ramnit | 8342585e9eee1b1911992068dfa8f5dd1b9e1548f1f81d726ddb5f1442b5009d

Analysis

max time kernel
95s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-12-2024 07:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8342585e9eee1b1911992068dfa8f5dd1b9e1548f1f81d726ddb5f1442b5009dN.dll
Size

947KB
MD5

b8cf1b97212eab07ad9d97f6771bf6e0
SHA1

3da088e4ca06a1e54ca4dc36a2c47810169af877
SHA256

8342585e9eee1b1911992068dfa8f5dd1b9e1548f1f81d726ddb5f1442b5009d
SHA512

4ca204cba05f596b83c897cd4499b50c1bfb8c290d5d3e15edde972d77e0acd8ebca89c3468791e9892c5c0979b2d71754798628fd3dc6a4616d50d39bafab3b
SSDEEP

24576:pzb1MlCKUQyUmjtczu6Prs9pgWoopooK9kwP+PmS4+xXGeBD+VF3D:pzbKsUmjtcdPGgIwP+PmSdF+P

Score

10^/10

ramnit banker discovery spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Ramnit family
ramnit

Executes dropped EXE 4 IoCs

pid	Process
1652	rundll32mgr.exe
2120	rundll32mgrmgr.exe
1152	WaterMark.exe
3788	WaterMark.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgrmgr.exe	rundll32mgr.exe
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2120-22-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/2120-23-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1652-28-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/2120-27-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1652-19-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/2120-12-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/2120-11-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/2120-10-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/3788-56-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1152-54-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1152-61-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/memory/3788-64-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1152-63-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1152-67-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1152-72-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\WaterMark.exe	rundll32mgrmgr.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxB7F6.tmp	rundll32mgr.exe
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	rundll32mgr.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxB640.tmp	rundll32mgrmgr.exe
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	rundll32mgrmgr.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2400	4820	WerFault.exe	89
2424	5064	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32mgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaterMark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32mgrmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaterMark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31150163"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{91387A7C-BC46-11EF-BDBF-FAA11E730504} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{913D3F74-BC46-11EF-BDBF-FAA11E730504} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1706367280"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1706367280"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1709648153"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31150163"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1709648153"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31150163"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31150163"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "441184650"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{913FA19D-BC46-11EF-BDBF-FAA11E730504} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1709648153"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{9136188E-BC46-11EF-BDBF-FAA11E730504} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
1152	WaterMark.exe
1152	WaterMark.exe
1152	WaterMark.exe
1152	WaterMark.exe
3788	WaterMark.exe
3788	WaterMark.exe
3788	WaterMark.exe
3788	WaterMark.exe
1152	WaterMark.exe
1152	WaterMark.exe
1152	WaterMark.exe
1152	WaterMark.exe
1152	WaterMark.exe
1152	WaterMark.exe
1152	WaterMark.exe
1152	WaterMark.exe
1152	WaterMark.exe
1152	WaterMark.exe
1152	WaterMark.exe
1152	WaterMark.exe
3788	WaterMark.exe
3788	WaterMark.exe
3788	WaterMark.exe
3788	WaterMark.exe
3788	WaterMark.exe
3788	WaterMark.exe
3788	WaterMark.exe
3788	WaterMark.exe
3788	WaterMark.exe
3788	WaterMark.exe
3788	WaterMark.exe
3788	WaterMark.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1152	WaterMark.exe
Token: SeDebugPrivilege	3788	WaterMark.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3160	iexplore.exe
4060	iexplore.exe
3344	iexplore.exe
4960	iexplore.exe

Suspicious use of SetWindowsHookEx 18 IoCs

pid	Process
4060	iexplore.exe
4060	iexplore.exe
3160	iexplore.exe
3160	iexplore.exe
3344	iexplore.exe
3344	iexplore.exe
4960	iexplore.exe
4960	iexplore.exe
820	IEXPLORE.EXE
820	IEXPLORE.EXE
4100	IEXPLORE.EXE
4100	IEXPLORE.EXE
2908	IEXPLORE.EXE
2908	IEXPLORE.EXE
556	IEXPLORE.EXE
556	IEXPLORE.EXE
820	IEXPLORE.EXE
820	IEXPLORE.EXE

