Overview

overview

10

Static

static

3

10e75daab8...a2.exe

windows7-x64

7

10e75daab8...a2.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-12-2024 16:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    10e75daab8d37ded5da2e87609c5a30a515d90dd305e180568cfdf30da41a9a2.exe

  • Size

    163KB

  • MD5

    83ab2ec3e3456bc3cc19457a7534576d

  • SHA1

    3382b548d439bc16a4fd54aa49817109d13b8161

  • SHA256

    10e75daab8d37ded5da2e87609c5a30a515d90dd305e180568cfdf30da41a9a2

  • SHA512

    e603c8a683cbd1e259754c171c4066f3fe9aacd5d11636964041e38a25bdf8d6bdef4868f4c870a83214616770e89e1bd9c5ad1b3a3c830ee448610d0025b513

  • SSDEEP

    3072:VftffhJCuU9Cw7vFoF3M9Z8oU8HyNftffhJCuUZROzoTq0+RO7IwnY:VVfhguMCysgZNSdVfhguikdNwB

Score
10/10
ramnitbankerdiscoverypersistencespywarestealertrojanupxworm

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

    trojanspywarestealerwormbankerramnit
  • Ramnit family
    ramnit
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 5 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 8 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
    adwarespyware
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 52 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 43 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\10e75daab8d37ded5da2e87609c5a30a515d90dd305e180568cfdf30da41a9a2.exe
    "C:\Users\Admin\AppData\Local\Temp\10e75daab8d37ded5da2e87609c5a30a515d90dd305e180568cfdf30da41a9a2.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2380
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8993.bat
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:920
      • C:\Users\Admin\AppData\Local\Temp\10e75daab8d37ded5da2e87609c5a30a515d90dd305e180568cfdf30da41a9a2.exe
        "C:\Users\Admin\AppData\Local\Temp\10e75daab8d37ded5da2e87609c5a30a515d90dd305e180568cfdf30da41a9a2.exe"
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:5016
        • C:\Windows\SysWOW64\net.exe
          net stop "Kingsoft AntiVirus Service"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5032
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:4540
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8F20.bat
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:956
          • C:\Users\Admin\AppData\Local\Temp\10e75daab8d37ded5da2e87609c5a30a515d90dd305e180568cfdf30da41a9a2.exe
            "C:\Users\Admin\AppData\Local\Temp\10e75daab8d37ded5da2e87609c5a30a515d90dd305e180568cfdf30da41a9a2.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5096
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8FBD.bat
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4048
              • C:\Users\Admin\AppData\Local\Temp\10e75daab8d37ded5da2e87609c5a30a515d90dd305e180568cfdf30da41a9a2.exe
                "C:\Users\Admin\AppData\Local\Temp\10e75daab8d37ded5da2e87609c5a30a515d90dd305e180568cfdf30da41a9a2.exe"
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:5072
                • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
                  "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
                  8⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:4756
                  • C:\Program Files\Internet Explorer\iexplore.exe
                    "C:\Program Files\Internet Explorer\iexplore.exe"
                    9⤵
                    • Modifies Internet Explorer settings
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:4224
                    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4224 CREDAT:17410 /prefetch:2
                      10⤵
                      • System Location Discovery: System Language Discovery
                      • Modifies Internet Explorer settings
                      • Suspicious use of SetWindowsHookEx
                      PID:4708
    • C:\Windows\Logo1_.exe
      C:\Windows\Logo1_.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2960
      • C:\Windows\SysWOW64\net.exe
        net stop "Kingsoft AntiVirus Service"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4652
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4424

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe
    Filesize

    244KB

    MD5

    c618ca4be8a041bd66dea36079a387cc

    SHA1

    29c3689954584c43a3c10e89fe2a53dcfbd57b54

    SHA256

    0f72a93795f2b46cced9f05152e0acbcc68e5716e206d3117f92b1f804a059b8

    SHA512

    9d9c85675ec172a50dc9abe74ff7b0850143816e593b66007e5026b82075474deec6d239a8fa0c217b2322429dad67b6c68a0b38eca77bdd382f9023cfc95b0b

    Download Submit

  • C:\Program Files\7-Zip\7z.exe
    Filesize

    570KB

    MD5

    53311173fe75a5952362ca66e9c1a622

    SHA1

    71f060d7d5dafb46e62312bdf037e81cf19b6c62

    SHA256

    9ef51a8baa97fdb0fdfa10fae27c5766726e38f08d737e70033746bbec6e1276

    SHA512

    dcc795ae261565dfbd53af1d415a5947e21c538f69a64701e18e66cc89395b5af5fd4ab17af4203a27c5871fb56cef2b2441b17904309cb4de45a724f8236591

