emotet | 02a508a6ff8c53a9b4f43420ef555b84e843eec59c126aa603ee8795e0d85906

Analysis

max time kernel
145s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27/02/2025, 07:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-02-27_fc30ec71b2fd21590f76a2bed1384c96_icedid_ramnit.exe
Size

435KB
MD5

fc30ec71b2fd21590f76a2bed1384c96
SHA1

e3cc47fae54161eccf48aaaf95817ce007051113
SHA256

02a508a6ff8c53a9b4f43420ef555b84e843eec59c126aa603ee8795e0d85906
SHA512

32f59eb090475e12184b9967694b4fb5d8dcb2e7db8532c2deaf50597ec44a3d6bb1f7e7aa18be6afe6e6f4c806b778ab69c8e22c610930aa1caa9f276599054
SSDEEP

12288:dRX3wK9rybO3AlLBeTWi+eO6e2ZwgL7OG+pG/YD:dRX3wK9ruO3Alpi+eO6e2ZwBgYD

Score

10^/10

emotet ramnit epoch3 banker discovery spyware stealer trojan upx worm

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

41.169.20.147:8090

72.10.33.195:8080

177.0.241.28:80

82.165.15.188:8080

190.111.215.4:8080

46.49.124.53:80

190.63.7.166:8080

45.118.136.92:8080

220.128.125.18:80

178.153.214.228:80

139.59.12.63:8080

163.172.107.70:8080

190.251.235.239:80

46.32.229.152:8080

78.188.170.128:80

110.44.113.2:8080

77.74.78.80:443

37.70.131.107:80

188.0.135.237:80

188.251.213.180:443

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Emotet family
emotet
Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Ramnit family
ramnit

Executes dropped EXE 2 IoCs

pid	Process
2576	2025-02-27_fc30ec71b2fd21590f76a2bed1384c96_icedid_ramnitmgr.exe
2804	KBDCAmgr.exe

Loads dropped DLL 4 IoCs

pid	Process
1356	2025-02-27_fc30ec71b2fd21590f76a2bed1384c96_icedid_ramnit.exe
1356	2025-02-27_fc30ec71b2fd21590f76a2bed1384c96_icedid_ramnit.exe
2656	KBDCA.exe
2656	KBDCA.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\KBDCA\KBDCAmgr.exe	KBDCA.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00090000000120f9-4.dat	upx
behavioral1/memory/2576-11-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral1/memory/2576-17-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral1/memory/2804-39-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral1/memory/2804-35-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral1/memory/2804-34-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral1/memory/2656-29-0x0000000000610000-0x000000000066D000-memory.dmp	upx
behavioral1/memory/2804-37-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral1/memory/2576-44-0x0000000000400000-0x000000000045D000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KBDCAmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-02-27_fc30ec71b2fd21590f76a2bed1384c96_icedid_ramnit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-02-27_fc30ec71b2fd21590f76a2bed1384c96_icedid_ramnitmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KBDCA.exe

