ramnit | 2fec01b525f5884324e0744f1993697374937b895e4ebe1bb1655358324de310

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19-12-2024 23:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2fec01b525f5884324e0744f1993697374937b895e4ebe1bb1655358324de310N.dll
Size

572KB
MD5

a2bf52e69d03022587048ded8c1f04e0
SHA1

3debde763cb1261a3c7e6a75aff112a7e88335e7
SHA256

2fec01b525f5884324e0744f1993697374937b895e4ebe1bb1655358324de310
SHA512

555be4baa99225b877570a829c991dd76fd33abeec9c70671a48bb6afc70194eeb39b3171faae4671b501f2656c3a351d27f2dd02b11e6e5f52bc83b911dea9a
SSDEEP

12288:cehnaNPpSVZmNxRCwnwm3W3OHIIf521eZ:ceh0PpS6NxNnwYeOHX3

Score

10^/10

ramnit banker discovery persistence spyware stealer trojan upx worm

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe"	svchost.exe

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Ramnit family
ramnit

Executes dropped EXE 2 IoCs

pid	Process
2448	rundll32mgr.exe
1300	WaterMark.exe

Loads dropped DLL 4 IoCs

pid	Process
2096	rundll32.exe
2096	rundll32.exe
2448	rundll32mgr.exe
2448	rundll32mgr.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe
File created	C:\Windows\SysWOW64\dmlconf.dat	svchost.exe
File opened for modification	C:\Windows\SysWOW64\dmlconf.dat	svchost.exe

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2448-15-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2448-14-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2448-13-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2448-18-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2448-20-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2448-17-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2448-12-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1300-39-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1300-35-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/1300-82-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1300-669-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.Printing.resources.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Runtime.Serialization.dll	svchost.exe
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	rundll32mgr.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\PresentationFramework.resources.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jfxmedia.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\ReachFramework.resources.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\UIAutomationClient.resources.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Services.Client.resources.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.DynamicData.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libsmf_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\msvcr100.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Net.Resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libopus_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libchorus_flanger_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Journal\NBMapTIP.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\WindowsAccessBridge-64.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\dtplugin\deployJava1.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\verify.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\misc\libfingerprinter_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm	svchost.exe
File opened for modification	C:\Program Files\Internet Explorer\jsdbgui.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\epl-v10.html	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Services.Design.resources.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\kcms.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\license.html	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Services.Design.resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_duplicate_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\oledb32.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\jvm.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\verify.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\license.html	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libripple_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\java.exe	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\PresentationBuildTasks.resources.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Activities.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.VisualC.STLCLR.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libttml_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libmpgv_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\visualization\libprojectm_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\DVD Maker\OmdProject.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dcpr.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh.htm	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\plugin2\msvcr100.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\policytool.exe	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\misc\libaddonsfsstorage_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpeg4video_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_output\libvdummy_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Journal\NBDoc.DLL	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\deploy.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationProvider.resources.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm	svchost.exe
File opened for modification	C:\Program Files\DVD Maker\WMM2CLIP.dll	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.IdentityModel.Resources.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\oledb32r.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Web.Entity.Design.Resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libavcodec_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libpsychedelic_plugin.dll	svchost.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1060	2096	WerFault.exe	30

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32mgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaterMark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
1300	WaterMark.exe
1300	WaterMark.exe
1300	WaterMark.exe
1300	WaterMark.exe
1300	WaterMark.exe
1300	WaterMark.exe
1300	WaterMark.exe
1300	WaterMark.exe
2664	svchost.exe
2664	svchost.exe
2664	svchost.exe
2664	svchost.exe
2664	svchost.exe
2664	svchost.exe
2664	svchost.exe
2664	svchost.exe
2664	svchost.exe
2664	svchost.exe
2664	svchost.exe
2664	svchost.exe
2664	svchost.exe
2664	svchost.exe
2664	svchost.exe
2664	svchost.exe
2664	svchost.exe
2664	svchost.exe
2664	svchost.exe
2664	svchost.exe
2664	svchost.exe
2664	svchost.exe
2664	svchost.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1300	WaterMark.exe
Token: SeDebugPrivilege	2664	svchost.exe
Token: SeDebugPrivilege	2096	rundll32.exe
Token: SeDebugPrivilege	1060	WerFault.exe
Token: SeDebugPrivilege	1300	WaterMark.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2448	rundll32mgr.exe
1300	WaterMark.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 2096	2032	rundll32.exe	30
PID 2032 wrote to memory of 2096	2032	rundll32.exe	30
PID 2032 wrote to memory of 2096	2032	rundll32.exe	30
PID 2032 wrote to memory of 2096	2032	rundll32.exe	30
PID 2032 wrote to memory of 2096	2032	rundll32.exe	30
PID 2032 wrote to memory of 2096	2032	rundll32.exe	30
PID 2032 wrote to memory of 2096	2032	rundll32.exe	30
PID 2096 wrote to memory of 2448	2096	rundll32.exe	31
PID 2096 wrote to memory of 2448	2096	rundll32.exe	31
PID 2096 wrote to memory of 2448	2096	rundll32.exe	31
PID 2096 wrote to memory of 2448	2096	rundll32.exe	31
PID 2096 wrote to memory of 1060	2096	rundll32.exe	32
PID 2096 wrote to memory of 1060	2096	rundll32.exe	32
PID 2096 wrote to memory of 1060	2096	rundll32.exe	32
PID 2096 wrote to memory of 1060	2096	rundll32.exe	32
PID 2448 wrote to memory of 1300	2448	rundll32mgr.exe	33
PID 2448 wrote to memory of 1300	2448	rundll32mgr.exe	33
PID 2448 wrote to memory of 1300	2448	rundll32mgr.exe	33
PID 2448 wrote to memory of 1300	2448	rundll32mgr.exe	33
PID 1300 wrote to memory of 2820	1300	WaterMark.exe	34
PID 1300 wrote to memory of 2820	1300	WaterMark.exe	34
PID 1300 wrote to memory of 2820	1300	WaterMark.exe	34
PID 1300 wrote to memory of 2820	1300	WaterMark.exe	34
PID 1300 wrote to memory of 2820	1300	WaterMark.exe	34
PID 1300 wrote to memory of 2820	1300	WaterMark.exe	34
PID 1300 wrote to memory of 2820	1300	WaterMark.exe	34
PID 1300 wrote to memory of 2820	1300	WaterMark.exe	34
PID 1300 wrote to memory of 2820	1300	WaterMark.exe	34
PID 1300 wrote to memory of 2820	1300	WaterMark.exe	34
PID 1300 wrote to memory of 2664	1300	WaterMark.exe	35
PID 1300 wrote to memory of 2664	1300	WaterMark.exe	35
PID 1300 wrote to memory of 2664	1300	WaterMark.exe	35
PID 1300 wrote to memory of 2664	1300	WaterMark.exe	35
PID 1300 wrote to memory of 2664	1300	WaterMark.exe	35
PID 1300 wrote to memory of 2664	1300	WaterMark.exe	35
PID 1300 wrote to memory of 2664	1300	WaterMark.exe	35
PID 1300 wrote to memory of 2664	1300	WaterMark.exe	35
PID 1300 wrote to memory of 2664	1300	WaterMark.exe	35
PID 1300 wrote to memory of 2664	1300	WaterMark.exe	35
PID 2664 wrote to memory of 256	2664	svchost.exe	1
PID 2664 wrote to memory of 256	2664	svchost.exe	1
PID 2664 wrote to memory of 256	2664	svchost.exe	1
PID 2664 wrote to memory of 256	2664	svchost.exe	1
PID 2664 wrote to memory of 256	2664	svchost.exe	1
PID 2664 wrote to memory of 332	2664	svchost.exe	2
PID 2664 wrote to memory of 332	2664	svchost.exe	2
PID 2664 wrote to memory of 332	2664	svchost.exe	2
PID 2664 wrote to memory of 332	2664	svchost.exe	2
PID 2664 wrote to memory of 332	2664	svchost.exe	2
PID 2664 wrote to memory of 384	2664	svchost.exe	3
PID 2664 wrote to memory of 384	2664	svchost.exe	3
PID 2664 wrote to memory of 384	2664	svchost.exe	3
PID 2664 wrote to memory of 384	2664	svchost.exe	3
PID 2664 wrote to memory of 384	2664	svchost.exe	3
PID 2664 wrote to memory of 396	2664	svchost.exe	4
PID 2664 wrote to memory of 396	2664	svchost.exe	4
PID 2664 wrote to memory of 396	2664	svchost.exe	4
PID 2664 wrote to memory of 396	2664	svchost.exe	4
PID 2664 wrote to memory of 396	2664	svchost.exe	4
PID 2664 wrote to memory of 432	2664	svchost.exe	5
PID 2664 wrote to memory of 432	2664	svchost.exe	5
PID 2664 wrote to memory of 432	2664	svchost.exe	5
PID 2664 wrote to memory of 432	2664	svchost.exe	5
PID 2664 wrote to memory of 432	2664	svchost.exe	5

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe
1⤵
PID:256

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:332

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:384
- C:\Windows\system32\services.exe
  C:\Windows\system32\services.exe
  2⤵
  PID:476
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    3⤵
    PID:616
  - - C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
      4⤵
      PID:1228
  - - C:\Windows\system32\wbem\wmiprvse.exe
      C:\Windows\system32\wbem\wmiprvse.exe
      4⤵
      PID:1748
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    3⤵
    PID:696
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    3⤵
    PID:768
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    3⤵
    PID:832
  - - C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      4⤵
      PID:1176
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    3⤵
    PID:860
  - - C:\Windows\system32\wbem\WMIADAP.EXE
      wmiadap.exe /F /T /R
      4⤵
      PID:2644
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService
    3⤵
    PID:980
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    3⤵
    PID:272
- - C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    3⤵
    PID:556
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    3⤵
    PID:1076
- - C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    3⤵
    PID:1124
- - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
    "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
    3⤵
    PID:1612
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    3⤵
    PID:2236
- - C:\Windows\system32\sppsvc.exe
    C:\Windows\system32\sppsvc.exe
    3⤵
    PID:1632
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:492
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:500

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:396

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:432

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1272
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2fec01b525f5884324e0744f1993697374937b895e4ebe1bb1655358324de310N.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2032
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\2fec01b525f5884324e0744f1993697374937b895e4ebe1bb1655358324de310N.dll,#1
    3⤵
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2096
  - - C:\Windows\SysWOW64\rundll32mgr.exe
      C:\Windows\SysWOW64\rundll32mgr.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious use of UnmapMainImage
      Suspicious use of WriteProcessMemory
      PID:2448
    - - C:\Program Files (x86)\Microsoft\WaterMark.exe
        
        "C:\Program Files (x86)\Microsoft\WaterMark.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of UnmapMainImage
        Suspicious use of WriteProcessMemory
        
        PID:1300
      - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        6⤵
        Modifies WinLogon for persistence
        Drops file in System32 directory
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        
        PID:2820
      - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2664
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 224
      4⤵
      Program crash
      Suspicious use of AdjustPrivilegeToken
      PID:1060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

Filesize
391KB

MD5
067fdb52652dbbe9a116429e6f0a090e

SHA1
fc63e4988f14e12cd2bccc56da00a67183a6051a

SHA256
03ef340c1a57b326926b2321897fc84df3a87168b2fde98ef3269b70ac490e85

SHA512
3f57d287ce858a02a4839ff5fa85abf8ee9a81e92f23f3cc95e147fdd5b5bb8c27e1a2629dd66e6a246c29224ed2010df66e0c149687a06b69e7f39a65e28ce6

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

Filesize
387KB

MD5
a978c970e86e7a736d50f30051e35dc5

SHA1
7ea935a6acf078b6671f3e8300ca2ef601349a83

SHA256
7e005c9dc9270b35e3e767e617fcdc48d4a1925ac99f25d54494fff3c946b25a

SHA512
285b91cae95c123b5fe48d3c0fd62ffa664be7e29433c7b06049acd10e36a42c4366d62f11e5eaf64fd738e5d2d6c338fbe344c4459197726c34eeb43708efc8

Download Submit
C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
189KB

MD5
5c01bad70f6d4434471c4eb49ad498e2

SHA1
6abb1fd9c995f998b1b2adfb62bf4b8282085042

SHA256
ab06d72b495fb595aa0b0a2f0311cfd3d66b46e3d3ce98cd70c6f098d8fe66b9

SHA512
99dacc5410c59d58b7c18a9c3f5633ca7d03440692afcb9b39474d55a9e61b5cc3f1a972698c880041b3ee43fb030f6f963487a5469becb9e71bbf5778daf36e

Download Submit
memory/1300-43-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/1300-41-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/1300-82-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1300-42-0x0000000077A5F000-0x0000000077A60000-memory.dmp

Filesize
4KB

Download
memory/1300-35-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1300-71-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1300-92-0x0000000077A5F000-0x0000000077A60000-memory.dmp

Filesize
4KB

Download
memory/1300-39-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1300-669-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2096-5-0x0000000000180000-0x00000000001CB000-memory.dmp

Filesize
300KB

Download
memory/2096-406-0x0000000010000000-0x0000000010091000-memory.dmp

Filesize
580KB

Download
memory/2096-1-0x0000000010000000-0x0000000010091000-memory.dmp

Filesize
580KB

Download
memory/2096-2-0x0000000010000000-0x0000000010091000-memory.dmp

Filesize
580KB

Download
memory/2448-15-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2448-12-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2448-17-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2448-20-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2448-18-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2448-13-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2448-14-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2448-16-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/2448-11-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2664-94-0x0000000077A60000-0x0000000077A61000-memory.dmp

Filesize
4KB

Download
memory/2664-93-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2664-89-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2664-73-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2664-87-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2664-83-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2664-90-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2664-88-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/2664-91-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/2820-63-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2820-55-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2820-67-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2820-68-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2820-61-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/2820-403-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2820-53-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/2820-54-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2820-44-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2820-46-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download