PID 2896 wrote to memory of 1040	2896	WaterMark.exe	39
PID 2700 wrote to memory of 1352	2700	WaterMark.exe	40
PID 2700 wrote to memory of 1352	2700	WaterMark.exe	40
PID 2700 wrote to memory of 1352	2700	WaterMark.exe	40
PID 2700 wrote to memory of 1352	2700	WaterMark.exe	40
PID 2700 wrote to memory of 1352	2700	WaterMark.exe	40

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d46b1c21c4acb2e49fb8d024501ccef602361ac5915e00b3143a1899419ba17e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d46b1c21c4acb2e49fb8d024501ccef602361ac5915e00b3143a1899419ba17e.dll,#1
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1992
- - C:\Windows\SysWOW64\rundll32mgr.exe
    C:\Windows\SysWOW64\rundll32mgr.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of UnmapMainImage
    - Suspicious use of WriteProcessMemory
    PID:2656
  - - C:\Windows\SysWOW64\rundll32mgrmgr.exe
      C:\Windows\SysWOW64\rundll32mgrmgr.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of UnmapMainImage
      Suspicious use of WriteProcessMemory
      PID:2544
    - - C:\Program Files (x86)\Microsoft\WaterMark.exe
        
        "C:\Program Files (x86)\Microsoft\WaterMark.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of UnmapMainImage
        Suspicious use of WriteProcessMemory
        
        PID:2896
      - C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe
        
        "C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of UnmapMainImage
        Suspicious use of WriteProcessMemory
        
        PID:2752
        
        C:\Program Files (x86)\Microsoft\WaterMark.exe
        
        "C:\Program Files (x86)\Microsoft\WaterMark.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of UnmapMainImage
        
        PID:1384
      - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        6⤵
        Modifies WinLogon for persistence
        Drops file in System32 directory
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        
        PID:1492
      - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1040
  - - C:\Program Files (x86)\Microsoft\WaterMark.exe
      "C:\Program Files (x86)\Microsoft\WaterMark.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of UnmapMainImage
      Suspicious use of WriteProcessMemory
      PID:2700
    - - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2628
    - - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

Filesize
511KB

MD5
668b2b514db91461744c865ba50052bf

SHA1
37168b6eb2f887e00d834ca12da9058feed6d773

SHA256
c1d2ac28275c295dadc80f09376af124b9de953467717bd45af903b0ec80c096

SHA512
7716e80f001bd196835f9cae56e768b342299ee6a5d08db59959a1b84feea1a57d4484013b9564f67322d7db4394b834e71fbfba8536d4770429b5f9b0de458e

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

Filesize
507KB

MD5
cc603b5dd649c5ac7398f9b3c9c2089b

SHA1
d3448523a8f575efc90104bb212104f3d4453bf3

SHA256
fb9af04c32f8045c287e810811038e58849b9cb12533d13080ae7fc6621b59e3

SHA512
bf73fa27d37311b38d7878c48a6f3ef7814bbe8108e28cf545ae5eaf812e45bd8a84285685dc4d3a12453a7cf6c4d6374bf7298756b0bdedfeaf142e0092888c

Download Submit
C:\Windows\SysWOW64\rundll32mgrmgr.exe

Filesize
123KB

MD5
04161f533ee93611681445f8a165ed68

SHA1
d3f4b2bfc8b384d2602989082056751ae21b8105

SHA256
97e8d8fefbd8aef88875b7373e6a5ec0ff0fa02fc1b63af254d8116e6d959f81

SHA512
4e3ad0bd23e728966e7f0d86fda0883bb8196d9eca93c6c9633c3b786c451864fabd9f300fb7355277fb8de334c1fe5cb54b01c2ad88c3e51ad7fa221a57119f

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
249KB

MD5
725aad1265430294dabb34fbbdd37b60

SHA1
e6f02781f9dfe58ba653554d45ef027646638d41

SHA256
c305dd145312babc4bd84cb9b1f998f81ed90b527b52666d68add509eca1b5e7

SHA512
7437a4b7b9ea19267d71933ef1fb18565ecc00516dbed0b49a3b3300be824db3509aace52baa96e5d31143d8aff9ec8abb6499c620e5f5fa403f4f2c741ca1e9

Download Submit
memory/1384-134-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1384-130-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1492-84-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/1492-116-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/1492-112-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/1492-86-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/1992-13-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1992-9-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/1992-1-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/1992-10-0x00000000001A0000-0x00000000001EB000-memory.dmp

Filesize
300KB

Download
memory/1992-14-0x00000000772D0000-0x00000000772D1000-memory.dmp

Filesize
4KB

Download
memory/1992-15-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2544-28-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2544-27-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2544-26-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2544-25-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2544-24-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2544-53-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2544-29-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/2656-37-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2656-35-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2656-18-0x0000000000150000-0x000000000017B000-memory.dmp

Filesize
172KB

Download
memory/2656-52-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2656-11-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2700-181-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2700-82-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/2700-56-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2752-111-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2896-60-0x0000000000120000-0x000000000014B000-memory.dmp

Filesize
172KB

Download
memory/2896-73-0x0000000000120000-0x000000000014B000-memory.dmp

Filesize
172KB

Download
memory/2896-77-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/2896-57-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2896-182-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download