Modifies Internet Explorer settings 1 TTPs 55 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{74F5B951-F4DC-11EF-AD2E-6E295C7D81A3} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{74F36F61-F4DC-11EF-AD2E-6E295C7D81A3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff5600000000000000dc04000065020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff6f00000019000000f50400007e020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "446803184"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
2576	2025-02-27_fc30ec71b2fd21590f76a2bed1384c96_icedid_ramnitmgr.exe
2576	2025-02-27_fc30ec71b2fd21590f76a2bed1384c96_icedid_ramnitmgr.exe
2576	2025-02-27_fc30ec71b2fd21590f76a2bed1384c96_icedid_ramnitmgr.exe
2576	2025-02-27_fc30ec71b2fd21590f76a2bed1384c96_icedid_ramnitmgr.exe
2576	2025-02-27_fc30ec71b2fd21590f76a2bed1384c96_icedid_ramnitmgr.exe
2576	2025-02-27_fc30ec71b2fd21590f76a2bed1384c96_icedid_ramnitmgr.exe
2576	2025-02-27_fc30ec71b2fd21590f76a2bed1384c96_icedid_ramnitmgr.exe
2576	2025-02-27_fc30ec71b2fd21590f76a2bed1384c96_icedid_ramnitmgr.exe
2804	KBDCAmgr.exe
2804	KBDCAmgr.exe
2804	KBDCAmgr.exe
2804	KBDCAmgr.exe
2804	KBDCAmgr.exe
2804	KBDCAmgr.exe
2804	KBDCAmgr.exe
2804	KBDCAmgr.exe
2656	KBDCA.exe
2656	KBDCA.exe
2656	KBDCA.exe
2656	KBDCA.exe
2656	KBDCA.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1356	2025-02-27_fc30ec71b2fd21590f76a2bed1384c96_icedid_ramnit.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2576	2025-02-27_fc30ec71b2fd21590f76a2bed1384c96_icedid_ramnitmgr.exe
Token: SeDebugPrivilege	2804	KBDCAmgr.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2720	iexplore.exe
2716	iexplore.exe
2720	iexplore.exe
2720	iexplore.exe

Suspicious use of SetWindowsHookEx 22 IoCs

pid	Process
1356	2025-02-27_fc30ec71b2fd21590f76a2bed1384c96_icedid_ramnit.exe
1356	2025-02-27_fc30ec71b2fd21590f76a2bed1384c96_icedid_ramnit.exe
2716	iexplore.exe
2716	iexplore.exe
2720	iexplore.exe
2720	iexplore.exe
2792	IEXPLORE.EXE
2792	IEXPLORE.EXE
600	IEXPLORE.EXE
600	IEXPLORE.EXE
2656	KBDCA.exe
2656	KBDCA.exe
2720	iexplore.exe
2720	iexplore.exe
2720	iexplore.exe
2720	iexplore.exe
1604	IEXPLORE.EXE
1604	IEXPLORE.EXE
1604	IEXPLORE.EXE
1604	IEXPLORE.EXE
1604	IEXPLORE.EXE
1604	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 1356 wrote to memory of 2576	1356	2025-02-27_fc30ec71b2fd21590f76a2bed1384c96_icedid_ramnit.exe	30
PID 1356 wrote to memory of 2576	1356	2025-02-27_fc30ec71b2fd21590f76a2bed1384c96_icedid_ramnit.exe	30
PID 1356 wrote to memory of 2576	1356	2025-02-27_fc30ec71b2fd21590f76a2bed1384c96_icedid_ramnit.exe	30
PID 1356 wrote to memory of 2576	1356	2025-02-27_fc30ec71b2fd21590f76a2bed1384c96_icedid_ramnit.exe	30
PID 2576 wrote to memory of 2716	2576	2025-02-27_fc30ec71b2fd21590f76a2bed1384c96_icedid_ramnitmgr.exe	31
PID 2576 wrote to memory of 2716	2576	2025-02-27_fc30ec71b2fd21590f76a2bed1384c96_icedid_ramnitmgr.exe	31
PID 2576 wrote to memory of 2716	2576	2025-02-27_fc30ec71b2fd21590f76a2bed1384c96_icedid_ramnitmgr.exe	31
PID 2576 wrote to memory of 2716	2576	2025-02-27_fc30ec71b2fd21590f76a2bed1384c96_icedid_ramnitmgr.exe	31
PID 2576 wrote to memory of 2720	2576	2025-02-27_fc30ec71b2fd21590f76a2bed1384c96_icedid_ramnitmgr.exe	32
PID 2576 wrote to memory of 2720	2576	2025-02-27_fc30ec71b2fd21590f76a2bed1384c96_icedid_ramnitmgr.exe	32
PID 2576 wrote to memory of 2720	2576	2025-02-27_fc30ec71b2fd21590f76a2bed1384c96_icedid_ramnitmgr.exe	32
PID 2576 wrote to memory of 2720	2576	2025-02-27_fc30ec71b2fd21590f76a2bed1384c96_icedid_ramnitmgr.exe	32
PID 2716 wrote to memory of 600	2716	iexplore.exe	33
PID 2716 wrote to memory of 600	2716	iexplore.exe	33
PID 2716 wrote to memory of 600	2716	iexplore.exe	33
PID 2716 wrote to memory of 600	2716	iexplore.exe	33
PID 2720 wrote to memory of 2792	2720	iexplore.exe	34
PID 2720 wrote to memory of 2792	2720	iexplore.exe	34
PID 2720 wrote to memory of 2792	2720	iexplore.exe	34
PID 2720 wrote to memory of 2792	2720	iexplore.exe	34
PID 1356 wrote to memory of 2656	1356	2025-02-27_fc30ec71b2fd21590f76a2bed1384c96_icedid_ramnit.exe	35
PID 1356 wrote to memory of 2656	1356	2025-02-27_fc30ec71b2fd21590f76a2bed1384c96_icedid_ramnit.exe	35
PID 1356 wrote to memory of 2656	1356	2025-02-27_fc30ec71b2fd21590f76a2bed1384c96_icedid_ramnit.exe	35
PID 1356 wrote to memory of 2656	1356	2025-02-27_fc30ec71b2fd21590f76a2bed1384c96_icedid_ramnit.exe	35
PID 2656 wrote to memory of 2804	2656	KBDCA.exe	36
PID 2656 wrote to memory of 2804	2656	KBDCA.exe	36
PID 2656 wrote to memory of 2804	2656	KBDCA.exe	36
PID 2656 wrote to memory of 2804	2656	KBDCA.exe	36
PID 2804 wrote to memory of 1736	2804	KBDCAmgr.exe	37
PID 2804 wrote to memory of 1736	2804	KBDCAmgr.exe	37
PID 2804 wrote to memory of 1736	2804	KBDCAmgr.exe	37
PID 2804 wrote to memory of 1736	2804	KBDCAmgr.exe	37
PID 2804 wrote to memory of 1212	2804	KBDCAmgr.exe	38
PID 2804 wrote to memory of 1212	2804	KBDCAmgr.exe	38
PID 2804 wrote to memory of 1212	2804	KBDCAmgr.exe	38
PID 2804 wrote to memory of 1212	2804	KBDCAmgr.exe	38
PID 2720 wrote to memory of 1604	2720	iexplore.exe	39
PID 2720 wrote to memory of 1604	2720	iexplore.exe	39
PID 2720 wrote to memory of 1604	2720	iexplore.exe	39
PID 2720 wrote to memory of 1604	2720	iexplore.exe	39

