ramnit | 488e75e28ed648af7738686a6c2ffc7b146c7ade30ee47dabe52bda4c4a9eeca

Analysis

max time kernel
120s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/12/2024, 05:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

488e75e28ed648af7738686a6c2ffc7b146c7ade30ee47dabe52bda4c4a9eeca.dll
Size

212KB
MD5

84c79a31b6ec4ddfb8af38bd82e397a9
SHA1

5e8193d5438395bdb58636954f3841d56526a7f2
SHA256

488e75e28ed648af7738686a6c2ffc7b146c7ade30ee47dabe52bda4c4a9eeca
SHA512

ba9081b58d6e0dbb6126f01452d243e18ccddbab4bd068fd9a7db56d752509c24c0847e0a8055e582537ba78a19d0620f1d9726d76e42f8e32cda9a4e02b12a2
SSDEEP

3072:an4cV8gf2u41Z5tKlwiIhKQGUppd4/nPxh:g4y8gOl2nIcNEdexh

Score

10^/10

ramnit banker discovery persistence spyware stealer trojan upx worm

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe"	svchost.exe

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Ramnit family
ramnit

Executes dropped EXE 2 IoCs

pid	Process
1740	rundll32mgr.exe
2532	WaterMark.exe

Loads dropped DLL 4 IoCs

pid	Process
2548	rundll32.exe
2548	rundll32.exe
1740	rundll32mgr.exe
1740	rundll32mgr.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe
File created	C:\Windows\SysWOW64\dmlconf.dat	svchost.exe
File opened for modification	C:\Windows\SysWOW64\dmlconf.dat	svchost.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2532-27-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/memory/1740-21-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/memory/1740-11-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/memory/2532-51-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/memory/2532-63-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/memory/2532-584-0x0000000000400000-0x0000000000429000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\api-ms-win-crt-time-l1-1-0.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.DirectoryServices.AccountManagement.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libvcd_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_livehttp_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\msdfmap.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\npjp2.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.Design.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libmotiondetect_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe	svchost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\api-ms-win-crt-locale-l1-1-0.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationClient.resources.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\UIAutomationClientsideProviders.resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\axvlc.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libchorus_flanger_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE	svchost.exe
File opened for modification	C:\Program Files\Microsoft Games\Chess\Chess.exe	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Runtime.Serialization.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSCommon.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\license.html	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh.htm	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\glib-lite.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Aero.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Entity.Resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile.html	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libdmo_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\calendar.html	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\calendar.html	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\librawvideo_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_asf_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpeg4audio_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\ReachFramework.resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libidummy_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libnfs_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libaom_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libxa_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_splitter\libpanoramix_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\DVD Maker\OmdBase.dll	svchost.exe
