ramnit | 6a943da45561b89e7a60cdcea899249b13c35ab202648b15500a0ec236a66b32

Analysis

max time kernel
120s
max time network
97s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 01:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6a943da45561b89e7a60cdcea899249b13c35ab202648b15500a0ec236a66b32N.dll
Size

184KB
MD5

a4df67495a3e8a90b8626f38c0b95320
SHA1

3d97b8da469fc943f3ce07a4630e9fb110192b53
SHA256

6a943da45561b89e7a60cdcea899249b13c35ab202648b15500a0ec236a66b32
SHA512

db6386f2fef84785a46706eabebb5bd2b1b89d62f72551ebf8318ca74bd9320ef78d955e93af21e54411986bed41b0f1293db649b92c26fea636b7cca8ba94e3
SSDEEP

3072:jn4cV8gf2u41Z5tKlw+riClf+gfjxbfkhbN:L4y8gOl2zrhlf++xYhh

Score

10^/10

ramnit banker discovery persistence spyware stealer trojan upx worm

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe"	svchost.exe

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Ramnit family
ramnit

Executes dropped EXE 2 IoCs

pid	Process
2552	rundll32mgr.exe
2980	WaterMark.exe

Loads dropped DLL 4 IoCs

pid	Process
2380	rundll32.exe
2380	rundll32.exe
2552	rundll32mgr.exe
2552	rundll32mgr.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe
File created	C:\Windows\SysWOW64\dmlconf.dat	svchost.exe
File opened for modification	C:\Windows\SysWOW64\dmlconf.dat	svchost.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2552-14-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2552-17-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/memory/2552-16-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2552-15-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2552-13-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2552-20-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2552-22-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2552-19-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2980-42-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2980-43-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/memory/2980-86-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2980-615-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_rgb_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe	svchost.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Entity.Resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libvnc_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libtextst_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Orange Circles.htm	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.RunTime.Serialization.Resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libcache_block_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\PhotoAcq.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jawt.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_output\libwingdi_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\msadds.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\fxplugins.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\msvcr100.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libdemuxdump_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\librv32_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_output\libcaca_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows NT\Accessories\WordpadFilter.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libstereo_widen_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libnsv_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7-zip32.dll	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\UIAutomationClientsideProviders.resources.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Speech.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Entity.Design.Resources.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\Microsoft.Build.Conversion.v3.5.resources.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.AddIn.Contract.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\epl-v10.html	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\t2k.dll	svchost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\api-ms-win-crt-locale-l1-1-0.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.IO.Log.Resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libwav_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\IPSEventLogMsg.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Xml.Linq.Resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libedgedetection_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\dt_socket.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationCore.resources.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ReachFramework.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libdmo_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libsid_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_wav_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libprefetch_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jaas_nt.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\sunmscapi.dll	svchost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\api-ms-win-crt-private-l1-1-0.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_yuy2_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\IpsMigrationPlugin.dll	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\mojo_core.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\tnameserv.exe	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\services_discovery\libwindrive_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Activities.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libscaletempo_pitch_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libspatialaudio_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\d3d11\libdirect3d11_filters_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpeg4audio_plugin.dll	svchost.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaterMark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32mgr.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