Suspicious use of UnmapMainImage 4 IoCs

pid	Process
2120	rundll32mgrmgr.exe
1652	rundll32mgr.exe
1152	WaterMark.exe
3788	WaterMark.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 3156 wrote to memory of 4280	3156	rundll32.exe	83
PID 3156 wrote to memory of 4280	3156	rundll32.exe	83
PID 3156 wrote to memory of 4280	3156	rundll32.exe	83
PID 4280 wrote to memory of 1652	4280	rundll32.exe	84
PID 4280 wrote to memory of 1652	4280	rundll32.exe	84
PID 4280 wrote to memory of 1652	4280	rundll32.exe	84
PID 1652 wrote to memory of 2120	1652	rundll32mgr.exe	85
PID 1652 wrote to memory of 2120	1652	rundll32mgr.exe	85
PID 1652 wrote to memory of 2120	1652	rundll32mgr.exe	85
PID 2120 wrote to memory of 1152	2120	rundll32mgrmgr.exe	86
PID 2120 wrote to memory of 1152	2120	rundll32mgrmgr.exe	86
PID 2120 wrote to memory of 1152	2120	rundll32mgrmgr.exe	86
PID 1652 wrote to memory of 3788	1652	rundll32mgr.exe	87
PID 1652 wrote to memory of 3788	1652	rundll32mgr.exe	87
PID 1652 wrote to memory of 3788	1652	rundll32mgr.exe	87
PID 1152 wrote to memory of 5064	1152	WaterMark.exe	88
PID 1152 wrote to memory of 5064	1152	WaterMark.exe	88
PID 1152 wrote to memory of 5064	1152	WaterMark.exe	88
PID 1152 wrote to memory of 5064	1152	WaterMark.exe	88
PID 1152 wrote to memory of 5064	1152	WaterMark.exe	88
PID 1152 wrote to memory of 5064	1152	WaterMark.exe	88
PID 1152 wrote to memory of 5064	1152	WaterMark.exe	88
PID 1152 wrote to memory of 5064	1152	WaterMark.exe	88
PID 1152 wrote to memory of 5064	1152	WaterMark.exe	88
PID 3788 wrote to memory of 4820	3788	WaterMark.exe	89
PID 3788 wrote to memory of 4820	3788	WaterMark.exe	89
PID 3788 wrote to memory of 4820	3788	WaterMark.exe	89
PID 3788 wrote to memory of 4820	3788	WaterMark.exe	89
PID 3788 wrote to memory of 4820	3788	WaterMark.exe	89
PID 3788 wrote to memory of 4820	3788	WaterMark.exe	89
PID 3788 wrote to memory of 4820	3788	WaterMark.exe	89
PID 3788 wrote to memory of 4820	3788	WaterMark.exe	89
PID 3788 wrote to memory of 4820	3788	WaterMark.exe	89
PID 1152 wrote to memory of 4060	1152	WaterMark.exe	96
PID 1152 wrote to memory of 4060	1152	WaterMark.exe	96
PID 1152 wrote to memory of 3344	1152	WaterMark.exe	97
PID 1152 wrote to memory of 3344	1152	WaterMark.exe	97
PID 3788 wrote to memory of 4960	3788	WaterMark.exe	98
PID 3788 wrote to memory of 4960	3788	WaterMark.exe	98
PID 3788 wrote to memory of 3160	3788	WaterMark.exe	99
PID 3788 wrote to memory of 3160	3788	WaterMark.exe	99
PID 4060 wrote to memory of 4100	4060	iexplore.exe	101
PID 4060 wrote to memory of 4100	4060	iexplore.exe	101
PID 4060 wrote to memory of 4100	4060	iexplore.exe	101
PID 3160 wrote to memory of 820	3160	iexplore.exe	103
PID 3160 wrote to memory of 820	3160	iexplore.exe	103
PID 3160 wrote to memory of 820	3160	iexplore.exe	103
PID 3344 wrote to memory of 2908	3344	iexplore.exe	102
PID 3344 wrote to memory of 2908	3344	iexplore.exe	102
PID 3344 wrote to memory of 2908	3344	iexplore.exe	102
PID 4960 wrote to memory of 556	4960	iexplore.exe	104
PID 4960 wrote to memory of 556	4960	iexplore.exe	104
PID 4960 wrote to memory of 556	4960	iexplore.exe	104

