ramnit | 0e6db7f6387713d786d15c08cb2e0cfd2cdb2099bcf1fa8cbfc90304966f6329

Analysis

max time kernel
120s
max time network
87s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
19-12-2024 23:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e6db7f6387713d786d15c08cb2e0cfd2cdb2099bcf1fa8cbfc90304966f6329N.dll
Size

530KB
MD5

a2e9e7bbf7c82296ee9e02d0fe8b8870
SHA1

3deafd8834ffd901bf65d62ee9b4d9ec229a1143
SHA256

0e6db7f6387713d786d15c08cb2e0cfd2cdb2099bcf1fa8cbfc90304966f6329
SHA512

fc0984439f82538aab23c69911e39fbb69be524c7014440c28c7618160fe6055e05578d5de5e0a0cc236c3be9790cd2f9cdc408a2c08aa9dd20d49f486ae6439
SSDEEP

12288:ch8fZLyb9PzVMBC/HVMOp4PkxHLCYwZckMQMNyZanD:c8F+Pzr/Hfp4MIYwZckMQmyGD

Score

10^/10

ramnit banker discovery persistence spyware stealer trojan upx worm

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe"	svchost.exe

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Ramnit family
ramnit

Executes dropped EXE 2 IoCs

pid	Process
3032	rundll32mgr.exe
2964	WaterMark.exe

Loads dropped DLL 4 IoCs

pid	Process
2340	rundll32.exe
2340	rundll32.exe
3032	rundll32mgr.exe
3032	rundll32mgr.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe
File created	C:\Windows\SysWOW64\dmlconf.dat	svchost.exe
File opened for modification	C:\Windows\SysWOW64\dmlconf.dat	svchost.exe

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2964-42-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/3032-22-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/3032-20-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/3032-19-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/3032-16-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/3032-15-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/3032-14-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2964-37-0x0000000000400000-0x0000000000439000-memory.dmp	upx
behavioral1/memory/2964-36-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2964-84-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2964-611-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\Microsoft.Ink.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Net.Resources.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Defender\MpCommu.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libmirror_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\InkObj.dll	svchost.exe
File opened for modification	C:\Program Files\DVD Maker\WMM2CLIP.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe	svchost.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\NPAUTHZ.DLL	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libdemuxdump_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\WindowsAccessBridge-64.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_asf_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libgradient_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\plugin2\msvcr100.dll	svchost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\api-ms-win-core-processthreads-l1-1-1.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\librtp_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libflac_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpeg4audio_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_rgb_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL	svchost.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\msadco.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.Speech.resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_wav_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\keystore\libmemory_keystore_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Web.Entity.Design.Resources.dll	svchost.exe
File opened for modification	C:\Program Files\ExportCompare.htm	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jli.dll	svchost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\api-ms-win-core-file-l2-1-0.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationCore.resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libgaussianblur_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\visualization\libvisual_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOInstallerUI.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\ssvagent.exe	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Runtime.Serialization.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_udp_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\api-ms-win-core-file-l1-2-0.dll	svchost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.ServiceModel.Resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\control\libwin_msg_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\w2k_lsa_auth.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\java-rmi.exe	svchost.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\PurblePlace2.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\librawaud_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_copy_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_hevc_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\TableTextService.dll	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\JdbcOdbc.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_dts_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Internet Explorer\F12.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\mlib_image.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libwasapi_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libwav_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libmagnify_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_output\libvmem_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Journal\jnwdui.dll	svchost.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\micaut.dll	svchost.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32mgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaterMark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
2964	WaterMark.exe
2964	WaterMark.exe
2964	WaterMark.exe
2964	WaterMark.exe
2964	WaterMark.exe
2964	WaterMark.exe
2964	WaterMark.exe
2964	WaterMark.exe
1324	svchost.exe
1324	svchost.exe
1324	svchost.exe
1324	svchost.exe
1324	svchost.exe
1324	svchost.exe
1324	svchost.exe
1324	svchost.exe
1324	svchost.exe
1324	svchost.exe
1324	svchost.exe
1324	svchost.exe
1324	svchost.exe
1324	svchost.exe
1324	svchost.exe
1324	svchost.exe
1324	svchost.exe
1324	svchost.exe
1324	svchost.exe
1324	svchost.exe
1324	svchost.exe
1324	svchost.exe
1324	svchost.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2964	WaterMark.exe
Token: SeDebugPrivilege	1324	svchost.exe
Token: SeDebugPrivilege	2964	WaterMark.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3032	rundll32mgr.exe
2964	WaterMark.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2340	2336	rundll32.exe	29
PID 2336 wrote to memory of 2340	2336	rundll32.exe	29
PID 2336 wrote to memory of 2340	2336	rundll32.exe	29
PID 2336 wrote to memory of 2340	2336	rundll32.exe	29
PID 2336 wrote to memory of 2340	2336	rundll32.exe	29
PID 2336 wrote to memory of 2340	2336	rundll32.exe	29
PID 2336 wrote to memory of 2340	2336	rundll32.exe	29
PID 2340 wrote to memory of 3032	2340	rundll32.exe	30
PID 2340 wrote to memory of 3032	2340	rundll32.exe	30
PID 2340 wrote to memory of 3032	2340	rundll32.exe	30
PID 2340 wrote to memory of 3032	2340	rundll32.exe	30
PID 3032 wrote to memory of 2964	3032	rundll32mgr.exe	31
PID 3032 wrote to memory of 2964	3032	rundll32mgr.exe	31
PID 3032 wrote to memory of 2964	3032	rundll32mgr.exe	31
PID 3032 wrote to memory of 2964	3032	rundll32mgr.exe	31
PID 2964 wrote to memory of 2976	2964	WaterMark.exe	32
PID 2964 wrote to memory of 2976	2964	WaterMark.exe	32
PID 2964 wrote to memory of 2976	2964	WaterMark.exe	32
PID 2964 wrote to memory of 2976	2964	WaterMark.exe	32
PID 2964 wrote to memory of 2976	2964	WaterMark.exe	32
PID 2964 wrote to memory of 2976	2964	WaterMark.exe	32
PID 2964 wrote to memory of 2976	2964	WaterMark.exe	32
PID 2964 wrote to memory of 2976	2964	WaterMark.exe	32
PID 2964 wrote to memory of 2976	2964	WaterMark.exe	32
PID 2964 wrote to memory of 2976	2964	WaterMark.exe	32
PID 2964 wrote to memory of 1324	2964	WaterMark.exe	33
PID 2964 wrote to memory of 1324	2964	WaterMark.exe	33
PID 2964 wrote to memory of 1324	2964	WaterMark.exe	33
PID 2964 wrote to memory of 1324	2964	WaterMark.exe	33
PID 2964 wrote to memory of 1324	2964	WaterMark.exe	33
PID 2964 wrote to memory of 1324	2964	WaterMark.exe	33
PID 2964 wrote to memory of 1324	2964	WaterMark.exe	33
PID 2964 wrote to memory of 1324	2964	WaterMark.exe	33
PID 2964 wrote to memory of 1324	2964	WaterMark.exe	33
PID 2964 wrote to memory of 1324	2964	WaterMark.exe	33
PID 1324 wrote to memory of 256	1324	svchost.exe	1
PID 1324 wrote to memory of 256	1324	svchost.exe	1
PID 1324 wrote to memory of 256	1324	svchost.exe	1
PID 1324 wrote to memory of 256	1324	svchost.exe	1
PID 1324 wrote to memory of 256	1324	svchost.exe	1
PID 1324 wrote to memory of 332	1324	svchost.exe	2
PID 1324 wrote to memory of 332	1324	svchost.exe	2
PID 1324 wrote to memory of 332	1324	svchost.exe	2
PID 1324 wrote to memory of 332	1324	svchost.exe	2
PID 1324 wrote to memory of 332	1324	svchost.exe	2
PID 1324 wrote to memory of 380	1324	svchost.exe	3
PID 1324 wrote to memory of 380	1324	svchost.exe	3
PID 1324 wrote to memory of 380	1324	svchost.exe	3
PID 1324 wrote to memory of 380	1324	svchost.exe	3
PID 1324 wrote to memory of 380	1324	svchost.exe	3
PID 1324 wrote to memory of 388	1324	svchost.exe	4
PID 1324 wrote to memory of 388	1324	svchost.exe	4
PID 1324 wrote to memory of 388	1324	svchost.exe	4
PID 1324 wrote to memory of 388	1324	svchost.exe	4
PID 1324 wrote to memory of 388	1324	svchost.exe	4
PID 1324 wrote to memory of 416	1324	svchost.exe	5
PID 1324 wrote to memory of 416	1324	svchost.exe	5
PID 1324 wrote to memory of 416	1324	svchost.exe	5
PID 1324 wrote to memory of 416	1324	svchost.exe	5
PID 1324 wrote to memory of 416	1324	svchost.exe	5
PID 1324 wrote to memory of 472	1324	svchost.exe	6
PID 1324 wrote to memory of 472	1324	svchost.exe	6
PID 1324 wrote to memory of 472	1324	svchost.exe	6
PID 1324 wrote to memory of 472	1324	svchost.exe	6

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe
1⤵
PID:256

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:332

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:380
- C:\Windows\system32\services.exe
  C:\Windows\system32\services.exe
  2⤵
  PID:472
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    3⤵
    PID:592
  - - C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
      4⤵
      PID:1240
  - - C:\Windows\system32\wbem\wmiprvse.exe
      C:\Windows\system32\wbem\wmiprvse.exe
      4⤵
      PID:268
  - - C:\Windows\system32\wbem\wmiprvse.exe
      C:\Windows\system32\wbem\wmiprvse.exe -Embedding
      4⤵
      PID:1804
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    3⤵
    PID:676
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    3⤵
    PID:736
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    3⤵
    PID:808
  - - C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      4⤵
      PID:1152
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    3⤵
    PID:856
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService
    3⤵
    PID:968
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    3⤵
    PID:284
- - C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    3⤵
    PID:328
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    3⤵
    PID:1064
- - C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    3⤵
    PID:1096
- - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
    "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
    3⤵
    PID:1608
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    3⤵
    PID:1796
- - C:\Windows\system32\sppsvc.exe
    C:\Windows\system32\sppsvc.exe
    3⤵
    PID:1932
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:488
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:496

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:388

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:416

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1196
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e6db7f6387713d786d15c08cb2e0cfd2cdb2099bcf1fa8cbfc90304966f6329N.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2336
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e6db7f6387713d786d15c08cb2e0cfd2cdb2099bcf1fa8cbfc90304966f6329N.dll,#1
    3⤵
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2340
  - - C:\Windows\SysWOW64\rundll32mgr.exe
      C:\Windows\SysWOW64\rundll32mgr.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of UnmapMainImage
      Suspicious use of WriteProcessMemory
      PID:3032
    - - C:\Program Files (x86)\Microsoft\WaterMark.exe
        
        "C:\Program Files (x86)\Microsoft\WaterMark.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of UnmapMainImage
        Suspicious use of WriteProcessMemory
        
        PID:2964
      - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        6⤵
        Modifies WinLogon for persistence
        Drops file in System32 directory
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        
        PID:2976
      - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

Filesize
204KB

MD5
ebfad4f7b3794fdbd8881fc9cdb5b329

SHA1
3d0acd14e571372a1f43f25249cde8691b367bba

SHA256
1109df2442e7538d9609ed3b184e5c8967cb59ca829a451670bf1204e7b58022

SHA512
8d3d3e6ad01a7e8f9e2fb8ceefa7598915d8767cdcfe1dc0dc1ab0ec37d16b9a9285b9cd1f6975b3a993721b4ac2f7a80e6e3c75470501da169fb2db684fd4d8

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

Filesize
200KB

MD5
3ff058c5bd71bc55cbc9ac507715cc22

SHA1
f9cef2e3e9d959b097774c708249c715792c1459

SHA256
591c250e583c9534669f8e275c8a3a411201621e6dbf87cf68da988a31552c87

SHA512
03b7f3a8fef60d0cce88f4093b30d13bda45157e3b0a62d0d0cf69520fb90ce2573089f9a82aa754eff4bdc68b35b18d7ee00823aee14af97f69ed44a7101b50

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
95KB

MD5
c916e6d39d0731aee36304bab2a74fd8

SHA1
0ba22a85ecb0af83d99a4f1979206db4c7283696

SHA256
eeb58ccbf36dabc9fe5b4999e6110899f9410904d954029932e9f18e4db3a8c4

SHA512
71d438bd86580e99d87a2644ad654bcd2d7cd19fa85848a376aa596ed9368009c2566e044fd25c956a5b999d11d3204b57355420d42d6d6e443b5df3ec234346

Download Submit
memory/1324-95-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/1324-75-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/1324-89-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/1324-85-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/1324-91-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/1324-92-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/1324-96-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/1324-93-0x0000000077460000-0x0000000077461000-memory.dmp

Filesize
4KB

Download
memory/1324-94-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2340-9-0x0000000010000000-0x000000001008A000-memory.dmp

Filesize
552KB

Download
memory/2340-10-0x0000000010000000-0x000000001008A000-memory.dmp

Filesize
552KB

Download
memory/2340-11-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2340-0-0x0000000010000000-0x000000001008A000-memory.dmp

Filesize
552KB

Download
memory/2340-13-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2964-36-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2964-43-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/2964-73-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/2964-44-0x000000007745F000-0x0000000077460000-memory.dmp

Filesize
4KB

Download
memory/2964-611-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2964-37-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2964-90-0x000000007745F000-0x0000000077460000-memory.dmp

Filesize
4KB

Download
memory/2964-84-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2964-42-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2976-56-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2976-358-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2976-64-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2976-61-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/2976-62-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2976-57-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2976-55-0x00000000000A0000-0x00000000000A1000-memory.dmp

Filesize
4KB

Download
memory/2976-48-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2976-46-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2976-69-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/3032-14-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3032-16-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3032-18-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/3032-19-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3032-15-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3032-20-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3032-22-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3032-12-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download