ramnit | 4e491700cade6ef9f5aa1cea4377a9c9c992597a0925bd1b8d42725765eb79b4

Analysis

max time kernel
150s
max time network
142s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-01-2025 13:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_65565b8d5a9a931960a71bf640f487c0.dll
Size

130KB
MD5

65565b8d5a9a931960a71bf640f487c0
SHA1

4bc5782d7cc0e51a9f321636e3311513e1c71109
SHA256

4e491700cade6ef9f5aa1cea4377a9c9c992597a0925bd1b8d42725765eb79b4
SHA512

1e78a1ea55519d80c5a65009145ec10ad15cd72c67d609fdc37d359126f6dcccca555fd1bf98bf726dbce465090ce720d040ead93d4ae363bbb2dac216987cb3
SSDEEP

1536:O2ZtHYphL6ITFRQyB9hNO2LG0lejqVBjKw/GWs/uv8kS1Y5/f/37ITIGykhx0W3z:OqITFRQyBBjLfnTDJL/H37ITIni5JF8W

Score

10^/10

ramnit banker discovery persistence spyware stealer trojan upx worm

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe"	svchost.exe

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Ramnit family
ramnit

Executes dropped EXE 2 IoCs

pid	Process
2184	rundll32mgr.exe
2676	WaterMark.exe

Loads dropped DLL 4 IoCs

pid	Process
3040	rundll32.exe
3040	rundll32.exe
2184	rundll32mgr.exe
2184	rundll32mgr.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe
File created	C:\Windows\SysWOW64\dmlconf.dat	svchost.exe
File opened for modification	C:\Windows\SysWOW64\dmlconf.dat	svchost.exe

