ramnit | 2fe1472d35d7b557a6c3ad59cca15ea968bced06e15a86f834a41687d357f1b1

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
10-01-2025 02:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-01-10_e1d03607f99283910378c874c016d48a_mafia_ramnit.exe
Size

1.9MB
MD5

e1d03607f99283910378c874c016d48a
SHA1

d861b91f3478a80a07599f7715e25ac56aedebdd
SHA256

2fe1472d35d7b557a6c3ad59cca15ea968bced06e15a86f834a41687d357f1b1
SHA512

1df7f840c0c62903aeaa955d2c9e0fa3552991d650a751d3d1f5beea9211f3c4b5fd47cc88cd1b633d4303e9d73544363df7af8a18db62ad0aa208561b61fe2d
SSDEEP

49152:SfH9d7Hq+fTD6aHf3IFLeVsxKaEwudNNNkeeBqocYdAt1HKgD9vB:SfdRHq+7OaHf4LxxKaEwudNNNkeekt1P

Score

10^/10

ramnit banker discovery spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Ramnit family
ramnit

Executes dropped EXE 4 IoCs

pid	Process
2896	2025-01-10_e1d03607f99283910378c874c016d48a_mafia_ramnitSrv.exe
2280	2025-01-10_e1d03607f99283910378c874c016d48a_mafia_ramnitSrvSrv.exe
1536	DesktopLayer.exe
588	DesktopLayerSrv.exe

Loads dropped DLL 4 IoCs

pid	Process
2988	2025-01-10_e1d03607f99283910378c874c016d48a_mafia_ramnit.exe
2896	2025-01-10_e1d03607f99283910378c874c016d48a_mafia_ramnitSrv.exe
2896	2025-01-10_e1d03607f99283910378c874c016d48a_mafia_ramnitSrv.exe
1536	DesktopLayer.exe

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000c00000001202c-2.dat	upx
behavioral1/memory/2988-3-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/files/0x0008000000016c66-9.dat	upx
behavioral1/memory/2896-8-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/memory/588-39-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2280-28-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/588-43-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/588-41-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2896-17-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/memory/2280-16-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/1536-46-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/memory/1536-36-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/memory/1536-33-0x0000000000230000-0x000000000025E000-memory.dmp	upx
behavioral1/memory/2280-24-0x0000000000400000-0x000000000042E000-memory.dmp	upx

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\pxBDF2.tmp	DesktopLayerSrv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	DesktopLayerSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxBDB4.tmp	2025-01-10_e1d03607f99283910378c874c016d48a_mafia_ramnitSrv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	2025-01-10_e1d03607f99283910378c874c016d48a_mafia_ramnitSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	2025-01-10_e1d03607f99283910378c874c016d48a_mafia_ramnitSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxBDD3.tmp	2025-01-10_e1d03607f99283910378c874c016d48a_mafia_ramnitSrvSrv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	2025-01-10_e1d03607f99283910378c874c016d48a_mafia_ramnitSrvSrv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe	DesktopLayer.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopLayerSrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-01-10_e1d03607f99283910378c874c016d48a_mafia_ramnit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-01-10_e1d03607f99283910378c874c016d48a_mafia_ramnitSrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-01-10_e1d03607f99283910378c874c016d48a_mafia_ramnitSrvSrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopLayer.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "442639080"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff5600000000000000dc04000065020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{25B42751-CEFD-11EF-9D85-5E63E904F626} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{25B688B1-CEFD-11EF-9D85-5E63E904F626} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2280	2025-01-10_e1d03607f99283910378c874c016d48a_mafia_ramnitSrvSrv.exe
2280	2025-01-10_e1d03607f99283910378c874c016d48a_mafia_ramnitSrvSrv.exe
2280	2025-01-10_e1d03607f99283910378c874c016d48a_mafia_ramnitSrvSrv.exe
2280	2025-01-10_e1d03607f99283910378c874c016d48a_mafia_ramnitSrvSrv.exe
588	DesktopLayerSrv.exe
588	DesktopLayerSrv.exe
588	DesktopLayerSrv.exe
588	DesktopLayerSrv.exe
1536	DesktopLayer.exe
1536	DesktopLayer.exe
1536	DesktopLayer.exe
1536	DesktopLayer.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2556	iexplore.exe
2752	iexplore.exe
2340	iexplore.exe

