Overview
overview
10Static
static
100706909124...af.exe
windows7-x64
100706909124...af.exe
windows10-2004-x64
10092a8a750e...b8.exe
windows7-x64
10092a8a750e...b8.exe
windows10-2004-x64
100b4363ea1b...c7.exe
windows7-x64
100b4363ea1b...c7.exe
windows10-2004-x64
101474031cf4...a5.exe
windows7-x64
101474031cf4...a5.exe
windows10-2004-x64
101c64423afe...82.exe
windows7-x64
101c64423afe...82.exe
windows10-2004-x64
1024754063ad...fb.exe
windows7-x64
1024754063ad...fb.exe
windows10-2004-x64
10262ab91f7f...5c.exe
windows7-x64
10262ab91f7f...5c.exe
windows10-2004-x64
102c6e778930...90.exe
windows7-x64
102c6e778930...90.exe
windows10-2004-x64
10313130ecff...14.exe
windows7-x64
10313130ecff...14.exe
windows10-2004-x64
103a142d0199...a1.exe
windows7-x64
103a142d0199...a1.exe
windows10-2004-x64
10473246aff3...2b.exe
windows7-x64
10473246aff3...2b.exe
windows10-2004-x64
10532651acde...62.exe
windows7-x64
10532651acde...62.exe
windows10-2004-x64
1054d317bff9...74.exe
windows7-x64
1054d317bff9...74.exe
windows10-2004-x64
10574c22b9ce...30.exe
windows7-x64
10574c22b9ce...30.exe
windows10-2004-x64
106d76abe8ee...21.exe
windows7-x64
106d76abe8ee...21.exe
windows10-2004-x64
1076f01f1de9...6d.exe
windows7-x64
376f01f1de9...6d.exe
windows10-2004-x64
10Analysis
-
max time kernel
93s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
29-12-2024 12:11
Behavioral task
behavioral1
Sample
07069091241215607c36cbe294255edb67c26fd27ebee8923c0d0e23fc0b7baf.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
07069091241215607c36cbe294255edb67c26fd27ebee8923c0d0e23fc0b7baf.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
092a8a750e5d4aee2bae9207ee5cfcaad2db4224f93cc3efe52fb113a2808db8.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
092a8a750e5d4aee2bae9207ee5cfcaad2db4224f93cc3efe52fb113a2808db8.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
0b4363ea1bbc55747d0c878125637bcf50aaeb4fc44b1b972c7b8daedc2512c7.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
0b4363ea1bbc55747d0c878125637bcf50aaeb4fc44b1b972c7b8daedc2512c7.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
1474031cf449fb6bc31aa6bb646941714610874a7663787f62a07d817b614ea5.exe
Resource
win7-20241010-en
Behavioral task
behavioral8
Sample
1474031cf449fb6bc31aa6bb646941714610874a7663787f62a07d817b614ea5.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
1c64423afe71c8539881c789518416a72ef8ee611727513e1f47c9c9154bb782.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
1c64423afe71c8539881c789518416a72ef8ee611727513e1f47c9c9154bb782.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
24754063ad81e8ab4be77eac0a61cdf74054083d04947327adf4a062c6ef84fb.exe
Resource
win7-20240729-en
Behavioral task
behavioral12
Sample
24754063ad81e8ab4be77eac0a61cdf74054083d04947327adf4a062c6ef84fb.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
262ab91f7f3303121efe6ceec005edeabf80ebe5cfc53a807ae99b636597985c.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
262ab91f7f3303121efe6ceec005edeabf80ebe5cfc53a807ae99b636597985c.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
2c6e7789308643ecb686566eba4753a825da5dab42e11fb207f8bbfa330f3990.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
2c6e7789308643ecb686566eba4753a825da5dab42e11fb207f8bbfa330f3990.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
313130ecff1098fa44652ff626976d22f759ada06900b3e1ea125f412bf90814.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
313130ecff1098fa44652ff626976d22f759ada06900b3e1ea125f412bf90814.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
3a142d0199bd1e8504b199948f5b2742fcd704316875051f5f8cc3e75d6a1da1.exe
Resource
win7-20241010-en
Behavioral task
behavioral20
Sample
3a142d0199bd1e8504b199948f5b2742fcd704316875051f5f8cc3e75d6a1da1.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
473246aff3e141d2fc390990fa13a49cf36f66a8ace5f230250e7035981e1f2b.exe
Resource
win7-20241010-en
Behavioral task
behavioral22
Sample
473246aff3e141d2fc390990fa13a49cf36f66a8ace5f230250e7035981e1f2b.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
532651acde43a5fb82a5c4de5c3dd9ef5809e5a75d52bb9af1c672c08e8c9062.exe
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
532651acde43a5fb82a5c4de5c3dd9ef5809e5a75d52bb9af1c672c08e8c9062.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
54d317bff9681eb1d6bfd7691dd4096dd2bc4cc3a5a02be8f80aab623f349874.exe
Resource
win7-20240729-en
Behavioral task
behavioral26
Sample
54d317bff9681eb1d6bfd7691dd4096dd2bc4cc3a5a02be8f80aab623f349874.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
574c22b9ce95cd6205f7ff6bab0e414c1e0d6bc26070819ce1c1ba0ccb710930.exe
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
574c22b9ce95cd6205f7ff6bab0e414c1e0d6bc26070819ce1c1ba0ccb710930.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
6d76abe8ee33124ffde9dae2f6bccf7836b23ab3d0a92d9458b557c362c41e21.exe
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
6d76abe8ee33124ffde9dae2f6bccf7836b23ab3d0a92d9458b557c362c41e21.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe
Resource
win7-20240903-en
General
-
Target
092a8a750e5d4aee2bae9207ee5cfcaad2db4224f93cc3efe52fb113a2808db8.exe
-
Size
157KB
-
MD5
e2753ae9503a05b6d86cbf016eb59ff0
-
SHA1
f2d4d2cd13b3b12951762a21586cb6f3129c8f95
-
SHA256
092a8a750e5d4aee2bae9207ee5cfcaad2db4224f93cc3efe52fb113a2808db8
-
SHA512
5363a002cdca8df310ebbc20e96ade59e4f581ddce1f81854c8ff2318d42b5731a29679073bc5f6d84f46117d5e0ec6d6b4a439be9b9ed3847cf48780bb1ccf4
-
SSDEEP
1536:VIZZnAEjEIZvumULmj4wrraK5dZ4Ltta9Km/ec3DtAL6bmZ4bXSjrAE+fySPoqRI:GnnAQVG/LytaKItS/fiLKS+f5Aq7i
Malware Config
Signatures
-
Ramnit family
-
Loads dropped DLL 1 IoCs
pid Process 4504 092a8a750e5d4aee2bae9207ee5cfcaad2db4224f93cc3efe52fb113a2808db8.exe -
resource yara_rule behavioral4/memory/4504-6-0x0000000000400000-0x0000000000432000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 2504 4504 WerFault.exe 81 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 092a8a750e5d4aee2bae9207ee5cfcaad2db4224f93cc3efe52fb113a2808db8.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\092a8a750e5d4aee2bae9207ee5cfcaad2db4224f93cc3efe52fb113a2808db8.exe"C:\Users\Admin\AppData\Local\Temp\092a8a750e5d4aee2bae9207ee5cfcaad2db4224f93cc3efe52fb113a2808db8.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4504 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 4802⤵
- Program crash
PID:2504
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4504 -ip 45041⤵PID:4680
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD54f3387277ccbd6d1f21ac5c07fe4ca68
SHA1e16506f662dc92023bf82def1d621497c8ab5890
SHA256767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
SHA5129da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219