Analysis

  • max time kernel
    93s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-12-2024 03:10

General

  • Target

    5ce23b2a954a3803aa90be4fec60be105e09d15fd24bfca1420db12d65f8e0e9.dll

  • Size

    276KB

  • MD5

    d713d347658a4744e01eb2f9e169ce1c

  • SHA1

    77777460a0b41f505de6cf8a3144b64df87ba01b

  • SHA256

    5ce23b2a954a3803aa90be4fec60be105e09d15fd24bfca1420db12d65f8e0e9

  • SHA512

    387d0ab83c48d45ab3bc9abf7f5b0d9dc5b7a04944d2d319bb4d2978630829cd369bda6349737ca67980856a0a76a2279892d67134a96e1acbb47b6e7e64b5a1

  • SSDEEP

    3072:FdcQ2ZNMSQvbajUTUItjT68+xQEVulys593oI8mmwXrPbh:VATSOjUQKculy8uI9fbPN

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Ramnit family
  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • UPX packed file 12 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 50 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ce23b2a954a3803aa90be4fec60be105e09d15fd24bfca1420db12d65f8e0e9.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4552
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ce23b2a954a3803aa90be4fec60be105e09d15fd24bfca1420db12d65f8e0e9.dll,#1
      2⤵
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1376
      • C:\Windows\SysWOW64\rundll32mgr.exe
        C:\Windows\SysWOW64\rundll32mgr.exe
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of UnmapMainImage
        • Suspicious use of WriteProcessMemory
        PID:788
        • C:\Program Files (x86)\Microsoft\WaterMark.exe
          "C:\Program Files (x86)\Microsoft\WaterMark.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of UnmapMainImage
          • Suspicious use of WriteProcessMemory
          PID:1672
          • C:\Windows\SysWOW64\svchost.exe
            C:\Windows\system32\svchost.exe
            5⤵
              PID:3344
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 204
                6⤵
                • Program crash
                PID:4752
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe"
              5⤵
              • Modifies Internet Explorer settings
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:2524
              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2524 CREDAT:17410 /prefetch:2
                6⤵
                • System Location Discovery: System Language Discovery
                • Modifies Internet Explorer settings
                • Suspicious use of SetWindowsHookEx
                PID:2272
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe"
              5⤵
              • Modifies Internet Explorer settings
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:4072
              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4072 CREDAT:17410 /prefetch:2
                6⤵
                • System Location Discovery: System Language Discovery
                • Modifies Internet Explorer settings
                • Suspicious use of SetWindowsHookEx
                PID:1252
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3344 -ip 3344
      1⤵
        PID:4916

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

        Filesize

        471B

        MD5

        ec237169ada59f1945749967a6d3d7f0

        SHA1

        e8fe32e8fa527409463d3fa0d63b6bdf709d7bd6

        SHA256

        b783f55456ca301f00aab79b6a0720bfb2450aefd094e6026231fab663152d70

        SHA512

        d5b5bff9f6afb36817c2c556e67c4ed7fc787a51bef623eb7150b596cc4cc88bee4b10b5eccae2c2ed0055653166f68bf75f2375ce4689666eb42330361de2d5

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

        Filesize

        404B

        MD5

        1081bee877db70df6826b89f40d1c0bd

        SHA1

        f9b767aad023a70ad70217fc3c00c2271ae3110e

        SHA256

        6a68162fd906fe8402b696cf40c0dab9a9e596ee5b0e6a550660434914cc8cca

        SHA512

        77c0005f881df384c429d59c8366f5f8c77bf4c0cfeea170323534a73f472deb9e8c6017001d9be690f909c448463cf87a1d5b063d2e3fc677aec10a6f7f9dd0

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

        Filesize

        404B

        MD5

        123221a6cd92ad577b188229756ed226

        SHA1

        35a80c45efd5fdc37295dca116a832f477a3f061

        SHA256

        d9ce11104ecc1163ae961536f814484172c076ecb7a7217cbcf680d464e82592

        SHA512

        90e072e330571e5dfe74b5e17e429ba6ae3048d7fd4aea0f40fe21841f52037cafb5a94e7c512ca236ea23c4ed3a0382924834492a641805d536a86f1a1632b2

      • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{84F778DC-BC24-11EF-B319-622000771059}.dat

        Filesize

        4KB

        MD5

        37750570148fdf9e07c27ff7add06ad5

        SHA1

        43b8116336d4d21be79e3450958e710b8055a739

        SHA256

        5aeccc7bb42cc989794e68ac287415794863f834ad005872e7f4a154d1d291fe

        SHA512

        5af1f5536d5b6518b94480bcc675f204feb1d6d3d8395776ef586c262bf6b4f7ae73733ea4c9fa0224d05ccf01812b4204141720495006e5b914fa2edb95c03b

      • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{84F9DB27-BC24-11EF-B319-622000771059}.dat

        Filesize

        5KB

        MD5

        67e30644617538a8ae1ca4e51bae6ff8

        SHA1

        54781515055b782ed89e311c9dc81abbb1993b2c

        SHA256

        1b5b4480b1bd1b2939fe59d4db801f3a74022c81f7f958f423019bd3e761268b

        SHA512

        dfbf2db936ca926a39842ecfd7f5c7a1c183762a460c0cebf1de58c6bf26cf17cdfe59e4c077ef9292cbe2c324a41c85bfe746b9c319d5c679af19c470cf9d05

      • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verF9E1.tmp

        Filesize

        15KB

        MD5

        1a545d0052b581fbb2ab4c52133846bc

        SHA1

        62f3266a9b9925cd6d98658b92adec673cbe3dd3

        SHA256

        557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

        SHA512

        bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8R55UT9S\suggestions[1].en-US

        Filesize

        17KB

        MD5

        5a34cb996293fde2cb7a4ac89587393a

        SHA1

        3c96c993500690d1a77873cd62bc639b3a10653f

        SHA256

        c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

        SHA512

        e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

      • C:\Windows\SysWOW64\rundll32mgr.exe

        Filesize

        124KB

        MD5

        f384ea72b4e3b1342ae772e437a585e9

        SHA1

        e67abce1da81b4f719cf2297d676bb1d69db5224

        SHA256

        aeb89b034661d5bee4aeb61382abd56affce7f6410100f01cdf4c806a7638825

        SHA512

        109b294e44a62453745ec1fc1ae3ffb6cccfb48f909e84a18beb88eab90dc484954808f54c96f292b4c189f38ec02598c08fc7e76d1e537cb40b98f08b2fa536

      • memory/788-8-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/788-10-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/788-7-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/788-11-0x00000000008B0000-0x00000000008B1000-memory.dmp

        Filesize

        4KB

      • memory/788-12-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/788-15-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/788-13-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/788-6-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/788-4-0x0000000000400000-0x0000000000429000-memory.dmp

        Filesize

        164KB

      • memory/1376-0-0x0000000010000000-0x0000000010047000-memory.dmp

        Filesize

        284KB

      • memory/1672-31-0x00000000772B2000-0x00000000772B3000-memory.dmp

        Filesize

        4KB

      • memory/1672-36-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/1672-37-0x00000000772B2000-0x00000000772B3000-memory.dmp

        Filesize

        4KB

      • memory/1672-38-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/1672-35-0x0000000000070000-0x0000000000071000-memory.dmp

        Filesize

        4KB

      • memory/1672-32-0x0000000020010000-0x0000000020022000-memory.dmp

        Filesize

        72KB

      • memory/1672-41-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/1672-30-0x0000000000060000-0x0000000000061000-memory.dmp

        Filesize

        4KB

      • memory/1672-29-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/1672-25-0x0000000000400000-0x0000000000429000-memory.dmp

        Filesize

        164KB

      • memory/3344-34-0x0000000000D00000-0x0000000000D01000-memory.dmp

        Filesize

        4KB

      • memory/3344-33-0x0000000000D20000-0x0000000000D21000-memory.dmp

        Filesize

        4KB