Analysis
-
max time kernel
15s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
30-12-2024 20:47
Static task
static1
Behavioral task
behavioral1
Sample
2a1ca62311fc416144f081e1b79fcb1cca40eb6da24de9916d6f90095440bf79N.dll
Resource
win7-20240903-en
General
-
Target
2a1ca62311fc416144f081e1b79fcb1cca40eb6da24de9916d6f90095440bf79N.dll
-
Size
240KB
-
MD5
4c7e8e6b0b27576220989a77779b20c0
-
SHA1
3bfb438b0b65340eb5d86b6799cf8a87fc4215c6
-
SHA256
2a1ca62311fc416144f081e1b79fcb1cca40eb6da24de9916d6f90095440bf79
-
SHA512
c8540474d1029d61328d9cafec601bf33672f84fd2cfb9c3940a036346a1294fc2ac9142b15c4d9d79fcfc38ed7b222eacb005321c966e6137920ccdd3309538
-
SSDEEP
3072:43Z4B+8x2fCFIpcLy1n5lB7GrDWwqrlK4tb1sA622USAz3y184D:43KB+8A6FecLq1BwytF6DYC11D
Malware Config
Signatures
-
Ramnit family
-
Executes dropped EXE 1 IoCs
pid Process 1620 regsvr32mgr.exe -
Loads dropped DLL 4 IoCs
pid Process 2320 regsvr32.exe 2320 regsvr32.exe 1620 regsvr32mgr.exe 1620 regsvr32mgr.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\regsvr32mgr.exe regsvr32.exe -
resource yara_rule behavioral1/memory/1620-14-0x0000000000400000-0x000000000042C1D8-memory.dmp upx behavioral1/memory/1620-20-0x0000000000400000-0x000000000042C1D8-memory.dmp upx behavioral1/memory/1620-19-0x0000000000400000-0x000000000042D000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Modifies registry class 21 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MtContain.CMtContainer\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MtContain.CMtContainer\CurVer\ = "MtContain.CMtContainer.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BA5748AA-CD16-4D3F-82F8-AC17CDCA598C} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BA5748AA-CD16-4D3F-82F8-AC17CDCA598C}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BA5748AA-CD16-4D3F-82F8-AC17CDCA598C}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2a1ca62311fc416144f081e1b79fcb1cca40eb6da24de9916d6f90095440bf79N.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BA5748AA-CD16-4D3F-82F8-AC17CDCA598C}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BA5748AA-CD16-4D3F-82F8-AC17CDCA598C}\VersionIndependentProgID\ = "MtContain.CMtContainer" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BA5748AA-CD16-4D3F-82F8-AC17CDCA598C}\TypeLib\ = "{00000000-0000-0000-0000-000000000000}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MtContain.CMtContainer.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BA5748AA-CD16-4D3F-82F8-AC17CDCA598C}\ = "Multimedia Terminator Container" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MtContain.CMtContainer\CLSID\ = "{BA5748AA-CD16-4D3F-82F8-AC17CDCA598C}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MtContain.CMtContainer\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MtContain.CMtContainer.1\ = "Multimedia Terminator Container" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MtContain.CMtContainer.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BA5748AA-CD16-4D3F-82F8-AC17CDCA598C}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BA5748AA-CD16-4D3F-82F8-AC17CDCA598C}\ProgID\ = "MtContain.CMtContainer.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BA5748AA-CD16-4D3F-82F8-AC17CDCA598C}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MtContain.CMtContainer\ = "Multimedia Terminator Container" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BA5748AA-CD16-4D3F-82F8-AC17CDCA598C}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MtContain.CMtContainer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MtContain.CMtContainer.1\CLSID\ = "{BA5748AA-CD16-4D3F-82F8-AC17CDCA598C}" regsvr32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2404 wrote to memory of 2320 2404 regsvr32.exe 30 PID 2404 wrote to memory of 2320 2404 regsvr32.exe 30 PID 2404 wrote to memory of 2320 2404 regsvr32.exe 30 PID 2404 wrote to memory of 2320 2404 regsvr32.exe 30 PID 2404 wrote to memory of 2320 2404 regsvr32.exe 30 PID 2404 wrote to memory of 2320 2404 regsvr32.exe 30 PID 2404 wrote to memory of 2320 2404 regsvr32.exe 30 PID 2320 wrote to memory of 1620 2320 regsvr32.exe 31 PID 2320 wrote to memory of 1620 2320 regsvr32.exe 31 PID 2320 wrote to memory of 1620 2320 regsvr32.exe 31 PID 2320 wrote to memory of 1620 2320 regsvr32.exe 31
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\2a1ca62311fc416144f081e1b79fcb1cca40eb6da24de9916d6f90095440bf79N.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\2a1ca62311fc416144f081e1b79fcb1cca40eb6da24de9916d6f90095440bf79N.dll2⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\SysWOW64\regsvr32mgr.exeC:\Windows\SysWOW64\regsvr32mgr.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1620
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5d124f55b9393c976963407dff51ffa79
SHA12c7bbedd79791bfb866898c85b504186db610b5d
SHA256ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef
SHA512278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06
-
Filesize
1.1MB
MD59b98d47916ead4f69ef51b56b0c2323c
SHA1290a80b4ded0efc0fd00816f373fcea81a521330
SHA25696e0ae104c9662d0d20fdf59844c2d18334e5847b6c4fc7f8ce4b3b87f39887b
SHA51268b67021f228d8d71df4deb0b6388558b2f935a6aa466a12199cd37ada47ee588ea407b278d190d3a498b0ef3f5f1a2573a469b7ea5561ab2e7055c45565fe94
-
Filesize
97KB
MD5ef5dc2521333fb418bd5518f1db3fd08
SHA13d5e8d6dbf09a599f674fe9d6c1d736b0c31cb70
SHA25675bfc7c1f54f2579541c35f721a6bbd9083c7208bd989624ceb25f16bd03afbe
SHA5128768e95f5539dc61350f552d575c683e20e000f41283701c9c5f393da40975a02a7d432374c72565f3e1848266ee94e20d905f62b849f91f3c956b7980d87882