    Download Submit

  • C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
    Filesize

    636KB

    MD5

    d82ffc872aed7c85cf936dcdcc2e6372

    SHA1

    50ca56cb4a429ce1532afaa2732f61833fc2b54f

    SHA256

    a487733710d946abff1a93a23ae6bbafd6c0800bc78e4d5e3cac36e2a14ddace

    SHA512

    0b0031418275c6be01f7757111058cd5bd3e5f4862e0631e2e28c5e7ffbb271446abdc2a88a7953ae55112799bc4a051becc2b14491e0d1760e336498665cc8b

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
    Filesize

    471B

    MD5

    030d28178ec890f0d933359dad23da1e

    SHA1

    5fa5195ca05aea5caaf471afbcc2fd039876f3c4

    SHA256

    1e40a11d7943a7924cacca9632fa6dd8bd24fb1072cb61e64f9033ebce74806b

    SHA512

    0a4d2a2dc387cda5c4a2545d416aa40eaccc7f0176861c2862c0a792970282189548309263d0937913a9e8be8105074a8d7129b87e277db68a0efbc57f3030e6

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
    Filesize

    404B

    MD5

    f20d52d0ac24a01063242579530531d5

    SHA1

    0de323c04377781fb03c19db1d770bb42f5ad34d

    SHA256

    ecc9458d9cd7d912933ebfbaa1ff6b888dadc2057db6154b2bbf0cc5c61c6f2f

    SHA512

    23556e0d61f345f9a48a8eb57f069e3a0614cf9c2c007f1b734adeea71552a203bd603696a7d253a2f211b93863ab0e85e5e6cee4be1a7aa7c8d3a1416c2c089

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver18C3.tmp
    Filesize

    15KB

    MD5

    1a545d0052b581fbb2ab4c52133846bc

    SHA1

    62f3266a9b9925cd6d98658b92adec673cbe3dd3

    SHA256

    557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

    SHA512

    bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6IJLDY7V\suggestions[1].en-US
    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\$$a8993.bat
    Filesize

    722B

    MD5

    36cff917b31dbdefce7222cb0490fd1d

    SHA1

    8a73dcb209aaf88593e7921cba7247a9cc689d07

    SHA256

    9377874c9ffeb9e63400f221d3cf0c42379a4e0cc1857d3349ad5b757ed69406

    SHA512

    af2c5da55280dcdc2810dad94e1842dc7b692e3ced906a017e7825bd6e7273772136385f75ca4cb1c311aa5d69eb725cfbc9385e45de1e7878ab49edab7794b3

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\$$a8F20.bat
    Filesize

    722B

    MD5

    1810cc38cfa25603a80464c37a909b66

    SHA1

    e632d3616e5d7057563f91acbafb35000c26f2b0

    SHA256

    96b231ba4640ed1c2c952660fd346f01b589d29ddbacfa499320a4079dae93e5

    SHA512

    cb131b3cfd51d6bbfe84ab1bdca67cb99174e0934cb41570be32b84a497d4cf5336fc34d93a6f986a35299133babf6ad74eb3b1399907620de959df5f1cc488e

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\$$a8FBD.bat
    Filesize

    722B

    MD5

    a0ffc7d3bce3112e44b0cca58882e521

    SHA1

    0d6551dcaeb719f352c6463d36a3ea9ed57cfc5f

    SHA256

    94e0c6b85b7afc9979a49b10f6b4ec1d7e2d7a7fc0c0fd3e5c75108f1221be00

    SHA512

    0166d6df1a5c195973366276825379a405468222c2de9ea247f5d6d5a7fb49c4c38987b851b5b8c056ff0e6a1e50341a1bc170cf49f2c34943c54eace3207dd5

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\10e75daab8d37ded5da2e87609c5a30a515d90dd305e180568cfdf30da41a9a2.exe.exe
    Filesize

    81KB

    MD5

    e0479c182d095e82b39a8aaebf1d1445

    SHA1

    550d80a845cf09373a1ae20307b708e58ab4a45b

    SHA256

    11d37253b136ea147835ce539f01944a27897ae068e217d8b5de450cfa60ea4f

    SHA512

    6c04d30838fca09fd61de6cb8db916809a97472907956ab561e3c9594db2cda0fe50708799e3f585d119f570cf04a6d1f84ee9e7cc787fbdd15df569a0428fef

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\10e75daab8d37ded5da2e87609c5a30a515d90dd305e180568cfdf30da41a9a2.exe.exe
    Filesize