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2184-13-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2184-12-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2184-20-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2184-18-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2184-17-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2676-36-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2676-40-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2184-14-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2184-15-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2676-87-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2676-658-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\System\Ole DB\msdaosp.dll	svchost.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\WindowsBase.resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libcvdsub_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Orange Circles.htm	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_http_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\clock.html	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\currency.html	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEOLEDB.DLL	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Csi.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationCore.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.ComponentModel.DataAnnotations.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_rist_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libflacsys_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\librv32_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\clock.html	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\msvcr100.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\JdbcOdbc.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libadummy_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\spu\libmosaic_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_output\libglinterop_dxva2_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\PhotoBase.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\calendar.html	svchost.exe
File opened for modification	C:\Program Files\Common Files\System\wab32.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libtta_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\RSSFeeds.html	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdaterInstallMgr.exe	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\WebKit.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe	svchost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\api-ms-win-crt-process-l1-1-0.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Engine.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libpuzzle_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libsepia_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Mail\wabimp.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\imjplm.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\JdbcOdbc.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\currency.html	svchost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe	svchost.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpshare.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\sunmscapi.dll	svchost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\api-ms-win-crt-stdio-l1-1-0.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\control\libwin_msg_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libantiflicker_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\DVD Maker\OmdBase.dll	svchost.exe
File opened for modification	C:\Program Files\Internet Explorer\msdbg2.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\epl-v10.html	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\dt_socket.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\jfxwebkit.dll	svchost.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Checkers\Chkr.dll	svchost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Conversion.v3.5.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlm.html	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libsimple_channel_mixer_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libnuv_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\UIAutomationTypes.resources.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\System\DirectDB.dll	svchost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\api-ms-win-crt-multibyte-l1-1-0.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.Printing.resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_copy_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libblendbench_plugin.dll	svchost.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32mgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaterMark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
2676	WaterMark.exe
2676	WaterMark.exe
2676	WaterMark.exe
2676	WaterMark.exe
2676	WaterMark.exe
2676	WaterMark.exe
2676	WaterMark.exe
2676	WaterMark.exe
2864	svchost.exe
2864	svchost.exe
2864	svchost.exe
2864	svchost.exe
2864	svchost.exe
2864	svchost.exe
2864	svchost.exe
2864	svchost.exe
2864	svchost.exe
2864	svchost.exe
2864	svchost.exe
2864	svchost.exe
2864	svchost.exe
2864	svchost.exe
2864	svchost.exe
2864	svchost.exe
2864	svchost.exe
2864	svchost.exe
2864	svchost.exe
2864	svchost.exe
2864	svchost.exe
2864	svchost.exe
2864	svchost.exe
2864	svchost.exe
2864	svchost.exe
2864	svchost.exe
2864	svchost.exe
2864	svchost.exe
2864	svchost.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2676	WaterMark.exe
Token: SeDebugPrivilege	2864	svchost.exe
Token: SeDebugPrivilege	2676	WaterMark.exe
Token: SeDebugPrivilege	3040	rundll32.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2184	rundll32mgr.exe
2676	WaterMark.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 3040	2956	rundll32.exe	31
PID 2956 wrote to memory of 3040	2956	rundll32.exe	31
PID 2956 wrote to memory of 3040	2956	rundll32.exe	31
PID 2956 wrote to memory of 3040	2956	rundll32.exe	31
PID 2956 wrote to memory of 3040	2956	rundll32.exe	31
PID 2956 wrote to memory of 3040	2956	rundll32.exe	31
PID 2956 wrote to memory of 3040	2956	rundll32.exe	31
PID 3040 wrote to memory of 2184	3040	rundll32.exe	32
PID 3040 wrote to memory of 2184	3040	rundll32.exe	32
PID 3040 wrote to memory of 2184	3040	rundll32.exe	32
PID 3040 wrote to memory of 2184	3040	rundll32.exe	32
PID 2184 wrote to memory of 2676	2184	rundll32mgr.exe	33
PID 2184 wrote to memory of 2676	2184	rundll32mgr.exe	33
PID 2184 wrote to memory of 2676	2184	rundll32mgr.exe	33
PID 2184 wrote to memory of 2676	2184	rundll32mgr.exe	33
PID 2676 wrote to memory of 2332	2676	WaterMark.exe	34
PID 2676 wrote to memory of 2332	2676	WaterMark.exe	34
PID 2676 wrote to memory of 2332	2676	WaterMark.exe	34
PID 2676 wrote to memory of 2332	2676	WaterMark.exe	34
PID 2676 wrote to memory of 2332	2676	WaterMark.exe	34
PID 2676 wrote to memory of 2332	2676	WaterMark.exe	34
PID 2676 wrote to memory of 2332	2676	WaterMark.exe	34
PID 2676 wrote to memory of 2332	2676	WaterMark.exe	34
PID 2676 wrote to memory of 2332	2676	WaterMark.exe	34
PID 2676 wrote to memory of 2332	2676	WaterMark.exe	34
PID 2676 wrote to memory of 2864	2676	WaterMark.exe	35
PID 2676 wrote to memory of 2864	2676	WaterMark.exe	35
PID 2676 wrote to memory of 2864	2676	WaterMark.exe	35
PID 2676 wrote to memory of 2864	2676	WaterMark.exe	35
PID 2676 wrote to memory of 2864	2676	WaterMark.exe	35
PID 2676 wrote to memory of 2864	2676	WaterMark.exe	35
PID 2676 wrote to memory of 2864	2676	WaterMark.exe	35
PID 2676 wrote to memory of 2864	2676	WaterMark.exe	35
PID 2676 wrote to memory of 2864	2676	WaterMark.exe	35
PID 2676 wrote to memory of 2864	2676	WaterMark.exe	35
PID 2864 wrote to memory of 256	2864	svchost.exe	1
PID 2864 wrote to memory of 256	2864	svchost.exe	1
PID 2864 wrote to memory of 256	2864	svchost.exe	1
PID 2864 wrote to memory of 256	2864	svchost.exe	1
PID 2864 wrote to memory of 256	2864	svchost.exe	1
PID 2864 wrote to memory of 336	2864	svchost.exe	2
PID 2864 wrote to memory of 336	2864	svchost.exe	2
PID 2864 wrote to memory of 336	2864	svchost.exe	2
PID 2864 wrote to memory of 336	2864	svchost.exe	2
PID 2864 wrote to memory of 336	2864	svchost.exe	2
PID 2864 wrote to memory of 384	2864	svchost.exe	3
PID 2864 wrote to memory of 384	2864	svchost.exe	3
PID 2864 wrote to memory of 384	2864	svchost.exe	3
PID 2864 wrote to memory of 384	2864	svchost.exe	3
PID 2864 wrote to memory of 384	2864	svchost.exe	3
PID 2864 wrote to memory of 392	2864	svchost.exe	4
PID 2864 wrote to memory of 392	2864	svchost.exe	4
PID 2864 wrote to memory of 392	2864	svchost.exe	4
PID 2864 wrote to memory of 392	2864	svchost.exe	4
PID 2864 wrote to memory of 392	2864	svchost.exe	4
PID 2864 wrote to memory of 432	2864	svchost.exe	5
PID 2864 wrote to memory of 432	2864	svchost.exe	5
PID 2864 wrote to memory of 432	2864	svchost.exe	5
PID 2864 wrote to memory of 432	2864	svchost.exe	5
PID 2864 wrote to memory of 432	2864	svchost.exe	5
PID 2864 wrote to memory of 476	2864	svchost.exe	6
PID 2864 wrote to memory of 476	2864	svchost.exe	6
PID 2864 wrote to memory of 476	2864	svchost.exe	6
PID 2864 wrote to memory of 476	2864	svchost.exe	6