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
2988	2025-01-10_e1d03607f99283910378c874c016d48a_mafia_ramnit.exe
2988	2025-01-10_e1d03607f99283910378c874c016d48a_mafia_ramnit.exe
2556	iexplore.exe
2556	iexplore.exe
2752	iexplore.exe
2752	iexplore.exe
2864	IEXPLORE.EXE
2864	IEXPLORE.EXE
2868	IEXPLORE.EXE
2868	IEXPLORE.EXE
2340	iexplore.exe
2340	iexplore.exe
1252	IEXPLORE.EXE
1252	IEXPLORE.EXE
1252	IEXPLORE.EXE
1252	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 2896	2988	2025-01-10_e1d03607f99283910378c874c016d48a_mafia_ramnit.exe	30
PID 2988 wrote to memory of 2896	2988	2025-01-10_e1d03607f99283910378c874c016d48a_mafia_ramnit.exe	30
PID 2988 wrote to memory of 2896	2988	2025-01-10_e1d03607f99283910378c874c016d48a_mafia_ramnit.exe	30
PID 2988 wrote to memory of 2896	2988	2025-01-10_e1d03607f99283910378c874c016d48a_mafia_ramnit.exe	30
PID 2896 wrote to memory of 2280	2896	2025-01-10_e1d03607f99283910378c874c016d48a_mafia_ramnitSrv.exe	31
PID 2896 wrote to memory of 2280	2896	2025-01-10_e1d03607f99283910378c874c016d48a_mafia_ramnitSrv.exe	31
PID 2896 wrote to memory of 2280	2896	2025-01-10_e1d03607f99283910378c874c016d48a_mafia_ramnitSrv.exe	31
PID 2896 wrote to memory of 2280	2896	2025-01-10_e1d03607f99283910378c874c016d48a_mafia_ramnitSrv.exe	31
PID 2896 wrote to memory of 1536	2896	2025-01-10_e1d03607f99283910378c874c016d48a_mafia_ramnitSrv.exe	32
PID 2896 wrote to memory of 1536	2896	2025-01-10_e1d03607f99283910378c874c016d48a_mafia_ramnitSrv.exe	32
PID 2896 wrote to memory of 1536	2896	2025-01-10_e1d03607f99283910378c874c016d48a_mafia_ramnitSrv.exe	32
PID 2896 wrote to memory of 1536	2896	2025-01-10_e1d03607f99283910378c874c016d48a_mafia_ramnitSrv.exe	32
PID 2280 wrote to memory of 2556	2280	2025-01-10_e1d03607f99283910378c874c016d48a_mafia_ramnitSrvSrv.exe	33
PID 2280 wrote to memory of 2556	2280	2025-01-10_e1d03607f99283910378c874c016d48a_mafia_ramnitSrvSrv.exe	33
PID 2280 wrote to memory of 2556	2280	2025-01-10_e1d03607f99283910378c874c016d48a_mafia_ramnitSrvSrv.exe	33
PID 2280 wrote to memory of 2556	2280	2025-01-10_e1d03607f99283910378c874c016d48a_mafia_ramnitSrvSrv.exe	33
PID 1536 wrote to memory of 588	1536	DesktopLayer.exe	34
PID 1536 wrote to memory of 588	1536	DesktopLayer.exe	34
PID 1536 wrote to memory of 588	1536	DesktopLayer.exe	34
PID 1536 wrote to memory of 588	1536	DesktopLayer.exe	34
PID 588 wrote to memory of 2752	588	DesktopLayerSrv.exe	35
PID 588 wrote to memory of 2752	588	DesktopLayerSrv.exe	35
PID 588 wrote to memory of 2752	588	DesktopLayerSrv.exe	35
PID 588 wrote to memory of 2752	588	DesktopLayerSrv.exe	35
PID 2556 wrote to memory of 2864	2556	iexplore.exe	36
PID 2556 wrote to memory of 2864	2556	iexplore.exe	36
PID 2556 wrote to memory of 2864	2556	iexplore.exe	36
PID 2556 wrote to memory of 2864	2556	iexplore.exe	36
PID 2752 wrote to memory of 2868	2752	iexplore.exe	37
PID 2752 wrote to memory of 2868	2752	iexplore.exe	37
PID 2752 wrote to memory of 2868	2752	iexplore.exe	37
PID 2752 wrote to memory of 2868	2752	iexplore.exe	37
PID 1536 wrote to memory of 2340	1536	DesktopLayer.exe	38
PID 1536 wrote to memory of 2340	1536	DesktopLayer.exe	38
PID 1536 wrote to memory of 2340	1536	DesktopLayer.exe	38
PID 1536 wrote to memory of 2340	1536	DesktopLayer.exe	38
PID 2340 wrote to memory of 1252	2340	iexplore.exe	39
PID 2340 wrote to memory of 1252	2340	iexplore.exe	39
PID 2340 wrote to memory of 1252	2340	iexplore.exe	39
PID 2340 wrote to memory of 1252	2340	iexplore.exe	39