2980	WaterMark.exe
2980	WaterMark.exe
2980	WaterMark.exe
2980	WaterMark.exe
2980	WaterMark.exe
2980	WaterMark.exe
2980	WaterMark.exe
2980	WaterMark.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2980	WaterMark.exe
Token: SeDebugPrivilege	2780	svchost.exe
Token: SeDebugPrivilege	2980	WaterMark.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2552	rundll32mgr.exe
2980	WaterMark.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 392 wrote to memory of 2380	392	rundll32.exe	29
PID 392 wrote to memory of 2380	392	rundll32.exe	29
PID 392 wrote to memory of 2380	392	rundll32.exe	29
PID 392 wrote to memory of 2380	392	rundll32.exe	29
PID 392 wrote to memory of 2380	392	rundll32.exe	29
PID 392 wrote to memory of 2380	392	rundll32.exe	29
PID 392 wrote to memory of 2380	392	rundll32.exe	29
PID 2380 wrote to memory of 2552	2380	rundll32.exe	30
PID 2380 wrote to memory of 2552	2380	rundll32.exe	30
PID 2380 wrote to memory of 2552	2380	rundll32.exe	30
PID 2380 wrote to memory of 2552	2380	rundll32.exe	30
PID 2552 wrote to memory of 2980	2552	rundll32mgr.exe	31
PID 2552 wrote to memory of 2980	2552	rundll32mgr.exe	31
PID 2552 wrote to memory of 2980	2552	rundll32mgr.exe	31
PID 2552 wrote to memory of 2980	2552	rundll32mgr.exe	31
PID 2980 wrote to memory of 2736	2980	WaterMark.exe	32
PID 2980 wrote to memory of 2736	2980	WaterMark.exe	32
PID 2980 wrote to memory of 2736	2980	WaterMark.exe	32
PID 2980 wrote to memory of 2736	2980	WaterMark.exe	32
PID 2980 wrote to memory of 2736	2980	WaterMark.exe	32
PID 2980 wrote to memory of 2736	2980	WaterMark.exe	32
PID 2980 wrote to memory of 2736	2980	WaterMark.exe	32
PID 2980 wrote to memory of 2736	2980	WaterMark.exe	32
PID 2980 wrote to memory of 2736	2980	WaterMark.exe	32
PID 2980 wrote to memory of 2736	2980	WaterMark.exe	32
PID 2980 wrote to memory of 2780	2980	WaterMark.exe	33
PID 2980 wrote to memory of 2780	2980	WaterMark.exe	33
PID 2980 wrote to memory of 2780	2980	WaterMark.exe	33
PID 2980 wrote to memory of 2780	2980	WaterMark.exe	33
PID 2980 wrote to memory of 2780	2980	WaterMark.exe	33
PID 2980 wrote to memory of 2780	2980	WaterMark.exe	33
PID 2980 wrote to memory of 2780	2980	WaterMark.exe	33
PID 2980 wrote to memory of 2780	2980	WaterMark.exe	33
PID 2980 wrote to memory of 2780	2980	WaterMark.exe	33
PID 2980 wrote to memory of 2780	2980	WaterMark.exe	33
PID 2780 wrote to memory of 256	2780	svchost.exe	1
PID 2780 wrote to memory of 256	2780	svchost.exe	1
PID 2780 wrote to memory of 256	2780	svchost.exe	1
PID 2780 wrote to memory of 256	2780	svchost.exe	1
PID 2780 wrote to memory of 256	2780	svchost.exe	1
PID 2780 wrote to memory of 336	2780	svchost.exe	2
PID 2780 wrote to memory of 336	2780	svchost.exe	2
PID 2780 wrote to memory of 336	2780	svchost.exe	2
PID 2780 wrote to memory of 336	2780	svchost.exe	2
PID 2780 wrote to memory of 336	2780	svchost.exe	2
PID 2780 wrote to memory of 372	2780	svchost.exe	3
PID 2780 wrote to memory of 372	2780	svchost.exe	3
PID 2780 wrote to memory of 372	2780	svchost.exe	3
PID 2780 wrote to memory of 372	2780	svchost.exe	3
PID 2780 wrote to memory of 372	2780	svchost.exe	3
PID 2780 wrote to memory of 384	2780	svchost.exe	4
PID 2780 wrote to memory of 384	2780	svchost.exe	4
PID 2780 wrote to memory of 384	2780	svchost.exe	4
PID 2780 wrote to memory of 384	2780	svchost.exe	4
PID 2780 wrote to memory of 384	2780	svchost.exe	4
PID 2780 wrote to memory of 420	2780	svchost.exe	5
PID 2780 wrote to memory of 420	2780	svchost.exe	5
PID 2780 wrote to memory of 420	2780	svchost.exe	5
PID 2780 wrote to memory of 420	2780	svchost.exe	5
PID 2780 wrote to memory of 420	2780	svchost.exe	5
PID 2780 wrote to memory of 464	2780	svchost.exe	6
PID 2780 wrote to memory of 464	2780	svchost.exe	6
PID 2780 wrote to memory of 464	2780	svchost.exe	6
PID 2780 wrote to memory of 464	2780	svchost.exe	6

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe
1⤵
PID:256

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:336

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:372
- C:\Windows\system32\services.exe
  C:\Windows\system32\services.exe
  2⤵
  PID:464
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    3⤵
    PID:604
  - - C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
      4⤵
      PID:928
  - - C:\Windows\system32\wbem\wmiprvse.exe
      C:\Windows\system32\wbem\wmiprvse.exe
      4⤵
      PID:1852
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    3⤵
    PID:684
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    3⤵
    PID:744
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    3⤵
    PID:816
  - - C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      4⤵
      PID:1320
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    3⤵
    PID:856
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService
    3⤵
    PID:992
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    3⤵
    PID:300
- - C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    3⤵
    PID:272
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    3⤵
    PID:1032
- - C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    3⤵
    PID:1232
- - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
    "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
    3⤵
    PID:1120
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    3⤵
    PID:1928
- - C:\Windows\system32\sppsvc.exe
    C:\Windows\system32\sppsvc.exe
    3⤵
    PID:1924
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:480
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:488