C:\Users\Admin\AppData\Local\Temp\2025-02-27_fc30ec71b2fd21590f76a2bed1384c96_icedid_ramnit.exe
"C:\Users\Admin\AppData\Local\Temp\2025-02-27_fc30ec71b2fd21590f76a2bed1384c96_icedid_ramnit.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1356
- C:\Users\Admin\AppData\Local\Temp\2025-02-27_fc30ec71b2fd21590f76a2bed1384c96_icedid_ramnitmgr.exe
  C:\Users\Admin\AppData\Local\Temp\2025-02-27_fc30ec71b2fd21590f76a2bed1384c96_icedid_ramnitmgr.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2576
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2716
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2716 CREDAT:275457 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:600
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2720
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2720 CREDAT:275457 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2792
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2720 CREDAT:275464 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1604
- C:\Windows\SysWOW64\KBDCA\KBDCA.exe
  "C:\Windows\SysWOW64\KBDCA\KBDCA.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Windows\SysWOW64\KBDCA\KBDCAmgr.exe
    C:\Windows\SysWOW64\KBDCA\KBDCAmgr.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2804
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      PID:1736
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      PID:1212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
71KB

MD5
83142242e97b8953c386f988aa694e4a

SHA1
833ed12fc15b356136dcdd27c61a50f59c5c7d50

SHA256
d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755

SHA512
bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
113cca75ccd3f9fb5ccce5c7b5031f33