C:\Users\Admin\AppData\Local\Temp\2025-01-10_e1d03607f99283910378c874c016d48a_mafia_ramnit.exe
"C:\Users\Admin\AppData\Local\Temp\2025-01-10_e1d03607f99283910378c874c016d48a_mafia_ramnit.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Users\Admin\AppData\Local\Temp\2025-01-10_e1d03607f99283910378c874c016d48a_mafia_ramnitSrv.exe
  C:\Users\Admin\AppData\Local\Temp\2025-01-10_e1d03607f99283910378c874c016d48a_mafia_ramnitSrv.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2896
- - C:\Users\Admin\AppData\Local\Temp\2025-01-10_e1d03607f99283910378c874c016d48a_mafia_ramnitSrvSrv.exe
    C:\Users\Admin\AppData\Local\Temp\2025-01-10_e1d03607f99283910378c874c016d48a_mafia_ramnitSrvSrv.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2280
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2556
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2556 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2864
- - C:\Program Files (x86)\Microsoft\DesktopLayer.exe
    "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1536
  - - C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe
      "C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:588
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2752
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2752 CREDAT:275457 /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2868
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2340
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2340 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
96fc71ed5fe43b51c1ecc55d4ae62061

SHA1
116870049405299d6b9cc39ff8e5ecc46ec7b5e9

SHA256
d064aac368281b5005fee859a4f70d64f92aa73d40699dac236cedc430994689

SHA512
500ac8aa389a9caab65a20541a498bbfaf85419dd98b648c62e017519b12c2dc8c73c73cfa5f9b034a3225979c16d3e559edeed7a649930099fc01d7fffc04f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4bc40b0fd23bbfc7f46787b2b4a4648f

SHA1
789f6b730059738ecaaeb10f9c13fddd00b87743

SHA256
106af7e360d0b6f15f0199a38cc7d57130b2fec9175e85dad4a25c1269186c57

SHA512
585e1f181690be3c32e183b5e3c6b71b94ab20af3a8a7de48f8f812f8d15ead821f2076bc645a469b37b528cab7142c8c7b3a443d52c50923cba81df8862af15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
da7eff9e4cd9abe240d6810194d93017

SHA1
d68c142d010f9adc9d9975067d0ffb9e711728d7

SHA256
20b0e630ce13d0f08b7c6daf27d25698057bc5ee50c4a4fd6079ec1a36328981

SHA512
82c4b0a810a25b2bebf3afd41f82ea85e7149097c43e97ce1a8222ee2e348a6ee9efb5062b49746dd77db63f09cf6b81ba174d3b068bede9777aa5b28e5f75ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
00c6999bbba314490783892f66a78e34

SHA1
afe8eeaa7c8737e8633a0e687d12c92b055ff41d

SHA256
5c15703b6eaaa78860b766aa326a6d006d1b0647b4db82f4c5ccd12472a50846

SHA512
8de3eeb74a1887910f10c11f01f3c13da9897bc11e1dbf102ed2bc0b5aa04cf7312224ebf1510c24e13f598196fcebcffa695ceaae670e9fed8da33e3b05b473

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
361b2f2b3a3b5614823691731af7b2d7

SHA1
ae170b0554d7d077109585be1e94c725235cf67b

SHA256
c0f6ef0b6d6b2e198488f59037c75ad4249b5a73799661593d32c1e187dc760f

SHA512
15b8e279639db52cd16ff831c92c16412c71b529f990264ca4e6de3de719858d78ea17e28d6ab25cc25140d91dcdef7e05549460e63c6dfe058d50ffdd93e015

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b242ecd79e223c9998c30ddf4cb5a474

SHA1
d3dbc9eee800271f0862737878e5aed6ad3ae628

SHA256
42660b9bc2bf2b5699e42bcedc5f03c14433609fd3f5588133b9f77ff39d0717

SHA512
d8556a735d5623365033929bc0cfba7355099cdeb88c89572ed8f9f31961965204a451a28fd4fb81c5569c5d23bc0bf5135afa9eccee6dbc4d9238c3e74f04e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf76153f44ac66a8dfafb2ebaaa92e7e

