Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
25-12-2024 16:29
General
-
Target
410c5ca58e6ceea8c7f62d750011eb0e1c2dfffbab3ffe17832ad1aef3ef4146.dll
-
Size
439KB
-
MD5
b2b9e4fea189984d23d8620d98d68984
-
SHA1
dd299d80fda6a7bfef0e31a961e926f1ae65ea50
-
SHA256
410c5ca58e6ceea8c7f62d750011eb0e1c2dfffbab3ffe17832ad1aef3ef4146
-
SHA512
5385432643796a88b082b7bb8d67fb1de2d9a6e6dff1b0f41f579ab57308232c6d08e4abb4aede0da774c1ef10e65e213c7493c6ab50f438ca064c1545dc49a9
-
SSDEEP
6144:yOp8HpzdQOStK+XsAWxnuTNo3+wO90oi8h:yOp8Hpz7+XsBJ+SXO9g8h
Malware Config
Signatures
-
Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
-
Ramnit family
-
Executes dropped EXE 6 IoCs
-
Drops file in System32 directory 2 IoCs
-
UPX packed file 19 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 10 IoCs
-
Program crash 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 48 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SetWindowsHookEx 14 IoCs
-
Suspicious use of UnmapMainImage 6 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\410c5ca58e6ceea8c7f62d750011eb0e1c2dfffbab3ffe17832ad1aef3ef4146.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\410c5ca58e6ceea8c7f62d750011eb0e1c2dfffbab3ffe17832ad1aef3ef4146.dll,#12⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32mgrmgr.exeC:\Windows\SysWOW64\rundll32mgrmgr.exe4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2296 -s 2047⤵
- Program crash
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"6⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3300 CREDAT:17410 /prefetch:27⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"6⤵
- Modifies Internet Explorer settings
-
-
-
-
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe"C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe"5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"6⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe7⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4924 -s 2048⤵
- Program crash
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"7⤵
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"7⤵
- Modifies Internet Explorer settings
-
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3672 -s 2046⤵
- Program crash
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1664 CREDAT:17410 /prefetch:26⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4844 CREDAT:17410 /prefetch:26⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2296 -ip 22961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3672 -ip 36721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4924 -ip 49241⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
471B
MD573d8dd7eaa8896905e31f1960f51ece1
SHA1164e031603e75d95091220c5ff0d695547f6d3ae
SHA2569ff75ab638fe252bd0d04aea3f0ce38270ffc8df5db9399f9ea45aaef196dddc
SHA5124879585482992d7ea3ee02775b74592b06daab32a63dc7700dd4da40c45a524f3bcfc2beff928a85563f09ad0438be5b3e458bc3d0cd08ad146d416fec014a04
-
Filesize
404B
MD5eaf510da9778e3e183d857932ec4da88
SHA1f7de456dae3339ee295d4d5adc80a2dd8dd1597e
SHA25619ad5a6f7a6951af84b44e3e5a98347f629df3ea8f031471f3ee1d0a17397328
SHA512b8157453efab26d2202bf05fc6ddd2d60dec21a66a0f4d7c2b34549557fa4913ccff0695f6154e503e713f3af1ba6863e7c8bcd2ae1782c0c404c915bede5e24
-
Filesize
5KB
MD5c63bd6de2ffe798b9981bf5479b2ff86
SHA1d962b2db1fddf048507f73d74b594afed694a65a
SHA256d1b2df41603d6087adbb8c8e81e2f87aa763cf8f7b7fca88f3c3d019065517d5
SHA512b37f13edd558a48e17b296fde92eadf24335aa58b7ec5743a6dfc1b5ba3710c4d7a6fa42e08d8fa64b2870a6dcc1769b81388996f9cb4a0929406011ba6b63c6
-
Filesize
5KB
MD5a8220e5de0df210f778beaa284d39b93
SHA18fdf8613f5b3f0dcbb7812b6e9b0c4e9f23c2ce9
SHA256e37eb1125f947f5a0177856233319bdd010442ed7ee9806ea2c6c65c19e6614a
SHA512c30cbfb2263190fa9b486fc62fab25fdc50a265ffdaa0dccb475b84191b63b73756347038552e68e5df6db9ec7e2471d71090b38a2618dd0a9f3031c9cb68390
-
Filesize
4KB
MD562850a20d409f530a05c8bfe59b7a95f
SHA17d869e5583d4c39488eda140c26ba03bcc6f833f
SHA256e88b39b015760f839b07217d66873677b5962299a9d1c59a5921b78b1a68f44c
SHA512e0ce1f673eec9b982098b47b8d0c62e03c6a8b7ae27ee6ca66ed57cf45c60e63f81e6689921eaaa5d78d0b333bdc2411c9aee689224717df37c71c1c9452a865
-
Filesize
15KB
MD51a545d0052b581fbb2ab4c52133846bc
SHA162f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA256557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
SHA512bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
339KB
MD57385f723cdfd6a19523b29e19fe63e39
SHA16eb6694a76aab6587eb45575f380cc7a80c66bc5
SHA256a50f5786e2dd07cfbc89f72484e3af5dcccc31d476713bd7b433c6f74ebc4e37
SHA512858c17a06aec78976775cd9df4f2652cfb97e35c14aa863e88f27cd332c6b6ecdb0c062d0cfdb53436981b50ba4681ebe04d00128df8be67398d021aa6d83632
-
Filesize
168KB
MD50943b815c588255874985439061ba474
SHA131ad4cdb76003b35f553cb96c78d887e7c960eba
SHA2567b1559c2f8d511f7be152a22809b358088048fc3e00d9963b92ad0ecb384bf51
SHA512fce7596624b5c224cbaaae55c4b224ff995eea33ed0ca9d40c33cfb5ffaa98f387f267175788f5431ca7209c2c69ef1024b9541f7b53a1a3c6412b09a19bd601
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
400KB
-
Filesize
132KB
-
Filesize
4KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
400KB
-
Filesize
132KB
-
Filesize
4KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
228KB
-
Filesize
4KB
-
Filesize
132KB
-
Filesize
4KB
-
Filesize
132KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
132KB
-
Filesize
4KB
-
Filesize
132KB
-
Filesize
400KB
-
Filesize
4KB
-
Filesize
400KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
400KB
-
Filesize
448KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
228KB
-
Filesize
132KB