File opened for modification	C:\Program Files\Internet Explorer\F12.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\eula.dll	svchost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\api-ms-win-crt-runtime-l1-1-0.dll	svchost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\xul.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Services.Client.resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\meta_engine\libtaglib_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\services_discovery\libmediadirs_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_yuy2_sse2_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libextract_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\awt.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\dt_shmem.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\mlib_image.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\java-rmi.exe	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.ServiceModel.Resources.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.AddIn.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_shout_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\InkObj.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javafx-iio.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\eclipse_1665.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\libxml2.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\server\jvm.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\PresentationCore.resources.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Linq.dll	svchost.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32mgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaterMark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
2532	WaterMark.exe
2532	WaterMark.exe
2532	WaterMark.exe
2532	WaterMark.exe
2532	WaterMark.exe
2532	WaterMark.exe
2532	WaterMark.exe
2532	WaterMark.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2532	WaterMark.exe
Token: SeDebugPrivilege	2668	svchost.exe
Token: SeDebugPrivilege	2532	WaterMark.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 236 wrote to memory of 2548	236	rundll32.exe	30
PID 236 wrote to memory of 2548	236	rundll32.exe	30
PID 236 wrote to memory of 2548	236	rundll32.exe	30
PID 236 wrote to memory of 2548	236	rundll32.exe	30
PID 236 wrote to memory of 2548	236	rundll32.exe	30
PID 236 wrote to memory of 2548	236	rundll32.exe	30
PID 236 wrote to memory of 2548	236	rundll32.exe	30
PID 2548 wrote to memory of 1740	2548	rundll32.exe	31
PID 2548 wrote to memory of 1740	2548	rundll32.exe	31
PID 2548 wrote to memory of 1740	2548	rundll32.exe	31
PID 2548 wrote to memory of 1740	2548	rundll32.exe	31
PID 1740 wrote to memory of 2532	1740	rundll32mgr.exe	32
PID 1740 wrote to memory of 2532	1740	rundll32mgr.exe	32
PID 1740 wrote to memory of 2532	1740	rundll32mgr.exe	32
PID 1740 wrote to memory of 2532	1740	rundll32mgr.exe	32
PID 2532 wrote to memory of 2760	2532	WaterMark.exe	33
PID 2532 wrote to memory of 2760	2532	WaterMark.exe	33
PID 2532 wrote to memory of 2760	2532	WaterMark.exe	33
PID 2532 wrote to memory of 2760	2532	WaterMark.exe	33
PID 2532 wrote to memory of 2760	2532	WaterMark.exe	33
PID 2532 wrote to memory of 2760	2532	WaterMark.exe	33
PID 2532 wrote to memory of 2760	2532	WaterMark.exe	33
PID 2532 wrote to memory of 2760	2532	WaterMark.exe	33
PID 2532 wrote to memory of 2760	2532	WaterMark.exe	33
PID 2532 wrote to memory of 2760	2532	WaterMark.exe	33
PID 2532 wrote to memory of 2668	2532	WaterMark.exe	34
PID 2532 wrote to memory of 2668	2532	WaterMark.exe	34
PID 2532 wrote to memory of 2668	2532	WaterMark.exe	34
PID 2532 wrote to memory of 2668	2532	WaterMark.exe	34
PID 2532 wrote to memory of 2668	2532	WaterMark.exe	34
PID 2532 wrote to memory of 2668	2532	WaterMark.exe	34
PID 2532 wrote to memory of 2668	2532	WaterMark.exe	34
PID 2532 wrote to memory of 2668	2532	WaterMark.exe	34
PID 2532 wrote to memory of 2668	2532	WaterMark.exe	34
PID 2532 wrote to memory of 2668	2532	WaterMark.exe	34
PID 2668 wrote to memory of 256	2668	svchost.exe	1
PID 2668 wrote to memory of 256	2668	svchost.exe	1
PID 2668 wrote to memory of 256	2668	svchost.exe	1
PID 2668 wrote to memory of 256	2668	svchost.exe	1
PID 2668 wrote to memory of 256	2668	svchost.exe	1
PID 2668 wrote to memory of 332	2668	svchost.exe	2
PID 2668 wrote to memory of 332	2668	svchost.exe	2
PID 2668 wrote to memory of 332	2668	svchost.exe	2
PID 2668 wrote to memory of 332	2668	svchost.exe	2
PID 2668 wrote to memory of 332	2668	svchost.exe	2
PID 2668 wrote to memory of 384	2668	svchost.exe	3
PID 2668 wrote to memory of 384	2668	svchost.exe	3
PID 2668 wrote to memory of 384	2668	svchost.exe	3
PID 2668 wrote to memory of 384	2668	svchost.exe	3
PID 2668 wrote to memory of 384	2668	svchost.exe	3
PID 2668 wrote to memory of 392	2668	svchost.exe	4
PID 2668 wrote to memory of 392	2668	svchost.exe	4
PID 2668 wrote to memory of 392	2668	svchost.exe	4
PID 2668 wrote to memory of 392	2668	svchost.exe	4
PID 2668 wrote to memory of 392	2668	svchost.exe	4
PID 2668 wrote to memory of 432	2668	svchost.exe	5
PID 2668 wrote to memory of 432	2668	svchost.exe	5
PID 2668 wrote to memory of 432	2668	svchost.exe	5
PID 2668 wrote to memory of 432	2668	svchost.exe	5
PID 2668 wrote to memory of 432	2668	svchost.exe	5
PID 2668 wrote to memory of 480	2668	svchost.exe	6
PID 2668 wrote to memory of 480	2668	svchost.exe	6
PID 2668 wrote to memory of 480	2668	svchost.exe	6
PID 2668 wrote to memory of 480	2668	svchost.exe	6

