ramnit | d46b1c21c4acb2e49fb8d024501ccef602361ac5915e00b3143a1899419ba17e

General

Target

d46b1c21c4acb2e49fb8d024501ccef602361ac5915e00b3143a1899419ba17e.dll
Size

284KB
MD5

be7a6dc894be83d9b5d6c87d5457af6e
SHA1

874488c410c4b3c1d21bcd4a1e61f1f68596349f
SHA256

d46b1c21c4acb2e49fb8d024501ccef602361ac5915e00b3143a1899419ba17e
SHA512

ab3534e496331b96c857891114af9bd364a2b4f750140aa7fb72deb581aecdabfa3d77c057d1d982850333759490c8980937534c8c2cd162c5a0aca4cde4c32a
SSDEEP

6144:dMqWfdNAFK/p8O456wg+RFxj3OWmgvWruTyOQMYp:GqWfdNAIpV45a+FxLmb5MYp

Score

10^/10

ramnit banker discovery persistence spyware stealer trojan upx worm

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe"	svchost.exe

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Ramnit family
ramnit
Executes dropped EXE 5 IoCs

Processes:

rundll32mgr.exerundll32mgrmgr.exeWaterMark.exeWaterMarkmgr.exeWaterMark.exe

pid process

2072 rundll32mgr.exe
2448 rundll32mgrmgr.exe
2696 WaterMark.exe
2772 WaterMarkmgr.exe
2660 WaterMark.exe

pid	process
2072	rundll32mgr.exe
2448	rundll32mgrmgr.exe
2696	WaterMark.exe
2772	WaterMarkmgr.exe
2660	WaterMark.exe

Loads dropped DLL 10 IoCs

Processes:

rundll32.exerundll32mgr.exeWaterMark.exerundll32mgrmgr.exe

pid	process
2164	rundll32.exe
2164	rundll32.exe
2072	rundll32mgr.exe
2072	rundll32mgr.exe
2072	rundll32mgr.exe
2072	rundll32mgr.exe
2696	WaterMark.exe
2696	WaterMark.exe
2448	rundll32mgrmgr.exe
2448	rundll32mgrmgr.exe

Drops file in System32 directory 4 IoCs

Processes:

rundll32.exerundll32mgr.exesvchost.exe

description	ioc	process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe
File created	C:\Windows\SysWOW64\rundll32mgrmgr.exe	rundll32mgr.exe
File created	C:\Windows\SysWOW64\dmlconf.dat	svchost.exe
File opened for modification	C:\Windows\SysWOW64\dmlconf.dat	svchost.exe

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2072-28-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2696-65-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2072-42-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2448-69-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2448-71-0x0000000000700000-0x000000000074B000-memory.dmp	upx
behavioral1/memory/2072-32-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2072-30-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2072-27-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2072-26-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2072-25-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2772-127-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2696-146-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2696-176-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2660-178-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\tabskb.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\WindowsFormsIntegration.resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libafile_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_output\libvdummy_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Journal\NBDoc.DLL	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEWSS.DLL	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VGX\VGX.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.Speech.resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libdtv_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libvnc_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Journal\jnwppr.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEODBC.DLL	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jli.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\t2k.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\glass.dll	svchost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\api-ms-win-crt-locale-l1-1-0.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Services.resources.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Entity.Design.Resources.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\sqloledb.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\liblive555_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libschroedinger_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\settings.html	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\settings.html	svchost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\cryptocme2.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\about.html	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libdemux_cdg_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libblend_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\settings.html	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libdvdnav_plugin.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeUpdater.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.AddIn.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\JavaAccessBridge-64.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\msvcr100.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Windows.Presentation.dll	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\vulkan-1.dll	svchost.exe
File opened for modification	C:\Program Files\Internet Explorer\F12.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe	svchost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\d3dcompiler_47.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\settings.html	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\dt_shmem.dll	svchost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libasf_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libmotionblur_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpegvideo_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\cpu.html	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\hprof.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libsdl_image_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libtextst_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_wav_plugin.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\DW\DBGHELP.DLL	svchost.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

rundll32.exeWaterMark.exesvchost.exeWaterMarkmgr.exesvchost.exesvchost.exerundll32mgr.exeWaterMark.exerundll32mgrmgr.exesvchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaterMark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaterMarkmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32mgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaterMark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32mgrmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

