emotet | fb63673ed7f692b0d3610a2629a26e598ec916440a32149ac0aeffb7c25305fc

Analysis

max time kernel
145s
max time network
151s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27/02/2025, 11:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnit.exe
Size

384KB
MD5

97b5211be2a493d35ed933b4b89bc1d5
SHA1

1caedc79c8857c16c3c50a526eb349a5c6176a28
SHA256

fb63673ed7f692b0d3610a2629a26e598ec916440a32149ac0aeffb7c25305fc
SHA512

847a584e2818e2819f2896b81501e680ff2a58bd96160e5e9a58e94bfa4d39e9908a3d33c1b1fd20490e3f37e35870b4d7460d68cefcf8cac3a6db99ba78d6aa
SSDEEP

6144:sF3MtP2xXEeeWFEuC3h93Fx8u2qEuIE2T9Iyo/Q0VNhveGbfUTpYDDmu/+3fbT:svxaUCh93FxmuIE2Vo/tWG+pG/YT

Score

10^/10

emotet ramnit epoch1 banker discovery spyware stealer trojan upx worm

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

219.92.13.25:80

91.236.4.234:443

192.241.143.52:8080

186.3.232.68:80

192.241.146.84:8080

12.162.84.2:8080

50.28.51.143:8080

221.133.46.86:443

185.94.252.27:443

114.109.179.60:80

186.33.141.88:80

172.104.169.32:8080

184.57.130.8:80

177.139.131.143:443

77.55.211.77:8080

81.169.202.3:443

72.47.248.48:7080

212.71.237.140:8080

190.229.148.144:80

178.79.163.131:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Emotet family
emotet
Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Ramnit family
ramnit

Executes dropped EXE 2 IoCs

pid	Process
2720	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe
2084	sscoremgr.exe

Loads dropped DLL 4 IoCs

pid	Process
2280	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnit.exe
2280	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnit.exe
2116	sscore.exe
2116	sscore.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\sscore\sscoremgr.exe	sscore.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000012118-9.dat	upx
behavioral1/memory/2720-11-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral1/memory/2720-14-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral1/memory/2084-32-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral1/memory/2084-35-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral1/memory/2720-40-0x0000000000400000-0x000000000045D000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sscore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sscoremgr.exe

Modifies Internet Explorer settings 1 TTPs 56 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff5600000000000000dc04000065020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8E6009D1-F4FB-11EF-AD58-7ED3796B1EC0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8E64CC91-F4FB-11EF-AD58-7ED3796B1EC0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff6f00000019000000f50400007e020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "446816541"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
2720	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe
2720	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe
2720	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe
2720	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe
2720	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe
2720	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe
2720	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe
2720	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe
2084	sscoremgr.exe
2084	sscoremgr.exe
2084	sscoremgr.exe
2084	sscoremgr.exe
2084	sscoremgr.exe
2084	sscoremgr.exe
2084	sscoremgr.exe
2084	sscoremgr.exe
2116	sscore.exe
2116	sscore.exe
2116	sscore.exe
2116	sscore.exe
2116	sscore.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2280	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnit.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2720	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe
Token: SeDebugPrivilege	2084	sscoremgr.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2860	iexplore.exe
2732	iexplore.exe
2732	iexplore.exe
2732	iexplore.exe

