emotet | fb63673ed7f692b0d3610a2629a26e598ec916440a32149ac0aeffb7c25305fc

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
27/02/2025, 11:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnit.exe
Size

384KB
MD5

97b5211be2a493d35ed933b4b89bc1d5
SHA1

1caedc79c8857c16c3c50a526eb349a5c6176a28
SHA256

fb63673ed7f692b0d3610a2629a26e598ec916440a32149ac0aeffb7c25305fc
SHA512

847a584e2818e2819f2896b81501e680ff2a58bd96160e5e9a58e94bfa4d39e9908a3d33c1b1fd20490e3f37e35870b4d7460d68cefcf8cac3a6db99ba78d6aa
SSDEEP

6144:sF3MtP2xXEeeWFEuC3h93Fx8u2qEuIE2T9Iyo/Q0VNhveGbfUTpYDDmu/+3fbT:svxaUCh93FxmuIE2Vo/tWG+pG/YT

Score

10^/10

emotet ramnit epoch1 banker discovery spyware stealer trojan upx worm

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

219.92.13.25:80

91.236.4.234:443

192.241.143.52:8080

186.3.232.68:80

192.241.146.84:8080

12.162.84.2:8080

50.28.51.143:8080

221.133.46.86:443

185.94.252.27:443

114.109.179.60:80

186.33.141.88:80

172.104.169.32:8080

184.57.130.8:80

177.139.131.143:443

77.55.211.77:8080

81.169.202.3:443

72.47.248.48:7080

212.71.237.140:8080

190.229.148.144:80

178.79.163.131:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Emotet family
emotet
Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Ramnit family
ramnit

Executes dropped EXE 2 IoCs

pid	Process
2644	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe
2896	KBDWOLmgr.exe

Loads dropped DLL 4 IoCs

pid	Process
3064	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnit.exe
3064	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnit.exe
2408	KBDWOL.exe
2408	KBDWOL.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\KBDWOL\KBDWOLmgr.exe	KBDWOL.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00080000000120fd-7.dat	upx
behavioral1/memory/2644-11-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral1/memory/2644-13-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral1/memory/2644-16-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral1/memory/2896-36-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral1/memory/2896-35-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral1/memory/2896-39-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral1/memory/2644-44-0x0000000000400000-0x000000000045D000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KBDWOL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KBDWOLmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnit.exe

Modifies Internet Explorer settings 1 TTPs 56 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8C0DA5C1-F4FB-11EF-9628-7EC7239491A4} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8C082781-F4FB-11EF-9628-7EC7239491A4} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "446816537"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff5600000000000000dc04000065020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
2644	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe
2644	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe
2644	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe
2644	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe
2644	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe
2644	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe
2644	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe
2644	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe
2896	KBDWOLmgr.exe
2896	KBDWOLmgr.exe
2896	KBDWOLmgr.exe
2896	KBDWOLmgr.exe
2896	KBDWOLmgr.exe
2896	KBDWOLmgr.exe
2896	KBDWOLmgr.exe
2896	KBDWOLmgr.exe
2408	KBDWOL.exe
2408	KBDWOL.exe
2408	KBDWOL.exe
2408	KBDWOL.exe
2408	KBDWOL.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3064	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnit.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2644	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe
Token: SeDebugPrivilege	2896	KBDWOLmgr.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2876	iexplore.exe
2668	iexplore.exe
2668	iexplore.exe
2668	iexplore.exe