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:384

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1360
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6a943da45561b89e7a60cdcea899249b13c35ab202648b15500a0ec236a66b32N.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:392
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\6a943da45561b89e7a60cdcea899249b13c35ab202648b15500a0ec236a66b32N.dll,#1
    3⤵
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2380
  - - C:\Windows\SysWOW64\rundll32mgr.exe
      C:\Windows\SysWOW64\rundll32mgr.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of UnmapMainImage
      Suspicious use of WriteProcessMemory
      PID:2552
    - - C:\Program Files (x86)\Microsoft\WaterMark.exe
        
        "C:\Program Files (x86)\Microsoft\WaterMark.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of UnmapMainImage
        Suspicious use of WriteProcessMemory
        
        PID:2980
      - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        6⤵
        Modifies WinLogon for persistence
        Drops file in System32 directory
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        
        PID:2736
      - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

Filesize
198KB

MD5
023b9ceeca1ddeb02a05563139facd5e

SHA1
954f231ec1cdc4b80381f2fb97597c701173d15b

SHA256
71aebb495acfe902cf0c6fb9f8bfe04afaafb8ceec085c08f2980cbea6e42553

SHA512
9ed27429c5fac8f72d3cdc283828e3ada5913c8097140e7005bf85acf996fefc26ddc5d00d91ffb6b8366376ee7876203d0b6a93f966373a912b120fcde5abba

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

Filesize
194KB

MD5
d097c6317e9b0036031abea748fde0bc

SHA1
72a16688524279f702052c7dfb80e5c3a639fac9

SHA256
3a67397e6d5f7fee5639b1a0dcf3d77d2842071afc8dbf5c28da1acbd26ccd12

SHA512
d79a709bb25af732fe8f0c7455e251aea7ffb6007c54b0417315f2c907a6cddbff27d247e84fd8e9b51772a91591525bf013b938dc4365767ee06ab4cfcdb175

Download Submit
C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
92KB

MD5
dace075bf1731bb90fc56f559f9e864f

SHA1
2147f6b576b71bba1f1c1117f86ecb123e941bab

SHA256
bc2ed6ce2caca16e2d4f77e2f59608fa901993a87a419e8066cda64eae8b9e8d

SHA512
f28c6c90c8ea26f8af6a62963249f4c420605040d2048db0b516dcd10f196173ea9dfbc8ab595db5241e0f3c4f57e9db690eb57abd4d795278f748651a01d0cf

Download Submit
memory/2380-4-0x0000000010000000-0x000000001002F000-memory.dmp

Filesize
188KB

Download
memory/2380-2-0x0000000010000000-0x000000001002F000-memory.dmp

Filesize
188KB

Download
memory/2380-1-0x0000000010000000-0x000000001002F000-memory.dmp

Filesize
188KB

Download
memory/2380-0-0x0000000010000000-0x000000001002F000-memory.dmp

Filesize
188KB

Download
memory/2380-12-0x0000000000280000-0x00000000002A9000-memory.dmp

Filesize
164KB

Download
memory/2552-16-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2552-15-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2552-13-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2552-17-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2552-20-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2552-22-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2552-19-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2552-29-0x0000000000050000-0x0000000000079000-memory.dmp

Filesize
164KB

Download
memory/2552-18-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/2552-14-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2552-32-0x0000000000050000-0x0000000000079000-memory.dmp

Filesize
164KB

Download
memory/2736-57-0x00000000000A0000-0x00000000000A1000-memory.dmp

Filesize
4KB

Download
memory/2736-70-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/2736-58-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2736-362-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2736-50-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2736-48-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2736-68-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2736-64-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2736-59-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2780-95-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2780-96-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/2780-76-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2780-92-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2780-93-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/2780-87-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2780-94-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2780-98-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2780-97-0x00000000777C0000-0x00000000777C1000-memory.dmp

Filesize
4KB

Download
memory/2980-74-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2980-45-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/2980-88-0x00000000777BF000-0x00000000777C0000-memory.dmp

Filesize
4KB

Download
memory/2980-86-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2980-75-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2980-46-0x00000000777BF000-0x00000000777C0000-memory.dmp

Filesize
4KB

Download
memory/2980-615-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2980-43-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2980-42-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download