Suspicious use of SetWindowsHookEx 22 IoCs

pid	Process
2280	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnit.exe
2280	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnit.exe
2732	iexplore.exe
2732	iexplore.exe
2860	iexplore.exe
2860	iexplore.exe
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE
2764	IEXPLORE.EXE
2764	IEXPLORE.EXE
2116	sscore.exe
2116	sscore.exe
2732	iexplore.exe
2732	iexplore.exe
2732	iexplore.exe
2732	iexplore.exe
1312	IEXPLORE.EXE
1312	IEXPLORE.EXE
2380	IEXPLORE.EXE
2380	IEXPLORE.EXE
2380	IEXPLORE.EXE
2380	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 2720	2280	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnit.exe	30
PID 2280 wrote to memory of 2720	2280	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnit.exe	30
PID 2280 wrote to memory of 2720	2280	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnit.exe	30
PID 2280 wrote to memory of 2720	2280	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnit.exe	30
PID 2720 wrote to memory of 2860	2720	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe	31
PID 2720 wrote to memory of 2860	2720	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe	31
PID 2720 wrote to memory of 2860	2720	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe	31
PID 2720 wrote to memory of 2860	2720	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe	31
PID 2720 wrote to memory of 2732	2720	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe	32
PID 2720 wrote to memory of 2732	2720	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe	32
PID 2720 wrote to memory of 2732	2720	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe	32
PID 2720 wrote to memory of 2732	2720	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe	32
PID 2732 wrote to memory of 2764	2732	iexplore.exe	33
PID 2732 wrote to memory of 2764	2732	iexplore.exe	33
PID 2732 wrote to memory of 2764	2732	iexplore.exe	33
PID 2732 wrote to memory of 2764	2732	iexplore.exe	33
PID 2860 wrote to memory of 2744	2860	iexplore.exe	34
PID 2860 wrote to memory of 2744	2860	iexplore.exe	34
PID 2860 wrote to memory of 2744	2860	iexplore.exe	34
PID 2860 wrote to memory of 2744	2860	iexplore.exe	34
PID 2280 wrote to memory of 2116	2280	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnit.exe	35
PID 2280 wrote to memory of 2116	2280	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnit.exe	35
PID 2280 wrote to memory of 2116	2280	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnit.exe	35
PID 2280 wrote to memory of 2116	2280	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnit.exe	35
PID 2116 wrote to memory of 2084	2116	sscore.exe	36
PID 2116 wrote to memory of 2084	2116	sscore.exe	36
PID 2116 wrote to memory of 2084	2116	sscore.exe	36
PID 2116 wrote to memory of 2084	2116	sscore.exe	36
PID 2084 wrote to memory of 2300	2084	sscoremgr.exe	37
PID 2084 wrote to memory of 2300	2084	sscoremgr.exe	37
PID 2084 wrote to memory of 2300	2084	sscoremgr.exe	37
PID 2084 wrote to memory of 2300	2084	sscoremgr.exe	37
PID 2084 wrote to memory of 684	2084	sscoremgr.exe	38
PID 2084 wrote to memory of 684	2084	sscoremgr.exe	38
PID 2084 wrote to memory of 684	2084	sscoremgr.exe	38
PID 2084 wrote to memory of 684	2084	sscoremgr.exe	38
PID 2732 wrote to memory of 1312	2732	iexplore.exe	39
PID 2732 wrote to memory of 1312	2732	iexplore.exe	39
PID 2732 wrote to memory of 1312	2732	iexplore.exe	39
PID 2732 wrote to memory of 1312	2732	iexplore.exe	39
PID 2732 wrote to memory of 2380	2732	iexplore.exe	40
PID 2732 wrote to memory of 2380	2732	iexplore.exe	40
PID 2732 wrote to memory of 2380	2732	iexplore.exe	40
PID 2732 wrote to memory of 2380	2732	iexplore.exe	40

C:\Users\Admin\AppData\Local\Temp\2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnit.exe
"C:\Users\Admin\AppData\Local\Temp\2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnit.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Users\Admin\AppData\Local\Temp\2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe
  C:\Users\Admin\AppData\Local\Temp\2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2720
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2860
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2860 CREDAT:275457 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2744
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2732
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2732 CREDAT:275457 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2764
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2732 CREDAT:275464 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1312
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2732 CREDAT:668676 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2380
- C:\Windows\SysWOW64\sscore\sscore.exe
  "C:\Windows\SysWOW64\sscore\sscore.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2116
- - C:\Windows\SysWOW64\sscore\sscoremgr.exe
    C:\Windows\SysWOW64\sscore\sscoremgr.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2084
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      PID:2300
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      PID:684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
71KB

MD5
83142242e97b8953c386f988aa694e4a

SHA1
833ed12fc15b356136dcdd27c61a50f59c5c7d50

SHA256
d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755

SHA512
bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c66c7f28e14862214b2b74073f35339e

SHA1
bd6fb624b1185d622a038e3d04197a8561c7de2a

SHA256
6547766b0d986e9b04a1123d9177a6257f0e254f4782da8aba3838b39e8eecaf

SHA512
891e612e46c23d377e7fa9be3161d9b04faea26e3ed552709621f080d5dda04ac824c1968ff9fe6fdb73042c6e62cc83b1eb68cffd0d608c80870fc66cc8e17f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
24c84b707d06144eb4a009fd17a1a658

SHA1
bdd1b17c516f91025a4b7911adecfb3487e5b3c7

SHA256
a080ed5b4fce38d8b6e1b2d259b97cc1602f13d958c41ffae78905d3c458db11

SHA512
ffb6e3eff8c677a2bfc3064ce7e2bb5846168df74882bc55c6ef452590dee3cd85676f4b1625e633a14ae6fc6cd415ddfa82b3f16b1124e4f939e8e1ba9a03a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b85ef5695d9e14ee1ff3a5d91a64d75

SHA1
7e48bf1f7ac058e6d3c57eaa211aca7f32a4002a

SHA256
f91f8c8088bb1d6cdc8187030933feb572094e276747840d8f7c0134616f95ef

SHA512
b51701b84d82a9bf01601e0aa78f3a558a6489054576438499e7c302d28e840eeb0eb7a148b3064fa4b1f8bea20277c6ec5c05fa1295147c105aa6655c331e43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6051ee79801f7c427623eb876fbfd35

