ramnit | 3d3aa18c4990109af1894eed8217cd935ea8713f50d752379c233126843931f7

Analysis

max time kernel
120s
max time network
92s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
16-12-2024 08:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3d3aa18c4990109af1894eed8217cd935ea8713f50d752379c233126843931f7N.dll
Size

335KB
MD5

afd5f90e07b064491aaf2c85233d9360
SHA1

6221272e94459dfe4f59b34a92ae8374af34d501
SHA256

3d3aa18c4990109af1894eed8217cd935ea8713f50d752379c233126843931f7
SHA512

99c12a42cf4ab8f6916b18f7866f53aaff9075b36e9d93fc2751ab1c43a5b57f81af2b4ba54d8977aff90493781638a77719239c187fd3570da06ea19a3a79f0
SSDEEP

6144:lCIGPj038tAgFMldWNX+N/ol0NARDbuZOj:uj038t/FMldW4NynZ

Score

10^/10

ramnit banker discovery persistence spyware stealer trojan upx worm

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe"	svchost.exe

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Ramnit family
ramnit

Executes dropped EXE 2 IoCs

pid	Process
332	rundll32mgr.exe
3032	WaterMark.exe

Loads dropped DLL 4 IoCs

pid	Process
2296	rundll32.exe
2296	rundll32.exe
332	rundll32mgr.exe
332	rundll32mgr.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe
File created	C:\Windows\SysWOW64\dmlconf.dat	svchost.exe
File opened for modification	C:\Windows\SysWOW64\dmlconf.dat	svchost.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/332-12-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/332-20-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/3032-38-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/332-18-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/332-17-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/332-15-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/332-14-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/332-13-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/3032-86-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/3032-676-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\Microsoft.Build.Conversion.v3.5.resources.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.Design.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\spu\liblogo_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\tipskins.dll	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe	svchost.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\misc\liblogger_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libgradfun_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\librotate_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Defender\MpCmdRun.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe	svchost.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckg.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\sunec.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\librawvid_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\WindowsBase.resources.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.RunTime.Serialization.Resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_es_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\PhotoAcq.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\j2pcsc.dll	svchost.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\AUTHZAX.DLL	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libsdl_image_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\control\libwin_msg_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\PhotoViewer.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.DirectoryServices.AccountManagement.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\control\libnetsync_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\java-rmi.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\ssv.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Net.Resources.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Linq.Resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libaribcam_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\msoshext.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\msdarem.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\dt_socket.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\jsdt.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\servertool.exe	svchost.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Checkers\Chkr.dll	svchost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\api-ms-win-crt-runtime-l1-1-0.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Services.Client.resources.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Soft Blue.htm	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\about.html	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libchorus_flanger_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2ssv.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\t2k.dll	svchost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Web.Entity.Design.Resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libtrivial_channel_mixer_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\visualization\libprojectm_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\DVD Maker\Pipeline.dll	svchost.exe
File opened for modification	C:\Program Files\Internet Explorer\msdbg2.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libsubsdec_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libwav_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\keystore\libfile_keystore_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\d3dcompiler_47.dll	svchost.exe
File opened for modification	C:\Program Files\Internet Explorer\F12Tools.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.Design.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libspeex_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\npt.dll	svchost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\IA2Marshal.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\misc\libaddonsvorepository_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libadjust_plugin.dll	svchost.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2736	2296	WerFault.exe	31