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe
1⤵
PID:256

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:332

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:384

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:392
- C:\Windows\system32\services.exe
  C:\Windows\system32\services.exe
  2⤵
  PID:480
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    3⤵
    PID:596
  - - C:\Windows\system32\wbem\wmiprvse.exe
      C:\Windows\system32\wbem\wmiprvse.exe
      4⤵
      PID:1264
  - - C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
      4⤵
      PID:1516
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    3⤵
    PID:672
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    3⤵
    PID:744
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    3⤵
    PID:808
  - - C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      4⤵
      PID:1048
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    3⤵
    PID:848
  - - C:\Windows\system32\wbem\WMIADAP.EXE
      wmiadap.exe /F /T /R
      4⤵
      PID:1540
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService
    3⤵
    PID:972
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    3⤵
    PID:272
- - C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    3⤵
    PID:1076
- - C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    3⤵
    PID:1084
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    3⤵
    PID:1164
- - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
    "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
    3⤵
    PID:2044
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    3⤵
    PID:1892
- - C:\Windows\system32\sppsvc.exe
    C:\Windows\system32\sppsvc.exe
    3⤵
    PID:2304
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:488
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:496

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:432

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1152
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\488e75e28ed648af7738686a6c2ffc7b146c7ade30ee47dabe52bda4c4a9eeca.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:236
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\488e75e28ed648af7738686a6c2ffc7b146c7ade30ee47dabe52bda4c4a9eeca.dll,#1
    3⤵
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2548
  - - C:\Windows\SysWOW64\rundll32mgr.exe
      C:\Windows\SysWOW64\rundll32mgr.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1740
    - - C:\Program Files (x86)\Microsoft\WaterMark.exe
        
        "C:\Program Files (x86)\Microsoft\WaterMark.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2532
      - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        6⤵
        Modifies WinLogon for persistence
        Drops file in System32 directory
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        
        PID:2760
      - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

Filesize
254KB

MD5
9a7d748972544b24e1652cc7a4584cb4

SHA1
54f4d2cc4b48996780f58569651a872d923ec8d5

SHA256
a968f13e2e71d8bda4f686e46cfc32435a9bc20cc7016acdf267a923d8533b12

SHA512
4a0deeacdc1db7f85a9761149038b7b537895dd32e394532733679b297645b9f27621c7dbed26bb06bf8c6b04136cb5d484c9c7e249bad2b3dee2cff574fb55c

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

Filesize
250KB

MD5
4a3b9dd48f87ce6b2ff0ea55704856f1

SHA1
5870fe1928af6132a48ad19832bb408401e8e0c8

SHA256
a435bbed3107fb3089f2534ff416db66c02c28304342a370cb911ba765835a05

SHA512
6fe5bca8566b630af5e0d64a34ab1d8d4f2462d8c73b325a3fc822dcc6090b3dbb5cfed054f9c8efc98a21c0c63ddf225b2f647b522b21392f9b1d0458e2940f

Download Submit
C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
120KB

MD5
5c141e95c22363e31b6f25fcb6815d2d

SHA1
2eafcc1a58429a95548c33b3a081a361cea0456d

SHA256
79a77eec3120d0d12ba3da622f3f837d05f74821881e08edce7f9496ff901103

SHA512
ae0930b8a884643603307a27a6a5d219ab3ddb598ef58b7d74baaf10738b968d6a96c92c4f752f47e324930c2ed4cb6533d9ba140899ce051a8cb6f4ff637809

Download Submit
memory/1740-21-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1740-11-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1740-12-0x0000000000220000-0x0000000000249000-memory.dmp

Filesize
164KB

Download
memory/2532-27-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2532-26-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/2532-51-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2532-584-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2532-580-0x0000000077BCF000-0x0000000077BD0000-memory.dmp

Filesize
4KB

Download
memory/2532-63-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2532-24-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2532-54-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/2532-55-0x0000000077BCF000-0x0000000077BD0000-memory.dmp

Filesize
4KB

Download
memory/2532-23-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2548-3504-0x00000000001A0000-0x00000000001C9000-memory.dmp

Filesize
164KB

Download
memory/2548-1-0x0000000010000000-0x0000000010036000-memory.dmp

Filesize
216KB

Download
memory/2548-9-0x0000000010000000-0x0000000010036000-memory.dmp

Filesize
216KB

Download
memory/2668-73-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/2668-69-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/2668-57-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2668-64-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2668-74-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2668-72-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2668-71-0x0000000077BD0000-0x0000000077BD1000-memory.dmp

Filesize
4KB

Download
memory/2668-70-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2668-68-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2760-29-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2760-35-0x00000000000E0000-0x00000000000E1000-memory.dmp

Filesize
4KB

Download
memory/2760-31-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2760-36-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2760-329-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2760-37-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2760-41-0x00000000000D0000-0x00000000000D1000-memory.dmp

Filesize
4KB

Download
memory/2760-42-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2760-50-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2760-44-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download