    137KB

    MD5

    56c765a6bae3953c3b3e2cdc70826731

    SHA1

    56aac813814e1d74914ed10252542e636bc4f330

    SHA256

    7a0ef5a0bdb4a246847e7b31e49bd570d47630d634eb53130f642b061e4e82c9

    SHA512

    dbcea75226a570a2ad5a600123a0d5ddf5f8cd38977eb6cf3d9566e59a7d6b8a1df9041e07259cf90049d24b0760802e0bb153a56a274dd301a53890aa870a90

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\10e75daab8d37ded5da2e87609c5a30a515d90dd305e180568cfdf30da41a9a2.exe.exe
    Filesize

    55KB

    MD5

    ff5e1f27193ce51eec318714ef038bef

    SHA1

    b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

    SHA256

    fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

    SHA512

    c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

    Download Submit

  • C:\Windows\Logo1_.exe
    Filesize

    26KB

    MD5

    6d1897fce1d6586be0535a68800186c1

    SHA1

    b7e726ce1efdd0faeb4e7815c135a2fc51e0a06f

    SHA256

    5f37e266fe06751a70976dde002a6dc53df2df2d08147adcaa408cdfa43f2324

    SHA512

    977e16961bfd2cd6fa9f4315887697be1c4bd3f98a79dd317a0db932ba5dc71bd779c333c4f56fa184618120a62caba9149ed047a52c4c5c73ba23b2aa1704ad

    Download Submit

  • C:\Windows\rundl132.exe
    Filesize

    26KB

    MD5

    a377c65eade7f19ab9dfa4a74a9e87de

    SHA1

    af82f1e48659bf20786fc83200f025403794e11e

    SHA256

    e56d093676d33c61f069e338a20e52151e92e9b4133f07e9924342667034126d

    SHA512

    fcbb661a23840f66a66c5785d46e025948a9c20491795755070f2c1cb276a9ab5d57463d1242c57a2cd86e9cbfcb987a0dc2d1433b5f81321f1d2389092ee4b8

    Download Submit

  • F:\$RECYCLE.BIN\S-1-5-21-2045521122-590294423-3465680274-1000\_desktop.ini
    Filesize

    10B

    MD5

    8b929bbff5206fb508d25ffd2036ed74

    SHA1

    cd32d37ccaae75cc9bb7ba821161d084b6d3d173

    SHA256

    e461dcb4d7e5d8f7940f58d1fb55b6934a26df6435436b8465461ecc002b172b

    SHA512

    5c5816f7ff2ef7de725d9b2f97e9ab62f765e81d53bfc3623c6683a34609fa8c1fb6b472ae266154be61937f296b16ed4147e7d2024517fa1e7603975df82281

    Download Submit

  • memory/2380-0-0x0000000000400000-0x0000000000434000-memory.dmp

    Filesize

    208KB

    Download

  • memory/2380-8-0x0000000000400000-0x0000000000434000-memory.dmp

    Filesize

    208KB

    Download

  • memory/2960-78-0x0000000000400000-0x0000000000434000-memory.dmp

    Filesize

    208KB

    Download

  • memory/2960-91-0x0000000000400000-0x0000000000434000-memory.dmp

    Filesize

    208KB

    Download

  • memory/2960-49-0x0000000000400000-0x0000000000434000-memory.dmp

    Filesize

    208KB

    Download

  • memory/2960-5308-0x0000000000400000-0x0000000000434000-memory.dmp

    Filesize

    208KB

    Download

  • memory/2960-57-0x0000000000400000-0x0000000000434000-memory.dmp

    Filesize

    208KB

    Download

  • memory/2960-9-0x0000000000400000-0x0000000000434000-memory.dmp

    Filesize

    208KB

    Download

  • memory/2960-4839-0x0000000000400000-0x0000000000434000-memory.dmp

    Filesize

    208KB

    Download

  • memory/2960-1287-0x0000000000400000-0x0000000000434000-memory.dmp

    Filesize

    208KB

    Download

  • memory/2960-76-0x0000000000400000-0x0000000000434000-memory.dmp

    Filesize

    208KB

    Download

  • memory/2960-201-0x0000000000400000-0x0000000000434000-memory.dmp

    Filesize

    208KB

    Download

  • memory/4756-45-0x0000000000590000-0x0000000000591000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4756-47-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

    Download

  • memory/5016-25-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

    Download

  • memory/5016-19-0x00000000001E0000-0x0000000000200000-memory.dmp

    Filesize

    128KB

    Download

  • memory/5016-18-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

    Download

  • memory/5072-40-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

    Download

  • memory/5072-46-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

    Download

  • memory/5096-29-0x0000000000400000-0x0000000000434000-memory.dmp

    Filesize

    208KB

    Download

  • memory/5096-36-0x0000000000400000-0x0000000000434000-memory.dmp

    Filesize

    208KB

    Download