SHA1
cb57e102fc94ca28c17fd5640b02a0351a94dbf8

SHA256
f1c6f99c69ff072ce7f10fc9a39192cc4beafd8d5000d4c4fc398d1cd7eda069

SHA512
fd3ffefe6de9974f9dc4f8f0d160e04d64df8013c16b4d6a4225d3423f6c22cdae6f6a449908c790b1bdc65b29c58e771abd856ce158204eca8aaeef238185d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
694dd1d7166b8b5d69e157662cb503af

SHA1
7e28c77c471489a61702a3eb1e40f51764acb97e

SHA256
c235f0449f32bfbd443c74e6f6fd218faf4b551bb580dd9aa768745aa204d35e

SHA512
3ed8da8e8bf337438454a7fff02d6bb157e592a6ec69a5704d15723d6517d3674dc4cb33d7e2dc2ec68c47ddcf29fd1bd521992872d356fd716ba8beefa2d3c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28bebdc0ea65c2e9cde7f67de1f67836

SHA1
cb016fdc896c889f9d06c1162bf90b92c593a0b4

SHA256
060da53ea24b98618d4654754a6877a05a808f36e7e7baf0b269dad254e9175c

SHA512
184200b29039a1b377009c7a2f7e790719f9c9ce91142501bb1d0cb4757d00ffaa65f070a27965921d344f09772f143d49a72c1e77945f999801378384a18c2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6a160e2807c86bac1a7520607784fd1

SHA1
c8141cdefb96505494b7485a753cde00627679da

SHA256
f35ace3c0325c5a917e0bee579ec044af1570cd237a2f9dc8b5d789d53751d90

SHA512
0ca1ce6b6524ba3b8ad82aefdb5ba978686027482c2131ed7bfcfae57401583333f217edab4d61f1b8739e39a0eb39dd384c8037f0185b8e54c6f082d11209eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
350c593899664c4b23e8f9409f9c85a9

SHA1
fcd8dd93f31f24c6eed132329962128fb7325236

SHA256
b962fefaa98255d2f6b09cb7971fa252c50821542042f0350adf50dba33bf20c

SHA512
ee83ec7a0ebb4fd5e0224b230e0d26f999141ad6a133622c06ae1e4191e6a1ff26363c8b70b993cf1c4aa837181e1d78c906072195d8e9ba1b32cf58b76743cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b67a6622c633d2a2bb66fad5b8793d24

SHA1
8bd43b6b6781ec3956f172faa4be005310fc9fd8

SHA256
1448b9435577e9b6981af955b9e0ac792af768163b58937661f8ed2c0377629c

SHA512
73a4149caa40b14ee8ae7e46737c241f390465c3a47b412a4894d2d451575ec4a8c7463025324f26b4e70a198dc7c077c3b7dae5c5687c88e5fdf68a389ab9ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6b803937542da529953e75dfa3efd6b

SHA1
d84d0871eca0a8433aa45493b8769bde612a78d4

SHA256
9af37de6eb9c8b0f90da36cea47bcd12ea23e552a210b241e77f713f67e16190

SHA512
d95744944fc03fc0d19b769941c2d78796986236363161421cdb76735fc1d79e19d1699f220d74700fc94de6cd175f6c1b828dfb208c686ed9622cb43d7f13b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
159bf91ca4981463615ed574d7e98406

SHA1
911b62285f76cf67bad252bf98bc17bc57c19df4

SHA256
5635fffc6b276849032ec9742574ab261e7d4244cbceb72fc5f0a5213678eef1

SHA512
6ca304876fa20c85a3d7507ccda59a8d56c906951f02b73254d85c4d0880d4b1beb48acf4e99a75e4ff05aed413e8a8d58201dc6462625bb34b46cccb7d115db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a20e03b7f729745d7eb44f97aa5bf1ba

SHA1
1fcfb05af4c635cbd037772fe5e9c959904815e0

SHA256
d01581812308b709b5070f03635a4891a990daa8be3889622c23849ba07bc64c

SHA512
5ae2327494fdc8c178b02748f4f0980f07058fc902092064519923e801d6d184799537a73be4541370c811797c94f2a9433c0af0e8fca902e8a04c57afe10531