Suspicious use of SetWindowsHookEx 22 IoCs

pid	Process
3064	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnit.exe
3064	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnit.exe
2876	iexplore.exe
2876	iexplore.exe
2668	iexplore.exe
2668	iexplore.exe
2276	IEXPLORE.EXE
2276	IEXPLORE.EXE
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE
2408	KBDWOL.exe
2408	KBDWOL.exe
2668	iexplore.exe
2668	iexplore.exe
2668	iexplore.exe
2668	iexplore.exe
1348	IEXPLORE.EXE
1348	IEXPLORE.EXE
1728	IEXPLORE.EXE
1728	IEXPLORE.EXE
1728	IEXPLORE.EXE
1728	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 2644	3064	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnit.exe	30
PID 3064 wrote to memory of 2644	3064	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnit.exe	30
PID 3064 wrote to memory of 2644	3064	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnit.exe	30
PID 3064 wrote to memory of 2644	3064	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnit.exe	30
PID 2644 wrote to memory of 2876	2644	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe	31
PID 2644 wrote to memory of 2876	2644	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe	31
PID 2644 wrote to memory of 2876	2644	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe	31
PID 2644 wrote to memory of 2876	2644	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe	31
PID 2644 wrote to memory of 2668	2644	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe	32
PID 2644 wrote to memory of 2668	2644	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe	32
PID 2644 wrote to memory of 2668	2644	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe	32
PID 2644 wrote to memory of 2668	2644	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe	32
PID 2876 wrote to memory of 2276	2876	iexplore.exe	33
PID 2876 wrote to memory of 2276	2876	iexplore.exe	33
PID 2876 wrote to memory of 2276	2876	iexplore.exe	33
PID 2876 wrote to memory of 2276	2876	iexplore.exe	33
PID 2668 wrote to memory of 2708	2668	iexplore.exe	34
PID 2668 wrote to memory of 2708	2668	iexplore.exe	34
PID 2668 wrote to memory of 2708	2668	iexplore.exe	34
PID 2668 wrote to memory of 2708	2668	iexplore.exe	34
PID 3064 wrote to memory of 2408	3064	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnit.exe	35
PID 3064 wrote to memory of 2408	3064	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnit.exe	35
PID 3064 wrote to memory of 2408	3064	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnit.exe	35
PID 3064 wrote to memory of 2408	3064	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnit.exe	35
PID 2408 wrote to memory of 2896	2408	KBDWOL.exe	36
PID 2408 wrote to memory of 2896	2408	KBDWOL.exe	36
PID 2408 wrote to memory of 2896	2408	KBDWOL.exe	36
PID 2408 wrote to memory of 2896	2408	KBDWOL.exe	36
PID 2896 wrote to memory of 852	2896	KBDWOLmgr.exe	37
PID 2896 wrote to memory of 852	2896	KBDWOLmgr.exe	37
PID 2896 wrote to memory of 852	2896	KBDWOLmgr.exe	37
PID 2896 wrote to memory of 852	2896	KBDWOLmgr.exe	37
PID 2896 wrote to memory of 1508	2896	KBDWOLmgr.exe	38
PID 2896 wrote to memory of 1508	2896	KBDWOLmgr.exe	38
PID 2896 wrote to memory of 1508	2896	KBDWOLmgr.exe	38
PID 2896 wrote to memory of 1508	2896	KBDWOLmgr.exe	38
PID 2668 wrote to memory of 1348	2668	iexplore.exe	39
PID 2668 wrote to memory of 1348	2668	iexplore.exe	39
PID 2668 wrote to memory of 1348	2668	iexplore.exe	39
PID 2668 wrote to memory of 1348	2668	iexplore.exe	39
PID 2668 wrote to memory of 1728	2668	iexplore.exe	40
PID 2668 wrote to memory of 1728	2668	iexplore.exe	40
PID 2668 wrote to memory of 1728	2668	iexplore.exe	40
PID 2668 wrote to memory of 1728	2668	iexplore.exe	40

C:\Users\Admin\AppData\Local\Temp\2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnit.exe
"C:\Users\Admin\AppData\Local\Temp\2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnit.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Users\Admin\AppData\Local\Temp\2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe
  C:\Users\Admin\AppData\Local\Temp\2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2644
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2876
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2876 CREDAT:275457 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2276
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2668
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2668 CREDAT:275457 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2708
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2668 CREDAT:472070 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1348
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2668 CREDAT:603139 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1728
- C:\Windows\SysWOW64\KBDWOL\KBDWOL.exe
  "C:\Windows\SysWOW64\KBDWOL\KBDWOL.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2408
- - C:\Windows\SysWOW64\KBDWOL\KBDWOLmgr.exe
    C:\Windows\SysWOW64\KBDWOL\KBDWOLmgr.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2896
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      PID:852
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      PID:1508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
71KB

MD5
83142242e97b8953c386f988aa694e4a

SHA1
833ed12fc15b356136dcdd27c61a50f59c5c7d50

SHA256
d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755

SHA512
bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e1d95afcc23067316e6fc7081ef9668c

SHA1
7271c449fd608275d78ad4fb1fa3b5c85763ed04

SHA256
13e29ce428dfebf428101721ed5ed1cb26eb27fd33e4f54508a73402dc0e8064

SHA512
c87e5e2a1a1b8382c390593a6f43c0752475c89a4f873453d5d297c668959e6b12543011089b6338a718dce3852cb71c050deabf4b9635a3dc27fba3d2f14189

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc52ad95ac3f8b6f914849129e77f0ec