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe
1⤵
PID:256

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:336

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:384
- C:\Windows\system32\services.exe
  C:\Windows\system32\services.exe
  2⤵
  PID:476
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    3⤵
    PID:604
  - - C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
      4⤵
      PID:316
  - - C:\Windows\system32\wbem\wmiprvse.exe
      C:\Windows\system32\wbem\wmiprvse.exe
      4⤵
      PID:1712
  - - C:\Windows\system32\wbem\wmiprvse.exe
      C:\Windows\system32\wbem\wmiprvse.exe -Embedding
      4⤵
      PID:2844
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    3⤵
    PID:684
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    3⤵
    PID:752
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    3⤵
    PID:820
  - - C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      4⤵
      PID:1164
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    3⤵
    PID:848
  - - \\?\C:\Windows\system32\wbem\WMIADAP.EXE
      wmiadap.exe /F /T /R
      4⤵
      PID:2996
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService
    3⤵
    PID:968
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    3⤵
    PID:112
- - C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    3⤵
    PID:1008
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    3⤵
    PID:1068
- - C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    3⤵
    PID:1112
- - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
    "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
    3⤵
    PID:1052
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    3⤵
    PID:1920
- - C:\Windows\system32\sppsvc.exe
    C:\Windows\system32\sppsvc.exe
    3⤵
    PID:2180
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:492
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:500

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:392

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:432

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1232
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_65565b8d5a9a931960a71bf640f487c0.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2956
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_65565b8d5a9a931960a71bf640f487c0.dll,#1
    3⤵
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3040
  - - C:\Windows\SysWOW64\rundll32mgr.exe
      C:\Windows\SysWOW64\rundll32mgr.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of UnmapMainImage
      Suspicious use of WriteProcessMemory
      PID:2184
    - - C:\Program Files (x86)\Microsoft\WaterMark.exe
        
        "C:\Program Files (x86)\Microsoft\WaterMark.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of UnmapMainImage
        Suspicious use of WriteProcessMemory
        
        PID:2676
      - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        6⤵
        Modifies WinLogon for persistence
        Drops file in System32 directory
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        
        PID:2332
      - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

Filesize
133KB

MD5
cdffd4cae4ca41f109d1a49675f3e786

SHA1
30f50485d57b667b4cbae750591c999d1f07a512

SHA256
6bbf9df54f76af20740d390fa3cf05323cc0523fcf86d7f5f28044ae40978ca7

SHA512
1696b3dbaf228237fb4087692f886a17d58b5be34de31f66a76278a41fe7a88775cf7604abf82ed518133dfc74604f93cfb02631855621f0ff25ac70685e49e6

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

Filesize
129KB

MD5
628cfc49a51d081c7baf8bb68333411f

SHA1
3f55b5cd88e03c3a8277ee228b200be4e532f044

SHA256
0a45fe53c63aa05bc68c95d8fc94800f33de86e4ac85180036ea8ed6ea56b2cb

SHA512
69bdd8d385b71dc205e9db76a6c45363d78b665b906b61f48b9aaf9e31c0698cdc0b8e7f29f57363a7842ad53359e7280f6993e984607626b6f74e651374748e

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
59KB

MD5
ce86bf0cae51eef1bba5b28557a5aec6

SHA1
9eef50bb22b2a73e284a98c216d79678dd929507

SHA256
28d6afcecd58954d962e95badfb05d2d4e6297a6aeeb758bcf97c325e658936b

SHA512
2974ee8cebd2688ef65edec87ba65cafd32662e424ab11ea14a8ef705b6f46aedd0447735e561ba8df0508c12a84fdf3916f4389fe1baa3f54ab94236ef8a995

Download Submit
memory/2184-14-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2184-11-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2184-13-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2184-12-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2184-20-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2184-18-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2184-17-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2184-16-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/2184-15-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2332-54-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2332-62-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2332-395-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2332-67-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2332-60-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2332-59-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/2332-46-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2332-44-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2332-55-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2332-53-0x00000000000A0000-0x00000000000A1000-memory.dmp

Filesize
4KB

Download
memory/2676-658-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2676-36-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2676-40-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2676-31-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2676-41-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2676-71-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2676-42-0x00000000779AF000-0x00000000779B0000-memory.dmp

Filesize
4KB

Download
memory/2676-87-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2676-90-0x00000000779AF000-0x00000000779B0000-memory.dmp

Filesize
4KB

Download
memory/2864-93-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/2864-88-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/2864-94-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2864-82-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2864-91-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2864-92-0x00000000779B0000-0x00000000779B1000-memory.dmp

Filesize
4KB

Download
memory/2864-86-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2864-89-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2864-73-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/3040-10-0x00000000002B0000-0x00000000002D3000-memory.dmp

Filesize
140KB

Download
memory/3040-3-0x00000000002B0000-0x00000000002D3000-memory.dmp

Filesize
140KB

Download
memory/3040-1-0x0000000010000000-0x0000000010024000-memory.dmp

Filesize
144KB

Download