WaterMark.exeWaterMark.exe

pid	process
2696	WaterMark.exe
2696	WaterMark.exe
2660	WaterMark.exe
2660	WaterMark.exe
2696	WaterMark.exe
2696	WaterMark.exe
2696	WaterMark.exe
2696	WaterMark.exe
2696	WaterMark.exe
2696	WaterMark.exe
2660	WaterMark.exe
2660	WaterMark.exe
2660	WaterMark.exe
2660	WaterMark.exe
2660	WaterMark.exe
2660	WaterMark.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

rundll32.exeWaterMark.exeWaterMark.exesvchost.exesvchost.exe

description	pid	process
Token: SeDebugPrivilege	2164	rundll32.exe
Token: SeDebugPrivilege	2696	WaterMark.exe
Token: SeDebugPrivilege	2660	WaterMark.exe
Token: SeDebugPrivilege	768	svchost.exe
Token: SeDebugPrivilege	2640	svchost.exe

Suspicious use of UnmapMainImage 5 IoCs

Processes:

rundll32mgr.exerundll32mgrmgr.exeWaterMark.exeWaterMark.exeWaterMarkmgr.exe

pid process

2072 rundll32mgr.exe
2448 rundll32mgrmgr.exe
2696 WaterMark.exe
2660 WaterMark.exe
2772 WaterMarkmgr.exe

pid	process
2072	rundll32mgr.exe
2448	rundll32mgrmgr.exe
2696	WaterMark.exe
2660	WaterMark.exe
2772	WaterMarkmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

rundll32.exerundll32.exerundll32mgr.exeWaterMark.exerundll32mgrmgr.exeWaterMark.exe