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8342585e9eee1b1911992068dfa8f5dd1b9e1548f1f81d726ddb5f1442b5009dN.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3156
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8342585e9eee1b1911992068dfa8f5dd1b9e1548f1f81d726ddb5f1442b5009dN.dll,#1
  2⤵
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4280
- - C:\Windows\SysWOW64\rundll32mgr.exe
    C:\Windows\SysWOW64\rundll32mgr.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of UnmapMainImage
    - Suspicious use of WriteProcessMemory
    PID:1652
  - - C:\Windows\SysWOW64\rundll32mgrmgr.exe
      C:\Windows\SysWOW64\rundll32mgrmgr.exe
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious use of UnmapMainImage
      Suspicious use of WriteProcessMemory
      PID:2120
    - - C:\Program Files (x86)\Microsoft\WaterMark.exe
        
        "C:\Program Files (x86)\Microsoft\WaterMark.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of UnmapMainImage
        Suspicious use of WriteProcessMemory
        
        PID:1152
      - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        6⤵
        
        PID:5064
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 204
        7⤵
        Program crash
        
        PID:2424
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4060
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4060 CREDAT:17410 /prefetch:2
        7⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:4100
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3344
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3344 CREDAT:17410 /prefetch:2
        7⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2908
  - - C:\Program Files (x86)\Microsoft\WaterMark.exe
      "C:\Program Files (x86)\Microsoft\WaterMark.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of UnmapMainImage
      Suspicious use of WriteProcessMemory
      PID:3788
    - - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        5⤵
        
        PID:4820
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 204
        6⤵
        Program crash
        
        PID:2400
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4960
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4960 CREDAT:17410 /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:556
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3160
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3160 CREDAT:17410 /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 5064 -ip 5064
1⤵
PID:2288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4820 -ip 4820
1⤵
PID:5040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
ec237169ada59f1945749967a6d3d7f0

SHA1
e8fe32e8fa527409463d3fa0d63b6bdf709d7bd6

SHA256
b783f55456ca301f00aab79b6a0720bfb2450aefd094e6026231fab663152d70

SHA512
d5b5bff9f6afb36817c2c556e67c4ed7fc787a51bef623eb7150b596cc4cc88bee4b10b5eccae2c2ed0055653166f68bf75f2375ce4689666eb42330361de2d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
6406ca5522987d68f1bd15861539b5bf

SHA1
e8e9c4904865b0021ac3eb788f435fb3bfbe613a

SHA256
1e85bdf7d4ac569266a3d2e2579d0e7bcbd8078d02063e00e72e4535b3b17a35

SHA512
cb0f4391da5bcd734de49d6e967fd412b119646ecacafb7ecf58a2f54609b8e293c8f322b8020107cdd3c338e015e892519c3406e8ea0da9ac7feb6a4c36fb90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
5f7c4fc2628455d87e20b279532c4004

SHA1
49954805a23aa55d328f2150ac25e07c5c72b162

SHA256
ab9ba831aae5b248e022d081f2d48eb79e6e0e9e34a67257ecece2fa9b988b54

SHA512
2f526b54ecd79fdf1a15d8dd3899c4cff455a537fcffb5fb1ba7eb4fcd6e4608a054b1fc4c2c99ed75f9a1ea9d0cf909097f1ac009c908766a140c841113dd0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{91387A7C-BC46-11EF-BDBF-FAA11E730504}.dat

Filesize
5KB

MD5
39261e822e88bd7fd2cb4adda887e3b1

SHA1
0c5d656802cc37e026ad6ceb60f3223d32fd4e66

SHA256
117bd67f3628569c680e6941ea53b21056079ce7caff5a4deab185dfb58fda9f

SHA512
56618f5fea9bbac150a68f5fe3ab7e25dc5c72ce710a9c51fcaa4888faa866f3db8393034744db6237b34b2323ae32849dd30107c82b9bb98c7245a6be2b7dd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{913D3F74-BC46-11EF-BDBF-FAA11E730504}.dat

