ramnit | 1857c1dd7942a15d31b1d9b8eaa72749f296221402aa659bab6a1b48e37f4122

Analysis

max time kernel
120s
max time network
91s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/12/2024, 03:52 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1857c1dd7942a15d31b1d9b8eaa72749f296221402aa659bab6a1b48e37f4122N.dll
Size

500KB
MD5

d274670f913543a1596c9ca564938ff0
SHA1

67e4bcf0912dea8125833f7aba776fba90d4186e
SHA256

1857c1dd7942a15d31b1d9b8eaa72749f296221402aa659bab6a1b48e37f4122
SHA512

8a384d715b7afb48be50ffa1cc4ea833417f051702515757b8cd8e945785ef1a5f919b3dc789da84f7ea740ee3127f87c189989959ef82f0f38ba6bf2c8ef58c
SSDEEP

12288:Ph8fZLyb9PzVMBC/HVMOp4PkxHLCYwZckMQMNoMlYXN:P8F+Pzr/Hfp4MIYwZckMQmblsN

Score

10^/10

ramnit banker discovery persistence spyware stealer trojan upx worm

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe"	svchost.exe

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Ramnit family
ramnit

Executes dropped EXE 2 IoCs

pid	Process
2408	rundll32mgr.exe
2728	WaterMark.exe

Loads dropped DLL 4 IoCs

pid	Process
2860	rundll32.exe
2860	rundll32.exe
2408	rundll32mgr.exe
2408	rundll32mgr.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe
File created	C:\Windows\SysWOW64\dmlconf.dat	svchost.exe
File opened for modification	C:\Windows\SysWOW64\dmlconf.dat	svchost.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2408-14-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2728-24-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2728-26-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2728-68-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2728-62-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2728-61-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2728-607-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\System\msadc\msadcf.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libvc1_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Windows.Presentation.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libaraw_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_rgb_mmx_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\IPSEventLogMsg.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\about.html	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.IdentityModel.Selectors.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.ComponentModel.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Management.Instrumentation.Resources.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Entity.Design.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libreal_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\msadcfr.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationClient.resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libbluescreen_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\instrument.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\sawindbg.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\spu\liblogo_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libgaussianblur_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.IdentityModel.Selectors.Resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libspatializer_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.WorkflowServices.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libdemux_cdg_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\oledb32r.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe	svchost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\api-ms-win-crt-convert-l1-1-0.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_setid_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\DVD Maker\PipeTran.dll	svchost.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\INLAUNCH.DLL	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationBuildTasks.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libcdda_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_file_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libgain_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libmp4_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_mp4_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jdwp.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\Welcome.html	svchost.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Media Player\setup_wm.exe	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libplaylist_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_dummy_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libposterize_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\plugin2\msvcr100.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Services.resources.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Windows.Presentation.resources.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Csi.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\PresentationBuildTasks.resources.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Shades of Blue.htm	svchost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\ucrtbase.