SHA1
66c06e2105a2ddb85224de8e2f69086fa8118671

SHA256
f6a27c67b396ffac90e4483e9ddb58aee82ff46d73b5cbb3bf21bcc4f001b7a0

SHA512
7297b628576e1c857fd078e8c3ba392bae5a23a1af9355f9bdc9ef8704d5a6b4d124a589eec3be64a0d9e4c9fac3bf59fc8183a98a7d3a18efd386add5d9189f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
28f8371d29695134c43042fcc089ec8d

SHA1
515b58e26966f480e25aa13ab2999730ff7eb486

SHA256
479e221b9dc72608c8ce4bdf723d37657df0768ec63a7d23c9d1d1c5a30a129f

SHA512
dd74729ba72154dacbd4c8ee12ca15eb0858f0c636c29b2847bf72d610fd9386717d0cdcb4e0a9a48e562ab55d23cc31cd55f91309d9a295260daf9e76593bc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d27749ce9016ebf9e7c04f6ad19d518

SHA1
eff04432b78e908fe2d232c4e79435ff10593479

SHA256
59b04666eadfcfcbd372caaf810903d1093edb39d479f0f551ac70006a9db138

SHA512
f33ffc66ee2ea30dc175b0bc6b27149d99eb3d85156bb223c529fca3fe348779260eda39e0c143769f5e3fe77c1c6031eb2713d31bfd456eeb12cfeccb6a75b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
66401d9a423fe8f8851c01bf18a9f768

SHA1
18046b92122e1576e8d44568b6c7ec7e1c06022a

SHA256
bd9fe0c32a944ea703f350eb24d66833b4287b428af68585e63065921b2658af

SHA512
cf841ed8b81ab51f4d4b5e01846a3d56b28727d1010ed4ee8d1eeebf5689c7410b05e3fcfa9516b80662f24c3e198cdec948bec60cda9f4b317a2bf1f41dbcaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6d98ec547d0de770f70c180e750bd33c

SHA1
90de1d37c8475e739497a095c35ffb2b0076f30d

SHA256
f15fc3aad7b01ce200487b44dca4880a48091acc40d56bc447d4f7b73e6fd538

SHA512
e651d9ea88eae658faf81b164eb333eb0a2251b8fa9be2789ae5b81c65e95c0a31831fcf7518f0fa03581c14d32170aea79106405b18e11a977e130509c1ce51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a6c379beffada85681b078622cdd565

SHA1
441558b0f0e8427376f6a93b52cd5bcb61d025eb

SHA256
47f09bfd7a1915bf1baa43a0ca21bbcb61117934fdc961f626395cea1ea463c6

SHA512
b245792d03b95501371de83d55aa3191764c856cfbc6f8ae29abefd8517b211e289de841b46e48c9af4f47b2eda6c9a3e529f26078e5919b8d13db86c52df8c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
488ccf57add7d230e47bbc2c85ef303d

SHA1
d5b9f3ae9b7c68e698f593fc41eca690f9c90722

SHA256
f1779319671c9d825d6230799f2f78eb1d2b93cbf72daf34dbe423662483302e

SHA512
73a144a173389d8a5c6259e7c79d5a5c0f448f87e44d3c52a13f9894cc4b3f742abb00754ca2377da48ffdffb0615a31884ce564c779e610f1121becd7cc6a5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
41b027ae7a93a38afb92c72ddd2f758b

SHA1
a3dc610037bd5d36b544ac8c0982d3b7c1e15a89

SHA256
7bf0cf9ff286280b0e48f30b4700592d541057739468ae5cc80698de7a3603ed

SHA512
0443c19a4a126f35a2ff31d1ee4450c473ca7685e942a2ece4be19b5f046797cc033d0d26e7718d1b6e9c693200b37bdc85273809a4c221a7648f8d8aaa44870

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c4eac4437e8283ef10053dd8e22693dd

SHA1
65609bb98de9ca0f800370087bc50cc3b452e8cb

SHA256
1ec985cc2c9bba7c09d47877faf8e5fd82fa27a1c5f6441fa1f25c00ecf53859

SHA512
a525c1038e630a398325e7fde204ef14bd5a282c7899ad3c26f21de2d8fc4980a65ba20b2ee9d261d8be89c73a61ae0201987efc595da789185dd8f6f02c3dea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
190a4ad9576520102d1ccd40e8cb4177

SHA1
af36f678e846b228d788feb3f3a683c04573be82

SHA256
c8264db8fd2ca7bdea320ed418b7c0335679e82f1881fe885aaed6b1cac6a937

SHA512
c5382b7267b04c752fa5ad102a50e12e760ca63f0176d4a968aa0eca84b590792d6f5fe1c4d99c454141183bcaf20ac17a164cb2cc48d04993bcf7b81bd00d33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59b78a33f539e39f04662100ec121409

