Analysis

  • max time kernel
    93s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-12-2024 11:14

General

  • Target

    e8e36758a1ec616c9def821e19d32ade432bae0edca9d441aa23c3afdbed8556.exe

  • Size

    101KB

  • MD5

    2605e3c1d5bfd029d9a889fba45367c9

  • SHA1

    2637e38242ebabaeef42befd29f985f4f4b4cf0e

  • SHA256

    e8e36758a1ec616c9def821e19d32ade432bae0edca9d441aa23c3afdbed8556

  • SHA512

    6aeeefb6eda0fcee6345b38a37cf7fbf0d19fe94d0111d2719c735449a140415eecb0575c6f9f35dede1952eb8484b896f23f4809813861b7fa092271db389e2

  • SSDEEP

    3072:y/BI4QbZiKLq6RObXUKk6Ztd2/v0PFk8jwaaHw7Koj4rePE:eOXYKeqoE/v0K

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Ramnit family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 38 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e8e36758a1ec616c9def821e19d32ade432bae0edca9d441aa23c3afdbed8556.exe
    "C:\Users\Admin\AppData\Local\Temp\e8e36758a1ec616c9def821e19d32ade432bae0edca9d441aa23c3afdbed8556.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2912
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\system32\svchost.exe
      2⤵
        PID:4324
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 204
          3⤵
          • Program crash
          PID:1420
      • C:\Program Files (x86)\Internet Explorer\iexplore.exe
        "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3308
        • C:\Program Files\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
          3⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:228
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:228 CREDAT:17410 /prefetch:2
            4⤵
            • System Location Discovery: System Language Discovery
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:2356
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:228 CREDAT:17416 /prefetch:2
            4⤵
            • System Location Discovery: System Language Discovery
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:1172
      • C:\Windows\SysWOW64\svchost.exe
        C:\Windows\system32\svchost.exe
        2⤵
          PID:1264
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1264 -s 204
            3⤵
            • Program crash
            PID:4940
        • C:\Program Files (x86)\Internet Explorer\iexplore.exe
          "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2528
          • C:\Program Files\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
            3⤵
            • Modifies Internet Explorer settings
            PID:3860
        • C:\Users\Admin\AppData\Local\Temp\kmpograaunjdpewt.exe
          "C:\Users\Admin\AppData\Local\Temp\kmpograaunjdpewt.exe"
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:3628
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4324 -ip 4324
        1⤵
          PID:4508
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1264 -ip 1264
          1⤵
            PID:1084

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

            Filesize

            471B

            MD5

            641fd00a680e2a2b7c46da9f49d4ac01

            SHA1

            91342c03f46164a5ffba758b6201387912e09026

            SHA256

            69b70d73aed768e709b4e26268d4bfbb349d3ed2d7fc7bba042a347b29f1062d

            SHA512

            004e47e9e0623bf782ad71418257088902bec47d213027287c46393d7a413d69a69fd213df1781d3c49ddde689943d5c5f3ff844fb9cc81c7eeaf331b8a4344f

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

            Filesize

            404B

            MD5

            f9826549664d6d582aae17383a6aacc4

            SHA1

            18781e116235e19df6f84f11e148dbb8ff5f04a8

            SHA256

            592596eebee0e8f504bff9117e580b5019d1969cb577efc9fa5c5755dfa12a98

            SHA512

            00d4458a70a8e47607597dee892b78a69ef2d181856284fb671fd0817f6f050fdbe955716c8296b7afd83910fafa1d1a8c60f8f202356e73087b69afabb86723

          • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver7BB.tmp

            Filesize

            15KB

            MD5

            1a545d0052b581fbb2ab4c52133846bc

            SHA1

            62f3266a9b9925cd6d98658b92adec673cbe3dd3

            SHA256

            557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

            SHA512

            bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0GUUC90F\suggestions[1].en-US

            Filesize

            17KB

            MD5

            5a34cb996293fde2cb7a4ac89587393a

            SHA1

            3c96c993500690d1a77873cd62bc639b3a10653f

            SHA256

            c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

            SHA512

            e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

          • C:\Users\Admin\AppData\Local\Temp\kmpograaunjdpewt.exe

            Filesize

            101KB

            MD5

            2605e3c1d5bfd029d9a889fba45367c9

            SHA1

            2637e38242ebabaeef42befd29f985f4f4b4cf0e

            SHA256

            e8e36758a1ec616c9def821e19d32ade432bae0edca9d441aa23c3afdbed8556

            SHA512

            6aeeefb6eda0fcee6345b38a37cf7fbf0d19fe94d0111d2719c735449a140415eecb0575c6f9f35dede1952eb8484b896f23f4809813861b7fa092271db389e2

          • memory/2912-18-0x0000000000400000-0x0000000000439F88-memory.dmp

            Filesize

            231KB

          • memory/2912-19-0x0000000000400000-0x0000000000439F88-memory.dmp

            Filesize

            231KB

          • memory/2912-1-0x0000000000400000-0x000000000043A000-memory.dmp

            Filesize

            232KB

          • memory/2912-10-0x0000000000400000-0x000000000043A000-memory.dmp

            Filesize

            232KB

          • memory/2912-11-0x0000000000400000-0x0000000000439F88-memory.dmp

            Filesize

            231KB

          • memory/2912-17-0x00000000779C2000-0x00000000779C3000-memory.dmp

            Filesize

            4KB

          • memory/2912-13-0x0000000000400000-0x0000000000439F88-memory.dmp

            Filesize

            231KB

          • memory/2912-0-0x0000000000400000-0x0000000000439F88-memory.dmp

            Filesize

            231KB

          • memory/2912-20-0x00000000779C2000-0x00000000779C3000-memory.dmp

            Filesize

            4KB

          • memory/2912-42-0x0000000000400000-0x000000000043A000-memory.dmp

            Filesize

            232KB

          • memory/2912-6-0x0000000000400000-0x0000000000439F88-memory.dmp

            Filesize

            231KB

          • memory/2912-5-0x0000000000620000-0x0000000000621000-memory.dmp

            Filesize

            4KB

          • memory/2912-4-0x0000000000610000-0x0000000000611000-memory.dmp

            Filesize

            4KB

          • memory/2912-2-0x0000000000400000-0x0000000000439F88-memory.dmp

            Filesize

            231KB

          • memory/3628-43-0x0000000000400000-0x0000000000439F88-memory.dmp

            Filesize

            231KB

          • memory/3628-48-0x0000000000400000-0x000000000043A000-memory.dmp

            Filesize

            232KB

          • memory/3628-47-0x0000000000400000-0x0000000000439F88-memory.dmp

            Filesize

            231KB

          • memory/4324-9-0x0000000001000000-0x0000000001001000-memory.dmp

            Filesize

            4KB

          • memory/4324-8-0x0000000001020000-0x0000000001021000-memory.dmp

            Filesize

            4KB