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\UIAutomationClient.resources.dll	svchost.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\PurblePlace.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libcroppadd_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\eventlog_provider.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\license.html	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\zip.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\epl-v10.html	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\Microsoft.Build.Utilities.v3.5.resources.dll	svchost.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32mgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaterMark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
2728	WaterMark.exe
2728	WaterMark.exe
2728	WaterMark.exe
2728	WaterMark.exe
2728	WaterMark.exe
2728	WaterMark.exe
2728	WaterMark.exe
2728	WaterMark.exe
2132	svchost.exe
2132	svchost.exe
2132	svchost.exe
2132	svchost.exe
2132	svchost.exe
2132	svchost.exe
2132	svchost.exe
2132	svchost.exe
2132	svchost.exe
2132	svchost.exe
2132	svchost.exe
2132	svchost.exe
2132	svchost.exe
2132	svchost.exe
2132	svchost.exe
2132	svchost.exe
2132	svchost.exe
2132	svchost.exe
2132	svchost.exe
2132	svchost.exe
2132	svchost.exe
2132	svchost.exe
2132	svchost.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2728	WaterMark.exe
Token: SeDebugPrivilege	2132	svchost.exe
Token: SeDebugPrivilege	2728	WaterMark.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1780 wrote to memory of 2860	1780	rundll32.exe	31
PID 1780 wrote to memory of 2860	1780	rundll32.exe	31
PID 1780 wrote to memory of 2860	1780	rundll32.exe	31
PID 1780 wrote to memory of 2860	1780	rundll32.exe	31
PID 1780 wrote to memory of 2860	1780	rundll32.exe	31
PID 1780 wrote to memory of 2860	1780	rundll32.exe	31
PID 1780 wrote to memory of 2860	1780	rundll32.exe	31
PID 2860 wrote to memory of 2408	2860	rundll32.exe	32
PID 2860 wrote to memory of 2408	2860	rundll32.exe	32
PID 2860 wrote to memory of 2408	2860	rundll32.exe	32
PID 2860 wrote to memory of 2408	2860	rundll32.exe	32
PID 2408 wrote to memory of 2728	2408	rundll32mgr.exe	33
PID 2408 wrote to memory of 2728	2408	rundll32mgr.exe	33
PID 2408 wrote to memory of 2728	2408	rundll32mgr.exe	33
PID 2408 wrote to memory of 2728	2408	rundll32mgr.exe	33
PID 2728 wrote to memory of 796	2728	WaterMark.exe	34
PID 2728 wrote to memory of 796	2728	WaterMark.exe	34
PID 2728 wrote to memory of 796	2728	WaterMark.exe	34
PID 2728 wrote to memory of 796	2728	WaterMark.exe	34
PID 2728 wrote to memory of 796	2728	WaterMark.exe	34
PID 2728 wrote to memory of 796	2728	WaterMark.exe	34
PID 2728 wrote to memory of 796	2728	WaterMark.exe	34
PID 2728 wrote to memory of 796	2728	WaterMark.exe	34
PID 2728 wrote to memory of 796	2728	WaterMark.exe	34
PID 2728 wrote to memory of 796	2728	WaterMark.exe	34
PID 2728 wrote to memory of 2132	2728	WaterMark.exe	35
PID 2728 wrote to memory of 2132	2728	WaterMark.exe	35
PID 2728 wrote to memory of 2132	2728	WaterMark.exe	35
PID 2728 wrote to memory of 2132	2728	WaterMark.exe	35
PID 2728 wrote to memory of 2132	2728	WaterMark.exe	35
PID 2728 wrote to memory of 2132	2728	WaterMark.exe	35
PID 2728 wrote to memory of 2132	2728	WaterMark.exe	35
PID 2728 wrote to memory of 2132	2728	WaterMark.exe	35
PID 2728 wrote to memory of 2132	2728	WaterMark.exe	35
PID 2728 wrote to memory of 2132	2728	WaterMark.exe	35
PID 2132 wrote to memory of 256	2132	svchost.exe	1
PID 2132 wrote to memory of 256	2132	svchost.exe	1
PID 2132 wrote to memory of 256	2132	svchost.exe	1
PID 2132 wrote to memory of 256	2132	svchost.exe	1
PID 2132 wrote to memory of 256	2132	svchost.exe	1
PID 2132 wrote to memory of 332	2132	svchost.exe	2
PID 2132 wrote to memory of 332	2132	svchost.exe	2
PID 2132 wrote to memory of 332	2132	svchost.exe	2
PID 2132 wrote to memory of 332	2132	svchost.exe	2
PID 2132 wrote to memory of 332	2132	svchost.exe	2
PID 2132 wrote to memory of 380	2132	svchost.exe	3
PID 2132 wrote to memory of 380	2132	svchost.exe	3
PID 2132 wrote to memory of 380	2132	svchost.exe	3
PID 2132 wrote to memory of 380	2132	svchost.exe	3
PID 2132 wrote to memory of 380	2132	svchost.exe	3
PID 2132 wrote to memory of 396	2132	svchost.exe	4
PID 2132 wrote to memory of 396	2132	svchost.exe	4
PID 2132 wrote to memory of 396	2132	svchost.exe	4
PID 2132 wrote to memory of 396	2132	svchost.exe	4
PID 2132 wrote to memory of 396	2132	svchost.exe	4
PID 2132 wrote to memory of 432	2132	svchost.exe	5
PID 2132 wrote to memory of 432	2132	svchost.exe	5
PID 2132 wrote to memory of 432	2132	svchost.exe	5
PID 2132 wrote to memory of 432	2132	svchost.exe	5
PID 2132 wrote to memory of 432	2132	svchost.exe	5
PID 2132 wrote to memory of 476	2132	svchost.exe	6
PID 2132 wrote to memory of 476	2132	svchost.exe	6
PID 2132 wrote to memory of 476	2132	svchost.exe	6
PID 2132 wrote to memory of 476	2132	svchost.exe	6