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1925bc8a364f7baed41fcc1a13e513aa

SHA1
30e708dfa09c90b03cd15089010e419c60cb8a86

SHA256
73dd5e1dc78820e7e3fd257bd239efb29ff2f7916c9962cc6ac5ce9ab4fcdd46

SHA512
1c2e7f2a65c49c2627bcc727bb89d8a8a0fac1a7f8c9b69687b744a9f8dd7d30856831f804be7cc389c99d5b858037d09e932d229aae0f68a1886b3767bc762d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
854eaa17317563664320bc908203bea8

SHA1
de05fea32c46e919fec074ae7127d19d70b5abd3

SHA256
a1584f584afc5cfcbff9ce4a8f7ffc636247fe9ab15aa6526bea3e1a7e4f8d65

SHA512
57fc084473661425b10c3d972d726aa70d82a9cf4c6dbe0c6fbf3d36165de860a7eaef6cb7c1d8860e3e0659a68a5255c0bd54dc7ce60ddf486765a8b32b5a01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18c2b8b410bcf1d58cef9d8a48973ad8

SHA1
760d86c77159b5b47992b724a904b90757c132ad

SHA256
d6472ac0992bf7c0d6cd8c6fee28f6f1b37b37f74a0a2aa08383e22e680fa608

SHA512
de101330854a71b760ef9f66f13d70f0ab5f6a8feb2c731b8eb2b3cb568817fab7c5a1b50bd8f4adbda851c0b73f7ea3e917eedb3597c8d0f5657146d80745fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b0aa0efc6d75ea530bb505d4d1a4a0a

SHA1
fe9c2cf4ece2f722107429697a8b219da116a053

SHA256
669182b443998c27cbe7878bfc7d314441cc7228509e6b4c0d9da7f5e9fb19ef

SHA512
21a337e18d57c7bb3208de999b1a2eae4aed32839d60ec9735b01530aa28e6cf4514c121a4cbb2ceed8ca2a013cd5a203978d0834ee4b281aee01232fa81e367

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3a44ec7188f8c4697f6973417dd86e8

SHA1
a2226dccc065a4a86bba5de650f539bc6cf233b7

SHA256
6b7457a22142c791dad8b26a75d1e5fc2fe4c95b2cfd4d194efecac8b8e658dd

SHA512
71f7aeae1081d7fa2ce67fde93220b0ab4958862bc845f73753889a5778eebbde32702e7a68c071bdd971ff8b0a8e54951aca340aae2ff04a1d0882b053e31fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
874cdb34dc491fc7e16dbfd80f794c7d

SHA1
89f34d4bfbdd7eaeed91b68f639029e4c57e7c62

SHA256
6699f3add072ca3b701f5b3cf125c8cb9e968ef336da53b17d64286191c8aff6

SHA512
f3686333cb2214ddfcb233e3f2016bddf0647d6acad80dc7469af0e39857bb26545910c25c99ce4a2215ca52250b186678372509015bf97d77417aa349c7f073

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07506bf5deb5b700eb5ff2ee98133080

SHA1
e7421a61fafc7d5acfda4ac833920a82c80330c2

SHA256
75b648b8f4b43d13c92df0704aaeec683f100558cb959e66501a8a82eef45d81

SHA512
334077dff149531f78738b41ca6d793ec1674ceb928663a96adad37e86a3277141ee70d48320ea2ce5f78be7da048f6f17d2bd6fd684262b9d2005df0a72da55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fbf0645c6bb939b96ada9ea0627da9eb

SHA1
aec4b208c588b4bd38fec193bdac65ac5cc6f7d2

SHA256
ad9964488b6907a7a8228e5cc5fd9d9770afa15329ccec6199fffed014496ca9

SHA512
2d7864ed0a49b531b9c0c51fa2119f908d7c192011205f9121522a55b923cf73481d48c8d65727bfcc778348f7a0f0121331580d8d7ea428906f00088b5e6220