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaterMark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32mgr.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
3032	WaterMark.exe
3032	WaterMark.exe
3032	WaterMark.exe
3032	WaterMark.exe
3032	WaterMark.exe
3032	WaterMark.exe
3032	WaterMark.exe
3032	WaterMark.exe
2676	svchost.exe
2676	svchost.exe
2676	svchost.exe
2676	svchost.exe
2676	svchost.exe
2676	svchost.exe
2676	svchost.exe
2676	svchost.exe
2676	svchost.exe
2676	svchost.exe
2676	svchost.exe
2676	svchost.exe
2676	svchost.exe
2676	svchost.exe
2676	svchost.exe
2676	svchost.exe
2676	svchost.exe
2676	svchost.exe
2676	svchost.exe
2676	svchost.exe
2676	svchost.exe
2676	svchost.exe
2676	svchost.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3032	WaterMark.exe
Token: SeDebugPrivilege	2676	svchost.exe
Token: SeDebugPrivilege	2296	rundll32.exe
Token: SeDebugPrivilege	2736	WerFault.exe
Token: SeDebugPrivilege	3032	WaterMark.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
332	rundll32mgr.exe
3032	WaterMark.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 2296	1668	rundll32.exe	31
PID 1668 wrote to memory of 2296	1668	rundll32.exe	31
PID 1668 wrote to memory of 2296	1668	rundll32.exe	31
PID 1668 wrote to memory of 2296	1668	rundll32.exe	31
PID 1668 wrote to memory of 2296	1668	rundll32.exe	31
PID 1668 wrote to memory of 2296	1668	rundll32.exe	31
PID 1668 wrote to memory of 2296	1668	rundll32.exe	31
PID 2296 wrote to memory of 332	2296	rundll32.exe	32
PID 2296 wrote to memory of 332	2296	rundll32.exe	32
PID 2296 wrote to memory of 332	2296	rundll32.exe	32
PID 2296 wrote to memory of 332	2296	rundll32.exe	32
PID 332 wrote to memory of 3032	332	rundll32mgr.exe	34
PID 332 wrote to memory of 3032	332	rundll32mgr.exe	34
PID 332 wrote to memory of 3032	332	rundll32mgr.exe	34
PID 332 wrote to memory of 3032	332	rundll32mgr.exe	34
PID 2296 wrote to memory of 2736	2296	rundll32.exe	33
PID 2296 wrote to memory of 2736	2296	rundll32.exe	33
PID 2296 wrote to memory of 2736	2296	rundll32.exe	33
PID 2296 wrote to memory of 2736	2296	rundll32.exe	33
PID 3032 wrote to memory of 2840	3032	WaterMark.exe	35
PID 3032 wrote to memory of 2840	3032	WaterMark.exe	35
PID 3032 wrote to memory of 2840	3032	WaterMark.exe	35
PID 3032 wrote to memory of 2840	3032	WaterMark.exe	35
PID 3032 wrote to memory of 2840	3032	WaterMark.exe	35
PID 3032 wrote to memory of 2840	3032	WaterMark.exe	35
PID 3032 wrote to memory of 2840	3032	WaterMark.exe	35
PID 3032 wrote to memory of 2840	3032	WaterMark.exe	35
PID 3032 wrote to memory of 2840	3032	WaterMark.exe	35
PID 3032 wrote to memory of 2840	3032	WaterMark.exe	35
PID 3032 wrote to memory of 2676	3032	WaterMark.exe	36
PID 3032 wrote to memory of 2676	3032	WaterMark.exe	36
PID 3032 wrote to memory of 2676	3032	WaterMark.exe	36
PID 3032 wrote to memory of 2676	3032	WaterMark.exe	36
PID 3032 wrote to memory of 2676	3032	WaterMark.exe	36
PID 3032 wrote to memory of 2676	3032	WaterMark.exe	36
PID 3032 wrote to memory of 2676	3032	WaterMark.exe	36
PID 3032 wrote to memory of 2676	3032	WaterMark.exe	36
PID 3032 wrote to memory of 2676	3032	WaterMark.exe	36
PID 3032 wrote to memory of 2676	3032	WaterMark.exe	36
PID 2676 wrote to memory of 256	2676	svchost.exe	1
PID 2676 wrote to memory of 256	2676	svchost.exe	1
PID 2676 wrote to memory of 256	2676	svchost.exe	1
PID 2676 wrote to memory of 256	2676	svchost.exe	1
PID 2676 wrote to memory of 256	2676	svchost.exe	1
PID 2676 wrote to memory of 336	2676	svchost.exe	2
PID 2676 wrote to memory of 336	2676	svchost.exe	2
PID 2676 wrote to memory of 336	2676	svchost.exe	2
PID 2676 wrote to memory of 336	2676	svchost.exe	2
PID 2676 wrote to memory of 336	2676	svchost.exe	2
PID 2676 wrote to memory of 384	2676	svchost.exe	3
PID 2676 wrote to memory of 384	2676	svchost.exe	3
PID 2676 wrote to memory of 384	2676	svchost.exe	3
PID 2676 wrote to memory of 384	2676	svchost.exe	3
PID 2676 wrote to memory of 384	2676	svchost.exe	3
PID 2676 wrote to memory of 396	2676	svchost.exe	4
PID 2676 wrote to memory of 396	2676	svchost.exe	4
PID 2676 wrote to memory of 396	2676	svchost.exe	4
PID 2676 wrote to memory of 396	2676	svchost.exe	4
PID 2676 wrote to memory of 396	2676	svchost.exe	4
PID 2676 wrote to memory of 432	2676	svchost.exe	5
PID 2676 wrote to memory of 432	2676	svchost.exe	5
PID 2676 wrote to memory of 432	2676	svchost.exe	5
PID 2676 wrote to memory of 432	2676	svchost.exe	5
PID 2676 wrote to memory of 432	2676	svchost.exe	5