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe
1⤵
PID:256

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:332

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:380
- C:\Windows\system32\services.exe
  C:\Windows\system32\services.exe
  2⤵
  PID:476
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    3⤵
    PID:592
  - - C:\Windows\system32\wbem\wmiprvse.exe
      C:\Windows\system32\wbem\wmiprvse.exe
      4⤵
      PID:1344
  - - C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
      4⤵
      PID:1472
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    3⤵
    PID:672
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    3⤵
    PID:756
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    3⤵
    PID:808
  - - C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      4⤵
      PID:1056
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    3⤵
    PID:844
  - - \\?\C:\Windows\system32\wbem\WMIADAP.EXE
      wmiadap.exe /F /T /R
      4⤵
      PID:2064
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService
    3⤵
    PID:960
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    3⤵
    PID:236
- - C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    3⤵
    PID:1048
- - C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    3⤵
    PID:1076
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    3⤵
    PID:1156
- - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
    "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
    3⤵
    PID:2044
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    3⤵
    PID:1772
- - C:\Windows\system32\sppsvc.exe
    C:\Windows\system32\sppsvc.exe
    3⤵
    PID:3004
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:492
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:500

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:396

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:432

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1124
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1857c1dd7942a15d31b1d9b8eaa72749f296221402aa659bab6a1b48e37f4122N.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1780
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\1857c1dd7942a15d31b1d9b8eaa72749f296221402aa659bab6a1b48e37f4122N.dll,#1
    3⤵
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2860
  - - C:\Windows\SysWOW64\rundll32mgr.exe
      C:\Windows\SysWOW64\rundll32mgr.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2408
    - - C:\Program Files (x86)\Microsoft\WaterMark.exe
        
        "C:\Program Files (x86)\Microsoft\WaterMark.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2728
      - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        6⤵
        Modifies WinLogon for persistence
        Drops file in System32 directory
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        
        PID:796
      - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2132

Network

DNS

google.com

svchost.exe

Remote address:

8.8.8.8:53

Request

google.com

IN A

Response

google.com

IN A

142.250.180.14
DNS

rterybrstutnrsbberve.com

svchost.exe

Remote address:

8.8.8.8:53

Request

rterybrstutnrsbberve.com

IN A

Response

rterybrstutnrsbberve.com

IN A

34.253.216.9
DNS

erwbtkidthetcwerc.com

svchost.exe

Remote address:

8.8.8.8:53

Request

erwbtkidthetcwerc.com

IN A

Response

erwbtkidthetcwerc.com

IN A

34.253.216.9
DNS

rvbwtbeitwjeitv.com

svchost.exe

Remote address:

8.8.8.8:53

Request

rvbwtbeitwjeitv.com

IN A

Response

rvbwtbeitwjeitv.com

IN A

204.95.99.221

91.220.62.30:443

svchost.exe

152 B
3
142.250.180.14:80

google.com

svchost.exe

98 B
52 B
2
1
91.220.62.30:443

svchost.exe

152 B
3
34.253.216.9:443

rterybrstutnrsbberve.com

https

svchost.exe

282 B
296 B
6
7
34.253.216.9:443

rterybrstutnrsbberve.com

https

svchost.exe

268 B
216 B
4
5
34.253.216.9:443

erwbtkidthetcwerc.com

https

svchost.exe

190 B
216 B
4
5
34.253.216.9:443

erwbtkidthetcwerc.com

https

svchost.exe

268 B
216 B
4
5
204.95.99.221:443

rvbwtbeitwjeitv.com

https

svchost.exe

558 B
132 B
12
3
204.95.99.221:443

rvbwtbeitwjeitv.com

https

svchost.exe

1.3kB
132 B
14
3
142.250.180.14:80

google.com

svchost.exe

98 B
52 B
2
1

8.8.8.8:53

google.com

dns

svchost.exe

56 B
72 B
1
1

DNS Request

google.com

DNS Response

142.250.180.14
8.8.8.8:53

rterybrstutnrsbberve.com

dns

svchost.exe

70 B
86 B
1
1

DNS Request

rterybrstutnrsbberve.com

DNS Response

34.253.216.9
8.8.8.8:53

erwbtkidthetcwerc.com

dns

svchost.exe

67 B
83 B
1
1

DNS Request

erwbtkidthetcwerc.com

DNS Response

34.253.216.9
8.8.8.8:53

rvbwtbeitwjeitv.com

dns

svchost.exe

65 B
81 B
1
1

DNS Request

rvbwtbeitwjeitv.com

DNS Response

204.95.99.221

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

Filesize
144KB

MD5
dfba937dbd7054751bfa6d21cde4b4e7

SHA1
de21e00aabfe02525132f24c5bce5d38422f7337

SHA256
cb6307ea7e37d1be176e02c6680eb286886647626ace3614a6aa5be36f0f8e22

SHA512
02dc5d22f10085431e9d688404ac5e2e29857f01b0060b5d842db0d7cf18fb2374d19ca1f52c16922067e2b62bca0bcfc0b27b1628c82c84723fcf8cdf07dbe0

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

Filesize
140KB

MD5
0c469bcbf1c31ca5405d2ca0f2ea29bf

SHA1
5ca3b31cfec5785d74c0ae02d7447edc9e5e0887

SHA256
d44531487992a38745ba75ab7f825b6e1e2a995983cfdd31ff81355dccede5f8

SHA512
dd39f80c5e634cfe7509aa766f28315e26431fa186d42077d4791db44ff9f4b4a382f22a2421ea3b195f53fa36930bea65020d19dd6e49524cb804711a9935f8

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
65KB

MD5
a9ea94ee4a3bb43d4057823b2072dc54

SHA1
94ade3c34ec08613daba8a1240586c24f8169794

SHA256
7edbb67a880d90e53ec7949c4907f4ccf5596899b98ed8651b01a485a7b06789

SHA512
0ae24a452c474a0b67eb17ceb78eabc46aad7f04a249d526cbd1bf25ccc94016133ee6cdd1cf342fa3c8dbff60372d18df56137a6c0303bbaee07f005f930ab5

Download Submit
memory/796-28-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/796-342-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/796-36-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/796-41-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/796-47-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/796-48-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/796-35-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/796-34-0x00000000000A0000-0x00000000000A1000-memory.dmp

Filesize
4KB

Download
memory/796-30-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2132-72-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2132-67-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2132-69-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2132-71-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2132-73-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2132-74-0x0000000077CB0000-0x0000000077CB1000-memory.dmp

Filesize
4KB

Download
memory/2132-70-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2132-55-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2132-63-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2408-14-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2728-52-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/2728-24-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2728-62-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2728-61-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2728-27-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2728-607-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2728-53-0x0000000077CAF000-0x0000000077CB0000-memory.dmp

Filesize
4KB

Download
memory/2728-68-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2728-25-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/2728-26-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2728-603-0x0000000077CAF000-0x0000000077CB0000-memory.dmp

Filesize
4KB

Download
memory/2860-0-0x0000000010000000-0x0000000010082000-memory.dmp

Filesize
520KB

Download
memory/2860-6-0x0000000010000000-0x0000000010082000-memory.dmp

Filesize
520KB

Download
memory/2860-1-0x0000000010000000-0x0000000010082000-memory.dmp

Filesize
520KB

Download
memory/2860-3-0x0000000010000000-0x0000000010082000-memory.dmp

Filesize
520KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.