SHA1
a64d02ca4d9025f60028bdfcabe8e88c3276dd58

SHA256
f6f3682185fbcd8f1b9aecb2ad129f83733895f54336625992407920176c26a9

SHA512
25191e23fc9346ac3b56932c8040ab88db3ea7cce6082ce12f6b2ec84a85c1e047acdf37e8fccf1a000897b61624b2f03655fab98717ab5a128488c29d9f2695

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
99eec52f7c02c8ddffee79a9dad8d87b

SHA1
caf29c8753e26c4f571e6d1e5cbb3272d69af7ca

SHA256
8c6cb50cc285ff0b3df4039d7d41d3e0263fe1d9bd81567fe86f715648bfc8ef

SHA512
28660eefec32f7b2b14543d7651d933f17c4efc2b6df5766785234d64ff6911bdf2616b9f7cbe0410842fe3a154142d3256c8deb5317cf5388f16a6d489e7477

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2242fd8494eaeb6bef29af7bf0322ca6

SHA1
726fe4790f4b2dd3f1db0a00549d5c6b1293c805

SHA256
f17823a0abdfeabc2d4e2bf2b3757f5471445452a57fb8eacdb02d5d56fc8f94

SHA512
e3231db1a715f551d62f02b3d24ebb0da825f87f10cc92524fd98dca61b310e7c10e9df6017c100f8306175c0bd3f4942bebf0e4f0998df0c885d02b2d17da2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed2f7542d6f5b0566341bac7cf4849a5

SHA1
073aa41d0939d88bfac83eb4864cbf39da86e415

SHA256
6bdde0b71e39e25bcc13c6b20fd187c98dec846854c24dc6c063ad340c0a4f1e

SHA512
2092e023be9bea67bc7d2e0f346144fa37efdb6eac75f336e2af6dc4074ee682de5a2dab4bed02ae1ac6f451f8c4681686cdfbdc2b661b939a052e96157c941c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
130785b8ea98861b2d5063bd81305dff

SHA1
9fc3c5366f5c7b2d982303d81885192c13731697

SHA256
b65ae69609e13f41dbded2ec1bf73fb325dc35f5161b21047ef6ceca16581f0c

SHA512
a7de495f827a2af54f01effb64eea5cdef08b0c20ec222565b032bbba252f3b6f0fc057de0157d71164422dad6efc888e6c56814d5b81e8cae7243c6bae21dcf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9028ff90c0a7b634b03a90236272beba

SHA1
3b67879c414b683d9223b6e6d92d8cd76627e9c1

SHA256
c0e54857514e836330b2acd9977bd1d476ee8ac34522bba039f168bbd72da7ca

SHA512
7af26df3f0612421ad475b655fea48ef0537e694f199976835b5dbd9c3ba6e4f723b9bcd5eddff03a6d4635e3aabda73b847e2dca8798243127893477e601eaf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf820a7eb9bc938cb22f5ab621867127

SHA1
6e3e9e8cc66f5bbb56986d269377397976e8a3ab

SHA256
aadc06d285fbfb2cf8420bd16e9d4b8119da9b4ea65f39153b663ff692c3f81a

SHA512
956c3a4307fa001797b2defd5d98f48db640f1bee6f1026152a04686dc9bc4a45878a91e22d2042ed0002638a9f43f5e37298789d35c9c462aec89265d5ba9fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d346982b797808038bacfb38bfff346e

SHA1
75c6544a938da6b79254b3da0151de8cd2c746cd

SHA256
e6202a60eb6cabb343733e1f92fc528e995cd828b1dbb4406123a2c4a7ce16d0

SHA512
17ed3e1cf6889da5f2d0d07efb9ebcf61a15ce57ae57c7a566c2c814531fc61c7efcad04d5ae2bf8cd46615316b90899be79ea539d6517ed7b0cea54759d6f69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ebdd72fd5d7e4f34f0c2a1ce4f551a2

SHA1
3554faca52447f6caeb3a3374344cb58a7f7e5cf

SHA256
0e26b186ce690391c7354cbfa80b181b32de4ec26a0d181c9b48bf98d73bc18d

SHA512
ee0f756fb1ae3f619de21a009de7b0f0759c8b86b222680e02d2c280ee575c877f481ade0909f0f681aab3ade23c301058fada69a1f0af733c589a01664b0e44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
70f02a8c4a5c499edafe44d06f7c0831

SHA1
7858885490313cf195163ff0f9cddc91f7b56a81

SHA256
caafe9f4108731faf8a5a44f1b0f0a6526dcb27c5528f06fb15bed57f7f82b2f

SHA512
ff63ba5a488153a03448abb5ec22cd59436d17aa6abc7f58d09a43f1ce8fd6ea0a27063e0b66af344eb4eb49807d23768a30873fca6079851eb4e95e60fab18f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
207a3769606f2a14fa0ea06b0f1e06b8

