Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02-01-2025 10:55
Static task
static1
Behavioral task
behavioral1
Sample
6d4c72394bdc32c2c5dc69249b9775fd9951531ab75a4db13a60adb34af30194.dll
Resource
win7-20240903-en
General
-
Target
6d4c72394bdc32c2c5dc69249b9775fd9951531ab75a4db13a60adb34af30194.dll
-
Size
220KB
-
MD5
53e344a35b893f44c3b753766d8cd68e
-
SHA1
f5fe3d9a761b20b54afe397c70e1277f6d1fd2a4
-
SHA256
6d4c72394bdc32c2c5dc69249b9775fd9951531ab75a4db13a60adb34af30194
-
SHA512
14c85a970ba9f3abfbab7e81ec600a77f2ebc4c0db04d37ad2b4b98d822f7f155e429226ad901aac019081cc410c314e7bc209ba2510a6cc62378ecc0c1c74c3
-
SSDEEP
3072:Fn2PxxtyiPQLBvBt0M1qCWzJP0ruTTBaClHpspom7ffrAmpu:dO4LBf0dJ5TTBZbspom7bXM
Malware Config
Signatures
-
Ramnit family
-
Executes dropped EXE 1 IoCs
pid Process 2784 rundll32mgr.exe -
Loads dropped DLL 2 IoCs
pid Process 2656 rundll32.exe 2656 rundll32.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe -
resource yara_rule behavioral1/memory/2784-12-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/files/0x0007000000012117-10.dat upx behavioral1/memory/2784-17-0x0000000000400000-0x0000000000464000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2784 rundll32mgr.exe 2784 rundll32mgr.exe 2784 rundll32mgr.exe -
Suspicious behavior: MapViewOfSection 25 IoCs
pid Process 2784 rundll32mgr.exe 2784 rundll32mgr.exe 2784 rundll32mgr.exe 2784 rundll32mgr.exe 2784 rundll32mgr.exe 2784 rundll32mgr.exe 2784 rundll32mgr.exe 2784 rundll32mgr.exe 2784 rundll32mgr.exe 2784 rundll32mgr.exe 2784 rundll32mgr.exe 2784 rundll32mgr.exe 2784 rundll32mgr.exe 2784 rundll32mgr.exe 2784 rundll32mgr.exe 2784 rundll32mgr.exe 2784 rundll32mgr.exe 2784 rundll32mgr.exe 2784 rundll32mgr.exe 2784 rundll32mgr.exe 2784 rundll32mgr.exe 2784 rundll32mgr.exe 2784 rundll32mgr.exe 2784 rundll32mgr.exe 2784 rundll32mgr.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2784 rundll32mgr.exe Token: SeDebugPrivilege 2784 rundll32mgr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1876 wrote to memory of 2656 1876 rundll32.exe 30 PID 1876 wrote to memory of 2656 1876 rundll32.exe 30 PID 1876 wrote to memory of 2656 1876 rundll32.exe 30 PID 1876 wrote to memory of 2656 1876 rundll32.exe 30 PID 1876 wrote to memory of 2656 1876 rundll32.exe 30 PID 1876 wrote to memory of 2656 1876 rundll32.exe 30 PID 1876 wrote to memory of 2656 1876 rundll32.exe 30 PID 2656 wrote to memory of 2784 2656 rundll32.exe 31 PID 2656 wrote to memory of 2784 2656 rundll32.exe 31 PID 2656 wrote to memory of 2784 2656 rundll32.exe 31 PID 2656 wrote to memory of 2784 2656 rundll32.exe 31 PID 2784 wrote to memory of 380 2784 rundll32mgr.exe 3 PID 2784 wrote to memory of 380 2784 rundll32mgr.exe 3 PID 2784 wrote to memory of 380 2784 rundll32mgr.exe 3 PID 2784 wrote to memory of 380 2784 rundll32mgr.exe 3 PID 2784 wrote to memory of 380 2784 rundll32mgr.exe 3 PID 2784 wrote to memory of 380 2784 rundll32mgr.exe 3 PID 2784 wrote to memory of 380 2784 rundll32mgr.exe 3 PID 2784 wrote to memory of 388 2784 rundll32mgr.exe 4 PID 2784 wrote to memory of 388 2784 rundll32mgr.exe 4 PID 2784 wrote to memory of 388 2784 rundll32mgr.exe 4 PID 2784 wrote to memory of 388 2784 rundll32mgr.exe 4 PID 2784 wrote to memory of 388 2784 rundll32mgr.exe 4 PID 2784 wrote to memory of 388 2784 rundll32mgr.exe 4 PID 2784 wrote to memory of 388 2784 rundll32mgr.exe 4 PID 2784 wrote to memory of 428 2784 rundll32mgr.exe 5 PID 2784 wrote to memory of 428 2784 rundll32mgr.exe 5 PID 2784 wrote to memory of 428 2784 rundll32mgr.exe 5 PID 2784 wrote to memory of 428 2784 rundll32mgr.exe 5 PID 2784 wrote to memory of 428 2784 rundll32mgr.exe 5 PID 2784 wrote to memory of 428 2784 rundll32mgr.exe 5 PID 2784 wrote to memory of 428 2784 rundll32mgr.exe 5 PID 2784 wrote to memory of 472 2784 rundll32mgr.exe 