SHA1
9cf9df933fe271f557eeb6d1befbd0f9e997c7d6

SHA256
9adcd9ccf60422dcf3239d8d31d7b93c13a477bd687965da207b9665508ce6dc

SHA512
1123ae4eeaed2b4b4a5ac320e89233ff1286de75151ac2a985e01b9f2e415646e32fabcd15becae8b387e0bed26a44dfa93cc00fbf5d2d49f1863492a2de0f2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
82793a3a9d1dab3ecdf9506586f6c173

SHA1
1c59622bcaaea08acce2e461c7677f3a2fa01b09

SHA256
e4d4b61cc747ecfa0c943cd8554d5fab75c94a7ab9bac5959c060a684453ff80

SHA512
a3fcde068dcf0ea51b5e59c42d95655e5f8228cf91d2550c53bb8fa0ff549ca7403fa8eb997c94a58dc541337fb3356e73382ca2295596e2b6b11e3b42f79195

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{25B42751-CEFD-11EF-9D85-5E63E904F626}.dat

Filesize
5KB

MD5
a79fd6d9df2e1fa890162d5fc0a4a01c

SHA1
45d05e0f53d7b25bbd48aa512f7775a889f5cb4f

SHA256
3228438c3fdce67f6450df55b7398483704e6e86690fe70cc7592b6287243c62

SHA512
b048ea324a75d07f8668cbf07b5124eeae1c0bc22740bf57fbcf70d9112e59a2151ac1de0e737f7add571081f1a959cdaca4c6ca7778bab2d14325dde5c50e4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{25B688B1-CEFD-11EF-9D85-5E63E904F626}.dat

Filesize
4KB

MD5
ddc6849468772ab434e15785ed09d1d4

SHA1
42303134478a8adcb73d985518e3b1f82065adac

SHA256
d19684ea5a05a3c6bfa7d477fdae32a4f966c914921055cf4792998980942737

SHA512
71a271a61af325c202f11f9856c0fae3b7faf620c9e439f958585b1eb6b8173c2a8833da4c4529825b8a6ad11e5e1b9d2a72de720adc4f85e1fb6877a95106c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{25B688B1-CEFD-11EF-9D85-5E63E904F626}.dat

Filesize
5KB

MD5
9811fd17a359d427c5b105ce569ff237

SHA1
9bef2c19c76de313183719baf6daa6c635b630fe

SHA256
59a540a50c2c8c9e9c08415b54cbcc964615be3476e0ec9631829da61fcae085

SHA512
ba58ce369e49391d4c1e77e9184e440d07279b1a764a742c44f10bfc5b9f7659df23df782cc916a6a632e64bab145b8271652750c0a1bdb698328fa623d9ebab

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDE50.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDF01.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
\Users\Admin\AppData\Local\Temp\2025-01-10_e1d03607f99283910378c874c016d48a_mafia_ramnitSrv.exe

Filesize
111KB

MD5
0807f983542add1cd3540a715835595e

SHA1
f7e1bca5b50ab319e5bfc070a3648d2facb940eb

SHA256
8b492fd5118993f8adb4ddbba5371a827fa96ff69699fe82286ad3a92758bf5f

SHA512
27161f765072f32977bfae3737a804492251514bd256336ed9eee985a760f11c8c778bfb45760bdbf94cb69ed49fa6831f2700548a290412a577fbc70a5b7d77

Download Submit
\Users\Admin\AppData\Local\Temp\2025-01-10_e1d03607f99283910378c874c016d48a_mafia_ramnitSrvSrv.exe

Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
memory/588-43-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/588-39-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/588-41-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1536-33-0x0000000000230000-0x000000000025E000-memory.dmp

Filesize
184KB

Download
memory/1536-36-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1536-46-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1536-451-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2280-24-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2280-28-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2280-16-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2280-26-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2896-17-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2896-8-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2896-20-0x00000000005D0000-0x000000000060D000-memory.dmp

Filesize
244KB

Download
memory/2896-11-0x00000000003D0000-0x00000000003FE000-memory.dmp

Filesize
184KB

Download
memory/2988-29-0x0000000000B30000-0x0000000000D25000-memory.dmp

Filesize
2.0MB

Download
memory/2988-3-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2988-0-0x0000000000B30000-0x0000000000D25000-memory.dmp

Filesize
2.0MB

Download