description	pid	process	target process
PID 2416 wrote to memory of 2164	2416	rundll32.exe	rundll32.exe
PID 2416 wrote to memory of 2164	2416	rundll32.exe	rundll32.exe
PID 2416 wrote to memory of 2164	2416	rundll32.exe	rundll32.exe
PID 2416 wrote to memory of 2164	2416	rundll32.exe	rundll32.exe
PID 2416 wrote to memory of 2164	2416	rundll32.exe	rundll32.exe
PID 2416 wrote to memory of 2164	2416	rundll32.exe	rundll32.exe
PID 2416 wrote to memory of 2164	2416	rundll32.exe	rundll32.exe
PID 2164 wrote to memory of 2072	2164	rundll32.exe	rundll32mgr.exe
PID 2164 wrote to memory of 2072	2164	rundll32.exe	rundll32mgr.exe
PID 2164 wrote to memory of 2072	2164	rundll32.exe	rundll32mgr.exe
PID 2164 wrote to memory of 2072	2164	rundll32.exe	rundll32mgr.exe
PID 2072 wrote to memory of 2448	2072	rundll32mgr.exe	rundll32mgrmgr.exe
PID 2072 wrote to memory of 2448	2072	rundll32mgr.exe	rundll32mgrmgr.exe
PID 2072 wrote to memory of 2448	2072	rundll32mgr.exe	rundll32mgrmgr.exe
PID 2072 wrote to memory of 2448	2072	rundll32mgr.exe	rundll32mgrmgr.exe
PID 2072 wrote to memory of 2696	2072	rundll32mgr.exe	WaterMark.exe
PID 2072 wrote to memory of 2696	2072	rundll32mgr.exe	WaterMark.exe
PID 2072 wrote to memory of 2696	2072	rundll32mgr.exe	WaterMark.exe
PID 2072 wrote to memory of 2696	2072	rundll32mgr.exe	WaterMark.exe
PID 2696 wrote to memory of 2772	2696	WaterMark.exe	WaterMarkmgr.exe
PID 2696 wrote to memory of 2772	2696	WaterMark.exe	WaterMarkmgr.exe
PID 2696 wrote to memory of 2772	2696	WaterMark.exe	WaterMarkmgr.exe
PID 2696 wrote to memory of 2772	2696	WaterMark.exe	WaterMarkmgr.exe
PID 2448 wrote to memory of 2660	2448	rundll32mgrmgr.exe	WaterMark.exe
PID 2448 wrote to memory of 2660	2448	rundll32mgrmgr.exe	WaterMark.exe
PID 2448 wrote to memory of 2660	2448	rundll32mgrmgr.exe	WaterMark.exe
PID 2448 wrote to memory of 2660	2448	rundll32mgrmgr.exe	WaterMark.exe
PID 2696 wrote to memory of 2668	2696	WaterMark.exe	svchost.exe
PID 2696 wrote to memory of 2668	2696	WaterMark.exe	svchost.exe
PID 2696 wrote to memory of 2668	2696	WaterMark.exe	svchost.exe
PID 2696 wrote to memory of 2668	2696	WaterMark.exe	svchost.exe
PID 2696 wrote to memory of 2668	2696	WaterMark.exe	svchost.exe
PID 2696 wrote to memory of 2668	2696	WaterMark.exe	svchost.exe
PID 2696 wrote to memory of 2668	2696	WaterMark.exe	svchost.exe
PID 2696 wrote to memory of 2668	2696	WaterMark.exe	svchost.exe
PID 2696 wrote to memory of 2668	2696	WaterMark.exe	svchost.exe
PID 2696 wrote to memory of 2668	2696	WaterMark.exe	svchost.exe
PID 2660 wrote to memory of 2320	2660	WaterMark.exe	svchost.exe
PID 2660 wrote to memory of 2320	2660	WaterMark.exe	svchost.exe
PID 2660 wrote to memory of 2320	2660	WaterMark.exe	svchost.exe
PID 2660 wrote to memory of 2320	2660	WaterMark.exe	svchost.exe
PID 2660 wrote to memory of 2320	2660	WaterMark.exe	svchost.exe
PID 2660 wrote to memory of 2320	2660	WaterMark.exe	svchost.exe
PID 2660 wrote to memory of 2320	2660	WaterMark.exe	svchost.exe
PID 2660 wrote to memory of 2320	2660	WaterMark.exe	svchost.exe
PID 2660 wrote to memory of 2320	2660	WaterMark.exe	svchost.exe
PID 2660 wrote to memory of 2320	2660	WaterMark.exe	svchost.exe
PID 2696 wrote to memory of 768	2696	WaterMark.exe	svchost.exe
PID 2696 wrote to memory of 768	2696	WaterMark.exe	svchost.exe
PID 2696 wrote to memory of 768	2696	WaterMark.exe	svchost.exe
PID 2696 wrote to memory of 768	2696	WaterMark.exe	svchost.exe
PID 2696 wrote to memory of 768	2696	WaterMark.exe	svchost.exe
PID 2696 wrote to memory of 768	2696	WaterMark.exe	svchost.exe
PID 2696 wrote to memory of 768	2696	WaterMark.exe	svchost.exe
PID 2696 wrote to memory of 768	2696	WaterMark.exe	svchost.exe
PID 2696 wrote to memory of 768	2696	WaterMark.exe	svchost.exe
PID 2696 wrote to memory of 768	2696	WaterMark.exe	svchost.exe
PID 2660 wrote to memory of 2640	2660	WaterMark.exe	svchost.exe
PID 2660 wrote to memory of 2640	2660	WaterMark.exe	svchost.exe
PID 2660 wrote to memory of 2640	2660	WaterMark.exe	svchost.exe
PID 2660 wrote to memory of 2640	2660	WaterMark.exe	svchost.exe
PID 2660 wrote to memory of 2640	2660	WaterMark.exe	svchost.exe
PID 2660 wrote to memory of 2640	2660	WaterMark.exe	svchost.exe
PID 2660 wrote to memory of 2640	2660	WaterMark.exe	svchost.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d46b1c21c4acb2e49fb8d024501ccef602361ac5915e00b3143a1899419ba17e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d46b1c21c4acb2e49fb8d024501ccef602361ac5915e00b3143a1899419ba17e.dll,#1
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2164
- - C:\Windows\SysWOW64\rundll32mgr.exe
    C:\Windows\SysWOW64\rundll32mgr.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of UnmapMainImage
    - Suspicious use of WriteProcessMemory
    PID:2072
  - - C:\Windows\SysWOW64\rundll32mgrmgr.exe
      C:\Windows\SysWOW64\rundll32mgrmgr.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of UnmapMainImage
      Suspicious use of WriteProcessMemory
      PID:2448
    - - C:\Program Files (x86)\Microsoft\WaterMark.exe
        