Filesize
4KB

MD5
800ff16624a9514d730b29499ca35960

SHA1
89ee6082bbcf9266552a6cbca37a221b127d22db

SHA256
7b5795d07f18e08a8317c884f5a1447d09d4e09932fab554bf4ea96586f17bc9

SHA512
a1d1269a401b4f2112a63025f2f483e44976fdeefdab66c40696adbecac558c23148f9bb81ac920241d12f9058f524b81ebd5f88597e0b2f5f2b09fc23f1ba17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{913D3F74-BC46-11EF-BDBF-FAA11E730504}.dat

Filesize
3KB

MD5
62a0a53b37e205e5858e4d31d04175ab

SHA1
aae3bcfa800ba3bac0eeec059d2af9d52e01cd1b

SHA256
d78e5ea67976deb005b2b0cd43fcf91aa0b9e519f229ede62782f47017e0107b

SHA512
19546cfc134ad3e0a369111167ec72dbdadbf76fe6698434768292eab3256dc7268d84ce10814c2b3ee74b5ca62d1c20fe8f48ffdb2cd91f1659463873ed5e52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{913FA19D-BC46-11EF-BDBF-FAA11E730504}.dat

Filesize
5KB

MD5
f0952809f318e2a49410a57335df4666

SHA1
4510c96399fda9841fac0a8896f8d5c08f681c1f

SHA256
36098a58f52ad6561eab71f7e4495f45be68c5f40d868adc28c274a251201b3a

SHA512
1e1ef7364d8a27077d57c8a3df52eae0e7cf91a79124462d04a53dfbd634be1cac113932aa0c3d1516fc2119f2fa66b4bd43ed01ddebe967168f6468c538b573

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver3B3F.tmp

Filesize
15KB

MD5
1a545d0052b581fbb2ab4c52133846bc

SHA1
62f3266a9b9925cd6d98658b92adec673cbe3dd3

SHA256
557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

SHA512
bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6IJLDY7V\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
288KB

MD5
7ad8b248824fb32c2994128f02025872

SHA1
e909d655af544419bfb1f9057f3f4aae5ab3f6ad

SHA256
64d9e990eb96059ac2ea6d0853bf07b0c3499214e09854ac24f6b1f2688a1d66

SHA512
f18a946f015ecd3e1f5694a72efbef3111c6c259ef9206f84d3c01ee6804fdc51fb052914143bc24e39583753d6bf15bc0dd9c1b4d5cc607f452cd0a79ced085

Download Submit
C:\Windows\SysWOW64\rundll32mgrmgr.exe

Filesize
143KB

MD5
963056968f712dce49fed780756eafa3

SHA1
1f833526e877d34bda4b7aad52be1b52f25c9bf2

SHA256
be71c16ee9e9ea295cf6f266ddf343c4589843e4288a09f60f9e15923d8f8313

SHA512
8ff2bd3c17e6a8730940dcc45faa600c5429a1e5e812821350d8c6448ddcc1526f5246608b5a56592276b15a821a78440adf05652c7dfb2b0016707dce9c958e

Download Submit
memory/1152-63-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1152-62-0x0000000000070000-0x0000000000071000-memory.dmp

Filesize
4KB

Download
memory/1152-72-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1152-67-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1152-65-0x00000000779D2000-0x00000000779D3000-memory.dmp

Filesize
4KB

Download
memory/1152-55-0x00000000779D2000-0x00000000779D3000-memory.dmp

Filesize
4KB

Download
memory/1152-54-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1152-50-0x0000000000060000-0x0000000000061000-memory.dmp

Filesize
4KB

Download
memory/1152-61-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1152-36-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1152-37-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1652-19-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1652-5-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1652-28-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1652-20-0x00000000008E0000-0x00000000008E1000-memory.dmp

Filesize
4KB

Download
memory/2120-27-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2120-12-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2120-18-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2120-10-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2120-11-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2120-23-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2120-22-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3788-53-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/3788-56-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3788-64-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4280-0-0x0000000005000000-0x00000000050F2000-memory.dmp

Filesize
968KB

Download
memory/5064-59-0x0000000000D20000-0x0000000000D21000-memory.dmp

Filesize
4KB

Download
memory/5064-60-0x0000000000CF0000-0x0000000000CF1000-memory.dmp

Filesize
4KB

Download