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ffbbfad726fc69d75599a4145d239fd

SHA1
489ad3ed94c56722091c2fbd980ea28229c1d5a1

SHA256
3a2b2336ae9e3b3e8ad5167ef984ed5268a4e512f9c01f3ca4583cf2055b6e85

SHA512
f0e9ef15e737c90037b7d7c2ce160b459c958fd9d57ea6b72f8c7622a96f6da1e85f486eb8077a469a61e9730eca9d6554dd2325842034b58c669c43330e9c29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f327ec715c30adcfb05a7247aa2e9b72

SHA1
ff86f697c437412d22cffae4980e0c68b80c00e7

SHA256
d1c6adc7005169924db5a329e0f613f465104a2db75b361d0790471c2fbdec78

SHA512
f1909314e34ccac1c51b17944f83904a6df1b335c034396e18e041a2b97ccc28d3f49654d91c8d8ca424c353c526e28fafe65bc20365ebfc995d51faeead4c11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{74F36F61-F4DC-11EF-AD2E-6E295C7D81A3}.dat

Filesize
3KB

MD5
420f5d7e734a461dc93ed85b2bd560ed

SHA1
6aa07f880d9aa23acb4994447877077cfdd4d285

SHA256
2494f25a579aca4289dfe591a2ebcc6d1ca89ecded4e8153974127407d7591c8

SHA512
49dc1c939390be07eaba48e34b159c1c1d7bf0151a4959e453e6f3e85252023bb612e40bb5ecc4d4053260b9c038d6dd92aec1220e65e5cee93cda5c65e4e3f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{74F5B951-F4DC-11EF-AD2E-6E295C7D81A3}.dat

Filesize
5KB

MD5
30b8aea18b985bb550d127c642c9aed5

SHA1
2329b645b1476b9c3170130e32bcf0667f1052a2

SHA256
3015a9ba63c802d01a1779506b42af6309c9dbf458a546649ec330e201849958

SHA512
6d09f244505dc80f0e77157b257e0f25a7579af7420eccc55972a43c1cbc55f70abb276a8699c17dca5ae07e75b76de10ad3b655ff305c90d5a71abeede6a35d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE6E9.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE808.tmp

Filesize
183KB

MD5
109cab5505f5e065b63d01361467a83b

SHA1
4ed78955b9272a9ed689b51bf2bf4a86a25e53fc

SHA256
ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673

SHA512
753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc

Download Submit
\Users\Admin\AppData\Local\Temp\2025-02-27_fc30ec71b2fd21590f76a2bed1384c96_icedid_ramnitmgr.exe

Filesize
105KB

MD5
d5ca6e1f080abc64bbb11e098acbeabb

SHA1
1849634bf5a65e1baddddd4452c99dfa003e2647

SHA256
30193b5ccf8a1834eac3502ef165350ab74b107451145f3d2937fdf24b9eceae

SHA512
aa57ce51de38af6212d7339c4baac543a54b0f527621b0ef9e78eca5e5699e8508a154f54f8ac04135527d8417275eeee72a502a362547575699330cc756b161

Download Submit
memory/1356-1-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/1356-8-0x0000000000230000-0x000000000028D000-memory.dmp

Filesize
372KB

Download
memory/1356-22-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/1356-18-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/1356-13-0x00000000003E0000-0x00000000003EC000-memory.dmp

Filesize
48KB

Download
memory/2576-16-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2576-10-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2576-44-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2576-11-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2576-12-0x0000000001CC0000-0x0000000001CC1000-memory.dmp

Filesize
4KB

Download
memory/2576-17-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2656-29-0x0000000000610000-0x000000000066D000-memory.dmp

Filesize
372KB

Download
memory/2656-23-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2656-40-0x0000000000630000-0x000000000063C000-memory.dmp

Filesize
48KB

Download
memory/2656-43-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2656-33-0x0000000000610000-0x000000000066D000-memory.dmp

Filesize
372KB

Download
memory/2804-38-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/2804-37-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2804-34-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2804-35-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2804-39-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2804-36-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download