        "C:\Program Files (x86)\Microsoft\WaterMark.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of UnmapMainImage
        Suspicious use of WriteProcessMemory
        
        PID:2660
      - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2320
      - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2640
  - - C:\Program Files (x86)\Microsoft\WaterMark.exe
      "C:\Program Files (x86)\Microsoft\WaterMark.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of UnmapMainImage
      Suspicious use of WriteProcessMemory
      PID:2696
    - - C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe
        
        "C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of UnmapMainImage
        
        PID:2772
    - - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        5⤵
        Modifies WinLogon for persistence
        Drops file in System32 directory
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        
        PID:2668
    - - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

Filesize
511KB

MD5
f82bf973be0d78a3a613b97368fadc87

SHA1
2f198a22c629e30cc434380ea57022a1aa24b6c3

SHA256
ae3342264901b19e3fd04f5f0bdf1be1e55c108a2fd0089fae31c8e66ee4e7b4

SHA512
8061ee299f46604c3dee194856080d8a0b179b5b96554ea6b808082fe317b41c5e9f59f8584adc3148fbf7814d1e61831fdc473e8bc7f2154042a9c0284173b0

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

Filesize
507KB

MD5
d8b34fce3ffea92dc0071764c4e32356

SHA1
edf4c75d23b9975609ffd5b67c35413dd7788ebd

SHA256
3a5b91a05840135d7227214c5d6b60d88a0b7125c694c4344df082fa9911b0e8

SHA512
f01293820e595105fc913c7e730763e3d6a11d7b55815b99a152cdf92ec7e67b51fa826a50b5cbf9316f86576df05bbdb7df59b690970cdef801c5e553fd6f94

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
249KB

MD5
725aad1265430294dabb34fbbdd37b60

SHA1
e6f02781f9dfe58ba653554d45ef027646638d41

SHA256
c305dd145312babc4bd84cb9b1f998f81ed90b527b52666d68add509eca1b5e7

SHA512
7437a4b7b9ea19267d71933ef1fb18565ecc00516dbed0b49a3b3300be824db3509aace52baa96e5d31143d8aff9ec8abb6499c620e5f5fa403f4f2c741ca1e9

Download Submit
\Windows\SysWOW64\rundll32mgrmgr.exe

Filesize
123KB

MD5
04161f533ee93611681445f8a165ed68

SHA1
d3f4b2bfc8b384d2602989082056751ae21b8105

SHA256
97e8d8fefbd8aef88875b7373e6a5ec0ff0fa02fc1b63af254d8116e6d959f81

SHA512
4e3ad0bd23e728966e7f0d86fda0883bb8196d9eca93c6c9633c3b786c451864fabd9f300fb7355277fb8de334c1fe5cb54b01c2ad88c3e51ad7fa221a57119f

Download Submit
memory/2072-25-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2072-27-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2072-28-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2072-32-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2072-30-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2072-42-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2072-29-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download
memory/2072-15-0x0000000000130000-0x000000000015B000-memory.dmp

Filesize
172KB

Download
memory/2072-22-0x0000000000130000-0x000000000015B000-memory.dmp

Filesize
172KB

Download
memory/2072-26-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2072-12-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2164-24-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2164-17-0x0000000077630000-0x0000000077631000-memory.dmp

Filesize
4KB

Download
memory/2164-173-0x00000000002B0000-0x00000000002B2000-memory.dmp

Filesize
8KB

Download
memory/2164-1-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/2164-16-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/2164-11-0x00000000002B0000-0x00000000002FB000-memory.dmp

Filesize
300KB

Download
memory/2164-9-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/2448-69-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2448-71-0x0000000000700000-0x000000000074B000-memory.dmp

Filesize
300KB

Download
memory/2660-77-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2660-178-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2660-104-0x0000000000050000-0x0000000000051000-memory.dmp

Filesize
4KB

Download
memory/2668-98-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2668-102-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2668-94-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2668-84-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2668-86-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2696-74-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/2696-75-0x000000007762F000-0x0000000077630000-memory.dmp

Filesize
4KB

Download
memory/2696-55-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2696-146-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2696-174-0x000000007762F000-0x0000000077630000-memory.dmp

Filesize
4KB

Download
memory/2696-176-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2696-65-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2772-127-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads