ramnit | 5894443a667888c965a793a435fa274e356f75ee7bb426a2c5d383ec2cb3dd8f

Analysis

max time kernel
120s
max time network
86s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-12-2024 02:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5894443a667888c965a793a435fa274e356f75ee7bb426a2c5d383ec2cb3dd8f.dll
Size

749KB
MD5

948c1804a0575469cc49ba7c9a9b7cc9
SHA1

489973165043e4240e1523b7f49b7cf8bd3c24b5
SHA256

5894443a667888c965a793a435fa274e356f75ee7bb426a2c5d383ec2cb3dd8f
SHA512

ab322bc9116f34e4cdbb89804557f2a561d2d11890092f5a9638c853690b3338b948cee3f8157130e15a255d4616979db018a3880496bc8b84dbb3c7d2fd9c37
SSDEEP

6144:2NIQzLZN4k3WvmRPLx+xXqOkyWh9ZN/c4bsXdHtVHs7Z9UqKJ0M:2NIyZN4+Wv4PLq6Okrh9ZN/hs9DsdDC

Score

10^/10

ramnit banker discovery persistence spyware stealer trojan upx worm

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe"	svchost.exe

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Ramnit family
ramnit

Executes dropped EXE 2 IoCs

pid	Process
2680	rundll32mgr.exe
2380	WaterMark.exe

Loads dropped DLL 4 IoCs

pid	Process
2232	rundll32.exe
2232	rundll32.exe
2680	rundll32mgr.exe
2680	rundll32mgr.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe
File created	C:\Windows\SysWOW64\dmlconf.dat	svchost.exe
File opened for modification	C:\Windows\SysWOW64\dmlconf.dat	svchost.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2680-15-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2680-13-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2680-22-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2680-20-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2680-19-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2680-16-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2680-14-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2380-42-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2380-90-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2380-665-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\cpyr.htm	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libnuv_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_es_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\hprof.dll	svchost.exe
File opened for modification	C:\Program Files\Internet Explorer\msdbg2.dll	svchost.exe
File opened for modification	C:\Program Files\Internet Explorer\Timeline_is.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\awt.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Net.Resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_setid_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_transcode_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\msdaremr.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Windows.Presentation.resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libsdp_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libcache_block_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_mosaic_bridge_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\dt_socket.dll	svchost.exe
File opened for modification	C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.IdentityModel.Selectors.Resources.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Mail\wabimp.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\msdaosp.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\sqloledb.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\profilerinterface.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe	svchost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libdtv_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\services_discovery\libmediadirs_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_output\libdirect3d9_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOLoaderUI.dll	svchost.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Spades\Shvl.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_imem_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libgradient_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libpuzzle_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\j2pcsc.dll	svchost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\lgpllibs.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.Speech.resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libedgedetection_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Media Player\WMPSideShowGadget.exe	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\calendar.html	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\calendar.html	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\libGLESv2.dll	svchost.exe
File opened for modification	C:\Program Files\Internet Explorer\networkinspection.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\librist_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libmjpeg_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\UIAutomationProvider.resources.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\Microsoft.Build.Conversion.v3.5.resources.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\jp2native.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\librawdv_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationProvider.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libnsc_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libxa_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\misc\libfingerprinter_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\jvm.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.Speech.resources.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Entity.Resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\npvlc.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libsubstx3g_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Media Player\WMPMediaSharing.dll	svchost.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2704	2232	WerFault.exe	30

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32mgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaterMark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
2380	WaterMark.exe
2380	WaterMark.exe
2380	WaterMark.exe
2380	WaterMark.exe
2380	WaterMark.exe
2380	WaterMark.exe
2380	WaterMark.exe
2380	WaterMark.exe
2880	svchost.exe
2880	svchost.exe
2880	svchost.exe
2880	svchost.exe
2880	svchost.exe
2880	svchost.exe
2880	svchost.exe
2880	svchost.exe
2880	svchost.exe
2880	svchost.exe
2880	svchost.exe
2880	svchost.exe
2880	svchost.exe
2880	svchost.exe
2880	svchost.exe
2880	svchost.exe
2880	svchost.exe
2880	svchost.exe
2880	svchost.exe
2880	svchost.exe
2880	svchost.exe
2880	svchost.exe
2880	svchost.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2380	WaterMark.exe
Token: SeDebugPrivilege	2880	svchost.exe
Token: SeDebugPrivilege	2232	rundll32.exe
Token: SeDebugPrivilege	2380	WaterMark.exe
Token: SeDebugPrivilege	2704	WerFault.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2680	rundll32mgr.exe
2380	WaterMark.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2232	2168	rundll32.exe	30
PID 2168 wrote to memory of 2232	2168	rundll32.exe	30
PID 2168 wrote to memory of 2232	2168	rundll32.exe	30
PID 2168 wrote to memory of 2232	2168	rundll32.exe	30
PID 2168 wrote to memory of 2232	2168	rundll32.exe	30
PID 2168 wrote to memory of 2232	2168	rundll32.exe	30
PID 2168 wrote to memory of 2232	2168	rundll32.exe	30
PID 2232 wrote to memory of 2680	2232	rundll32.exe	31
PID 2232 wrote to memory of 2680	2232	rundll32.exe	31
PID 2232 wrote to memory of 2680	2232	rundll32.exe	31
PID 2232 wrote to memory of 2680	2232	rundll32.exe	31
PID 2232 wrote to memory of 2704	2232	rundll32.exe	32
PID 2232 wrote to memory of 2704	2232	rundll32.exe	32
PID 2232 wrote to memory of 2704	2232	rundll32.exe	32
PID 2232 wrote to memory of 2704	2232	rundll32.exe	32
PID 2680 wrote to memory of 2380	2680	rundll32mgr.exe	33
PID 2680 wrote to memory of 2380	2680	rundll32mgr.exe	33
PID 2680 wrote to memory of 2380	2680	rundll32mgr.exe	33
PID 2680 wrote to memory of 2380	2680	rundll32mgr.exe	33
PID 2380 wrote to memory of 2516	2380	WaterMark.exe	34
PID 2380 wrote to memory of 2516	2380	WaterMark.exe	34
PID 2380 wrote to memory of 2516	2380	WaterMark.exe	34
PID 2380 wrote to memory of 2516	2380	WaterMark.exe	34
PID 2380 wrote to memory of 2516	2380	WaterMark.exe	34
PID 2380 wrote to memory of 2516	2380	WaterMark.exe	34
PID 2380 wrote to memory of 2516	2380	WaterMark.exe	34
PID 2380 wrote to memory of 2516	2380	WaterMark.exe	34
PID 2380 wrote to memory of 2516	2380	WaterMark.exe	34
PID 2380 wrote to memory of 2516	2380	WaterMark.exe	34
PID 2380 wrote to memory of 2880	2380	WaterMark.exe	35
PID 2380 wrote to memory of 2880	2380	WaterMark.exe	35
PID 2380 wrote to memory of 2880	2380	WaterMark.exe	35
PID 2380 wrote to memory of 2880	2380	WaterMark.exe	35
PID 2380 wrote to memory of 2880	2380	WaterMark.exe	35
PID 2380 wrote to memory of 2880	2380	WaterMark.exe	35
PID 2380 wrote to memory of 2880	2380	WaterMark.exe	35
PID 2380 wrote to memory of 2880	2380	WaterMark.exe	35
PID 2380 wrote to memory of 2880	2380	WaterMark.exe	35
PID 2380 wrote to memory of 2880	2380	WaterMark.exe	35
PID 2880 wrote to memory of 256	2880	svchost.exe	1
PID 2880 wrote to memory of 256	2880	svchost.exe	1
PID 2880 wrote to memory of 256	2880	svchost.exe	1
PID 2880 wrote to memory of 256	2880	svchost.exe	1
PID 2880 wrote to memory of 256	2880	svchost.exe	1
PID 2880 wrote to memory of 332	2880	svchost.exe	2
PID 2880 wrote to memory of 332	2880	svchost.exe	2
PID 2880 wrote to memory of 332	2880	svchost.exe	2
PID 2880 wrote to memory of 332	2880	svchost.exe	2
PID 2880 wrote to memory of 332	2880	svchost.exe	2
PID 2880 wrote to memory of 384	2880	svchost.exe	3
PID 2880 wrote to memory of 384	2880	svchost.exe	3
PID 2880 wrote to memory of 384	2880	svchost.exe	3
PID 2880 wrote to memory of 384	2880	svchost.exe	3
PID 2880 wrote to memory of 384	2880	svchost.exe	3
PID 2880 wrote to memory of 396	2880	svchost.exe	4
PID 2880 wrote to memory of 396	2880	svchost.exe	4
PID 2880 wrote to memory of 396	2880	svchost.exe	4
PID 2880 wrote to memory of 396	2880	svchost.exe	4
PID 2880 wrote to memory of 396	2880	svchost.exe	4
PID 2880 wrote to memory of 432	2880	svchost.exe	5
PID 2880 wrote to memory of 432	2880	svchost.exe	5
PID 2880 wrote to memory of 432	2880	svchost.exe	5
PID 2880 wrote to memory of 432	2880	svchost.exe	5
PID 2880 wrote to memory of 432	2880	svchost.exe	5

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe
1⤵
PID:256

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:332

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:384
- C:\Windows\system32\services.exe
  C:\Windows\system32\services.exe
  2⤵
  PID:480
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    3⤵
    PID:604
  - - C:\Windows\system32\wbem\wmiprvse.exe
      C:\Windows\system32\wbem\wmiprvse.exe
      4⤵
      PID:916
  - - C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
      4⤵
      PID:1860
  - - C:\Windows\system32\wbem\wmiprvse.exe
      C:\Windows\system32\wbem\wmiprvse.exe -Embedding
      4⤵
      PID:476
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    3⤵
    PID:680
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    3⤵
    PID:752
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    3⤵
    PID:816
  - - C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      4⤵
      PID:1168
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    3⤵
    PID:856
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService
    3⤵
    PID:968
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    3⤵
    PID:112
- - C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    3⤵
    PID:1020
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    3⤵
    PID:1060
- - C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    3⤵
    PID:1104
- - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
    "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
    3⤵
    PID:316
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    3⤵
    PID:2228
- - C:\Windows\system32\sppsvc.exe
    C:\Windows\system32\sppsvc.exe
    3⤵
    PID:2412
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:488
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:496

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:396

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:432

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1200
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5894443a667888c965a793a435fa274e356f75ee7bb426a2c5d383ec2cb3dd8f.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2168
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\5894443a667888c965a793a435fa274e356f75ee7bb426a2c5d383ec2cb3dd8f.dll,#1
    3⤵
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2232
  - - C:\Windows\SysWOW64\rundll32mgr.exe
      C:\Windows\SysWOW64\rundll32mgr.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of UnmapMainImage
      Suspicious use of WriteProcessMemory
      PID:2680
    - - C:\Program Files (x86)\Microsoft\WaterMark.exe
        
        "C:\Program Files (x86)\Microsoft\WaterMark.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of UnmapMainImage
        Suspicious use of WriteProcessMemory
        
        PID:2380
      - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        6⤵
        Modifies WinLogon for persistence
        Drops file in System32 directory
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        
        PID:2516
      - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2880
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 224
      4⤵
      Program crash
      Suspicious use of AdjustPrivilegeToken
      PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

Filesize
341KB

MD5
2ad8e7e0204ab1ed569e81d2a98c61ed

SHA1
a3b116c6178303d245d0cd38f2c624d374eca77a

SHA256
59898af81ca676cd1109a01ac4caeb658abb4b6c6b2c83959248d304d7683711

SHA512
5bbf1480af3380e9e8ada44d1eb0c4e9912bb2ae0c4076d939c9eab4087b0f2ae874e777e6c804870e8e5d3fb95b665573a6c7751fa076ce8d80e49be42813f7

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

Filesize
337KB

MD5
7f17e79452adac10c8e4e37c5f431918

SHA1
bac05960951348b03c9224e8e6dea984a8d86d7e

SHA256
57f8e65b7116a698e5bb08c5954357227752e4784c329bcbf511c5296a703ca6

SHA512
75f5eef3fff180cd205083a2d696f4a065bb96b5e73f1f5779cbb2a23c6f7a236f9a56b04c322e8d2879c855cdebb1b322a70f39a7ea93c3b0678cdedf2ff640

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
164KB

MD5
2a37762e1964cb393abf1b26b048e762

SHA1
6167b12b2d0e4db8bad3dd8ac6c7674f8eea2f1d

SHA256
385539e7b0dbbe1de66ca4888b07baab2bbce51b3e6c6edc1b2602628fa7d8e5

SHA512
57e2904f6231c879d99df7fdbc321c03c76bef310e0510b818d1fa3663d44d6e56742d1b746e96d42e9559c83d437bbc4eb7fe672567fd7e18ec513bfb8c53aa

Download Submit
memory/2232-412-0x0000000010000000-0x00000000100C1000-memory.dmp

Filesize
772KB

Download
memory/2232-12-0x0000000000250000-0x000000000028A000-memory.dmp

Filesize
232KB

Download
memory/2232-10-0x0000000000250000-0x000000000028A000-memory.dmp

Filesize
232KB

Download
memory/2232-9-0x0000000010000000-0x00000000100C1000-memory.dmp

Filesize
772KB

Download
memory/2232-0-0x0000000010000000-0x00000000100C1000-memory.dmp

Filesize
772KB

Download
memory/2380-90-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2380-44-0x00000000774DF000-0x00000000774E0000-memory.dmp

Filesize
4KB

Download
memory/2380-92-0x00000000774DF000-0x00000000774E0000-memory.dmp

Filesize
4KB

Download
memory/2380-665-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2380-45-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2380-73-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/2380-33-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2380-43-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download
memory/2380-42-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2516-409-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2516-55-0x00000000000A0000-0x00000000000A1000-memory.dmp

Filesize
4KB

Download
memory/2516-56-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2516-46-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2516-48-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2516-66-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2516-69-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2516-63-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/2516-57-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2680-19-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2680-20-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2680-14-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2680-11-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2680-15-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2680-31-0x0000000000050000-0x000000000008A000-memory.dmp

Filesize
232KB

Download
memory/2680-16-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2680-13-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2680-17-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/2680-22-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2880-85-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2880-93-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2880-91-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/2880-94-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2880-95-0x00000000774E0000-0x00000000774E1000-memory.dmp

Filesize
4KB

Download
memory/2880-96-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/2880-97-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2880-89-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2880-75-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download