6 PID 2784 wrote to memory of 472 2784 rundll32mgr.exe 6 PID 2784 wrote to memory of 472 2784 rundll32mgr.exe 6 PID 2784 wrote to memory of 472 2784 rundll32mgr.exe 6 PID 2784 wrote to memory of 472 2784 rundll32mgr.exe 6 PID 2784 wrote to memory of 472 2784 rundll32mgr.exe 6 PID 2784 wrote to memory of 472 2784 rundll32mgr.exe 6 PID 2784 wrote to memory of 488 2784 rundll32mgr.exe 7 PID 2784 wrote to memory of 488 2784 rundll32mgr.exe 7 PID 2784 wrote to memory of 488 2784 rundll32mgr.exe 7 PID 2784 wrote to memory of 488 2784 rundll32mgr.exe 7 PID 2784 wrote to memory of 488 2784 rundll32mgr.exe 7 PID 2784 wrote to memory of 488 2784 rundll32mgr.exe 7 PID 2784 wrote to memory of 488 2784 rundll32mgr.exe 7 PID 2784 wrote to memory of 496 2784 rundll32mgr.exe 8 PID 2784 wrote to memory of 496 2784 rundll32mgr.exe 8 PID 2784 wrote to memory of 496 2784 rundll32mgr.exe 8 PID 2784 wrote to memory of 496 2784 rundll32mgr.exe 8 PID 2784 wrote to memory of 496 2784 rundll32mgr.exe 8 PID 2784 wrote to memory of 496 2784 rundll32mgr.exe 8 PID 2784 wrote to memory of 496 2784 rundll32mgr.exe 8 PID 2784 wrote to memory of 608 2784 rundll32mgr.exe 9 PID 2784 wrote to memory of 608 2784 rundll32mgr.exe 9 PID 2784 wrote to memory of 608 2784 rundll32mgr.exe 9 PID 2784 wrote to memory of 608 2784 rundll32mgr.exe 9 PID 2784 wrote to memory of 608 2784 rundll32mgr.exe 9 PID 2784 wrote to memory of 608 2784 rundll32mgr.exe 9 PID 2784 wrote to memory of 608 2784 rundll32mgr.exe 9 PID 2784 wrote to memory of 688 2784 rundll32mgr.exe 10 PID 2784 wrote to memory of 688 2784 rundll32mgr.exe 10 PID 2784 wrote to memory of 688 2784 rundll32mgr.exe 10 PID 2784 wrote to memory of 688 2784 rundll32mgr.exe 10
Processes
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:380
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵PID:472
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵PID:608
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe4⤵PID:876
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵PID:1544
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵PID:688
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵PID:756
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵PID:832
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵PID:1184
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵PID:860
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵PID:980
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵PID:268
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵PID:544
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵PID:1052
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵PID:1128
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"3⤵PID:1180
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵PID:2148
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵PID:1932
-
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵PID:488
-
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:496
-
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:388
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:428
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1260
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6d4c72394bdc32c2c5dc69249b9775fd9951531ab75a4db13a60adb34af30194.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6d4c72394bdc32c2c5dc69249b9775fd9951531ab75a4db13a60adb34af30194.dll,#13⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2784
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
159KB
MD58703c6aeb2e62da71e50db9698d91e35
SHA1cafceda794c5b1976b46a5d39949137aba8dc9e6
SHA256c3a332de99e2b195bbb3e5927f8ee4217f968bc373f8c499db45db0b3388d47d
SHA51248e45868929fcacfa06c5078de2e54d32cfab80e5dd00036b37f3d55b33269f0ee82f46b68e7a6adc2ec9aecad8672393a77602c1b995133876c2c4e6d15229a