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe
1⤵
PID:256

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:336

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:384
- C:\Windows\system32\services.exe
  C:\Windows\system32\services.exe
  2⤵
  PID:476
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    3⤵
    PID:608
  - - C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
      4⤵
      PID:1972
  - - C:\Windows\system32\wbem\wmiprvse.exe
      C:\Windows\system32\wbem\wmiprvse.exe
      4⤵
      PID:1464
  - - C:\Windows\system32\wbem\wmiprvse.exe
      C:\Windows\system32\wbem\wmiprvse.exe -Embedding
      4⤵
      PID:2424
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    3⤵
    PID:684
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    3⤵
    PID:764
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    3⤵
    PID:824
  - - C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      4⤵
      PID:1088
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    3⤵
    PID:864
  - - \\?\C:\Windows\system32\wbem\WMIADAP.EXE
      wmiadap.exe /F /T /R
      4⤵
      PID:2412
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService
    3⤵
    PID:976
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    3⤵
    PID:284
- - C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    3⤵
    PID:1072
- - C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    3⤵
    PID:1080
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    3⤵
    PID:1168
- - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
    "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
    3⤵
    PID:1280
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    3⤵
    PID:2264
- - C:\Windows\system32\sppsvc.exe
    C:\Windows\system32\sppsvc.exe
    3⤵
    PID:1584
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:488
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:496

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:396

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:432

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1160
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3d3aa18c4990109af1894eed8217cd935ea8713f50d752379c233126843931f7N.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1668
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\3d3aa18c4990109af1894eed8217cd935ea8713f50d752379c233126843931f7N.dll,#1
    3⤵
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2296
  - - C:\Windows\SysWOW64\rundll32mgr.exe
      C:\Windows\SysWOW64\rundll32mgr.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of UnmapMainImage
      Suspicious use of WriteProcessMemory
      PID:332
    - - C:\Program Files (x86)\Microsoft\WaterMark.exe
        
        "C:\Program Files (x86)\Microsoft\WaterMark.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of UnmapMainImage
        Suspicious use of WriteProcessMemory
        
        PID:3032
      - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        6⤵
        Modifies WinLogon for persistence
        Drops file in System32 directory
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        
        PID:2840
      - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2676
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2296 -s 224
      4⤵
      Program crash
      Suspicious use of AdjustPrivilegeToken
      PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

Filesize
350KB

MD5
67428ba1b61849956b8b5ee3aabea041

SHA1
bad8bd23fd13d619f0f19d710e5da3dc0cdb67a9

SHA256
543bae24d748dd5d3dd0c830adde4f5ae498da1c1fb8a98d05281af2a1daf975

SHA512
602d89315960dbae227eff81e2e1a5a0b94ef22bdbfe534efe5546fb05baeb890824fe3fb81f99461f913cbb355721b290e6068b578da9aca279bca2bb66ead5

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

Filesize
346KB

MD5
24d7f2bcd2eb3dfa8360be919218e819

SHA1
ab83979ac01df91492a59893fd1ece689a20d670

SHA256
8586adeabe2b46c528d43189a66c6dd8b8ab03fd87d8de3c8c7e0b43e1eb02a7

SHA512
5e5a7de6e918c2528c373dfa3890aa172a85857e1392ca06339af19750dd647c47446541763d20ad5827d93e24c18d99d1fe0e8ead47d4e5ba403a142920d171

Download Submit
C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
168KB

MD5
ec016535aa51780874b79a790acc545e

SHA1
c4edad97073dabc1b4e5c2403913ae19eaffa74e

SHA256
61c1dd6fde3f6373c47e6f51d2a4ffbac33b8fb2fb530b83a696f874e3d21fca

SHA512
bf373701b6fcbc9cc7d40ca65caecb5896f443eb923423bc36659988ea95f0b51783b0fa7c0461d1eea286e0119212c45763f0e676c0a23c088b672bf9634736

Download Submit
memory/332-11-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/332-13-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/332-12-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/332-20-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/332-18-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/332-14-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/332-17-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/332-16-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/332-15-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2296-413-0x0000000010000000-0x0000000010058000-memory.dmp

Filesize
352KB

Download
memory/2296-10-0x00000000001A0000-0x00000000001DB000-memory.dmp

Filesize
236KB

Download
memory/2296-8-0x0000000010000000-0x0000000010058000-memory.dmp

Filesize
352KB

Download
memory/2296-1-0x0000000010000000-0x0000000010058000-memory.dmp

Filesize
352KB

Download
memory/2676-87-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/2676-91-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/2676-92-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2676-89-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2676-90-0x00000000774F0000-0x00000000774F1000-memory.dmp

Filesize
4KB

Download
memory/2676-85-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2676-81-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2676-72-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2676-88-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2840-64-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/2840-410-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2840-57-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2840-62-0x00000000000A0000-0x00000000000A1000-memory.dmp

Filesize
4KB

Download
memory/2840-63-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2840-45-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2840-65-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2840-52-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2840-66-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2840-67-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2840-43-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/3032-86-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3032-407-0x00000000774EF000-0x00000000774F0000-memory.dmp

Filesize
4KB

Download
memory/3032-70-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/3032-41-0x00000000774EF000-0x00000000774F0000-memory.dmp

Filesize
4KB

Download
memory/3032-676-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3032-40-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/3032-38-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download