SHA1
cc41b181117284c685fab8909d689939de08aaed

SHA256
0e543b9d7326e7f5258d9cf14479246f670422f4a335c17ef92bdb65af0966f3

SHA512
95593e7531b66a225f7cad38089bbc577075bba78032a5f196dfdcb0d5f38411c7c0d269100b838f69d307fc4c2efb540dee8b10573ffbd817757654036376e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a89232c18ae3b41e8a2e00ab5c0654dc

SHA1
8cb5d6fc26bee8dd44ed8dd3abc3a20579fd79f4

SHA256
d79ef197702643a19b2cbcb0ef7e5f0457abf5fcaa82ee0132614ac9e5381822

SHA512
0d59669ec3a0025e59067b9bc768c466c8d74e7e0ab8e83cef280f9d123a058f75a16ef4be206b48d6fe859c137e3be5359bce34d8e91253c7a3989607027bf8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d62905a5bd04001201b2b2ef043cd0b4

SHA1
2bafd5ab4413dc8c9b15d4385fcce94cdd6fd787

SHA256
d1eb3ed75f93023334c183f6a2d735e9dc4e720a41701dac68d6d56fe687cf05

SHA512
b8f5ad54ea6e6ccbdb1ecdaeb536ee35c48bd5e2e5efa38c70afd93c964d76b8f4f5a0baa2b0680d21631106559d029206c02badda45d2956d3f955b10f2e27d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e4df2fe37e5fe6c037d476a56fb6aa9

SHA1
09e01c33f239b704379a2ec97ddd4fc562921b71

SHA256
9648a4884379e5a4dce219e3023fe54a6514ccb7a89702bb219fcc19e3c0322b

SHA512
8b80c81dd85c15b72aac82e10ed9845f9898bc81d8b7ffa09cf61f564a07c20d81764723ec0761aada0917c09fee8bd869b5fabe32bdb55eeac4435f10a07933

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a26670cd51579e182296cf9da5f129c6

SHA1
85889857fb54bbf8a1a981c1aa7caa8549af1acb

SHA256
6be6e7b6351073b7fca6d7d2938e55357f5f52146fdcec3da3a30b1051396f07

SHA512
ef94bfe95e63f4db29ef30b8cd1fb82001177e0121f2d1765f550cbebe12bc8d1c366475b612a07430d9245751decd88ab497e4b459f50091c2b891734166b75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
999edfe2d75b66bec85a2891b911a8f2

SHA1
f39309c26cb13e29d8ffc2f8ad29cc02e86f3bd7

SHA256
dbfbcd5ab6fbb9fc772ebc2c431e01c98815c11d60dab2bc77a5efc46b42239f

SHA512
ec36e0a35eb75fdc2fca5406ddd9951fd15a4b380f2530abcf6429346bc2b88982f4fe520758cf7fef1f5798269f0e063816e02daba034e99a68b9d7261b006f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a3120b817fe354be7b91feda9de3ca5

SHA1
d2efca15753de4b3d87991a580d96e32d845be39

SHA256
711754635761799f00e874581412086dff7e34e4dcf472c6a07e9314b7e4577a

SHA512
0051967d861f4409efbc6c73c7ba2d5a4fd433c265bb9bc8b21a43577a2c23bba4f203e01beda8896531806af1615a796ecd1ad807996df132e605c64da5e7c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49dc16d1976698ba898de735c65767be

SHA1
492ebd654b5a862f1a4823f88798dc3de76837b0

SHA256
be3f0c20b884866d12f6460cdc92f8f3e98833c88cff3a99cb009c69d9c32ea6

SHA512
615ccb42e0b4ea0a9d698424424479ce6c1e3a36896d6392e3a7e4a9d96d881e0717509af5fdfa046c0138bb12252295143dafb2ed5fe3e5c2b1c3032d50dcbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d23ec7e0903550c0aa949f2c8c303dd1

SHA1
9a1e9e0766776816d95286b4fb585e7a675eb182

SHA256
256d9d500bc36a67e2c8b2457cf6490560f4cc4084c9f356cd663d5cbcc2a29c

SHA512
56e0bd4c1c89aee0d2f0a95462f1bc388f9318bf179820415d9b2b146161614e64261e6e6eea873e0f4e2f448409eebfc8792b85db3509b88efbe007f72aaf40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03152183b15b4447beb0e2f4e7a68812

SHA1
b91340de8aff2775ce0b81f718cfc5ef9d806aed

SHA256
d5280441568e820101287360fc46e017687cd2da53c6babf792764f808d2ba18

SHA512
89bee6dab7b691518e6ef662269907d34f1c304d15fdcf6269bad6d48619e9382fad927aff908d2a4dbde9f46bd24af54f1d1e61218a45cd766b10e67fd21bd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a93f4066d337acd251ae70c2662d5a90

SHA1
135005514cf375de2e63a5f587f9477d16e3a0a6

SHA256
5d4d69307c4ac2d2a4e7f3caadaadbc86fb895f5cbd02d6b0e4c406424e02c71

SHA512
3ab28d2963075f64d5e7d32544300ee56ef9888e34b5c9e2463a3932e9eb4c87f283d95e25d9aff97c9c4930817310bdb666f1181b7dabf15eab50aff28bc42f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
08e1461a3998dd27fcbff3c642fef367

SHA1
8ab315b688a3c369aba41ab6ebf3eb665e9932ce

SHA256
e60d9d8a00cf7cb82f8bd6b7a9c50288ff3b286e2956e47240aded3d0e888300

SHA512
b2de2b30c0cce3ae7ee2239eb121c7ab9d3ba0817cff352ca98cac9ac76f0bbe2be96fb882f60722783284358c9807f47166871981089f8c4d6d1b6be67dc714

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bcbdadf204367c9d6625ea6713f7daa1

SHA1
a423b567cfa5cf42be02ee729452fe70e705667f

SHA256
30100627ade1465fbb1ef6572a254db5d55ede457d00d6e05698ac9077e44c29

SHA512
8ed7b8050182b621e7939f484d2dde463d938581daea0648ab22e936abeeb8567fa7d0b8ca65335ece65ce4f5f731688648766bb30982fb078d8fa882fe6fb5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ddfd54af64eb7cf0419f9cc10ef2b69

SHA1
38a6f4c50f90f6a13eafa2c9efa1b17d2c67ee7c

SHA256
db6082553ff2f35751fce4c89161ba77b50dabfc7a0845712256b4df1ad75864

SHA512
f8c3921f4daa89e1cbbe6ac99ccab802be3e768565fa83d9d61bc7725602e0dda078bd595483696d16faa216356208ca1778ad3d0e36ca03d7393cdc52e8a011

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{8E6009D1-F4FB-11EF-AD58-7ED3796B1EC0}.dat

Filesize
4KB

MD5
316c9f1ad526899e190181b0f768991b

SHA1
152772da401df88c1e3dbb97cc3e6e22b84b9e01

SHA256
d706e2eb3823c88e12bd2025490750ac58343ec69c9d4abaa67e5d6f8d14a5dd

SHA512
0e37b8348ae86e230dd10b1ae4633d188ac71c72f381287b41e23ad8247e75d5552ca21316ccaa8ec7000f4a81163762470ac8ae180ae966e1f3ba8269e16fea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{8E64CC91-F4FB-11EF-AD58-7ED3796B1EC0}.dat

Filesize
5KB

MD5
4f8e9b326fd6df2ac732f750dea8d149

SHA1
4de9d7cb8edb5dbb3bd03e9fdde663f2604f1ed2

SHA256
d4d70529397e11d56459a11dd6fd9dbf28fdf26e07f634df91f4aa9846f4c2c5

SHA512
6e97c6f1542b71b44870c0a8341e040195de600d4b79d15c1f5228571071e73cdc5110ec88a978f310abfb3903fdd41372b6ac4fede9dd84d07387eeb087f7a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe

Filesize
105KB

MD5
d5ca6e1f080abc64bbb11e098acbeabb

SHA1
1849634bf5a65e1baddddd4452c99dfa003e2647

SHA256
30193b5ccf8a1834eac3502ef165350ab74b107451145f3d2937fdf24b9eceae

SHA512
aa57ce51de38af6212d7339c4baac543a54b0f527621b0ef9e78eca5e5699e8508a154f54f8ac04135527d8417275eeee72a502a362547575699330cc756b161

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab946.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9DA.tmp

Filesize
183KB

MD5
109cab5505f5e065b63d01361467a83b

SHA1
4ed78955b9272a9ed689b51bf2bf4a86a25e53fc

SHA256
ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673

SHA512
753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc

Download Submit
memory/2084-33-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2084-35-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2084-34-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2084-32-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2116-31-0x00000000002B0000-0x000000000030D000-memory.dmp

Filesize
372KB

Download
memory/2116-23-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2116-36-0x00000000002D0000-0x00000000002DC000-memory.dmp

Filesize
48KB

Download
memory/2116-39-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2116-516-0x00000000002B0000-0x000000000030D000-memory.dmp

Filesize
372KB

Download
memory/2280-17-0x0000000000260000-0x000000000026C000-memory.dmp

Filesize
48KB

Download
memory/2280-20-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2280-1-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2280-4-0x0000000000230000-0x000000000028D000-memory.dmp

Filesize
372KB

Download
memory/2720-40-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2720-12-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2720-13-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/2720-14-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2720-10-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/2720-11-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download