SHA1
2d9095f7029a16baaf916a1070db6c2e38f3b7de

SHA256
dd1ab63aa0ddf8d87616ab61f85e1715df377f1e314b1676f5b91d66b785405c

SHA512
3d4d82a8056fe13a10a784cf7f093081341a4fe7ea2af8b244f1021fa68e1134b751a66dff0f001d739d1d9606a0a61525fcb195ded95a0345e47a63d39a8b67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8fee126e97ad35b9efd4f1db684fdd2c

SHA1
6718dc61decd1a4cd2b111ebd90c8a48e71cac8a

SHA256
de6c831bf3d4f4bbda80610dfca0bf677c0ca8d34e0526fd5c2e4dfdd45e89c8

SHA512
c81ae6cd75ecf72a41a544158188d41a19af0c6a608207d603622b4619d6504a7e2f0aa117f4f62f86c179c2f6c3a8daf84df63a6f4dc30610963b096cdd1b03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e191a644d9842dee76482b0179135bc

SHA1
a593b199e1a6fe6b954ed1d56834ffb8a6f33ea0

SHA256
bb2cdb4b5ac6cec0eddf58da107cf3f849fd3d725d104e3c4393813ea2a206a8

SHA512
0bdd2b48c3810c64199933492b48802c1e206a2956a2396b3fa9268ad7ef96d1dfde5bfb80f9ffc040df93e3df3911c6db77d0238b88e9ccd5bced9b3b54c474

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2c67173cb8fb11745134afc85ee32c1

SHA1
f73618d2ab050b74b940e6f4ac9174dbf812c171

SHA256
fa9d2a83c67a9bb7844c108ea0a477fc26f310a06132f5eb5020fcf7155269ce

SHA512
c115720533695c20226670ef4487e004df21b6f5f49d20dc94bbbb97ee0640b7956112afb24a03c13f4cc44a6909db45219518a0511102676befde52959ce4cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5653cd7d5935c7b8a28b18766d9eb7a7

SHA1
d747e39ccd492d8dde0081c8de6c3b20075f8af1

SHA256
cafdcaed9e916c8e227184a0076e09ebe7eed3d0693bb841a706cfb038afa21b

SHA512
288f7ff29dce94465a1732b0f05ecd1a8bf2fef177f4e69efb60132c4c99e0b78eec67861eadc942191ab2da033e82fa15596f62083d55127c0edd631562e98a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a4d05db99a8f35b0130c2d4190edfd8

SHA1
91c0c7b86193f1a8d80b1edb5e369705acb32752

SHA256
d6727f54e3f456efed2d99bea72cdfa56db1b5358e2d538bba6246e7016e0722

SHA512
1f61e222955c8966ae3b15fb800ae2bd1820db04250be5da90cd32082524830c73e54a7b08f9171c1c95ff0547aabac8b65606f88f975ef0380bc5aa33e84dc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae30e323b882897e243297bd77aeb31f

SHA1
d0d9182cac4432d28ec6070f7bfdb81801bcdb18

SHA256
cd966d49139fc99f2d8fb8697ffe3bbccbd3da1b63f5b9e033b19b564722aabe

SHA512
21f5cfcc88bb685bdfcb233dbf5f32bada2148c1db6a2764409bf885ac4d359482fc59905c26afc47427edf53397ad952d4bb966e64055d3017aed82be15f64c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c13bf4b3ed6645a135bbf7b078a5686

SHA1
181b821e8b72b9e34b5713733193d1a5c79c8849

SHA256
d98426e39282a2f2bba57de0e59dee6a8544699d25ad6a79ab446a3714964e49

SHA512
7484da519603aa5115f056ca95b5ac129a8847078d0feb27834d2baf9be3b6f6516d966a82ca05c9d8a54541eca3706395dacaa49c1218a42f6490089f56a7c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{8C082781-F4FB-11EF-9628-7EC7239491A4}.dat

Filesize
5KB

MD5
027e14abb16da738a8df98d929ba4526

SHA1
70f03c0de2cf4a9b326332ca32975a789e15fdd8

SHA256
6dec121cbf0c9e2dc34af8c2d05a3b8dbdf1dad29149f45bd6ab386109bc4556

SHA512
e3ad5ff8e7c9d43111451bc9c738d676aa516990d74e91bdb6a670354bd7705896e895bcef0d83d264e52c3fe56968b0b0582071a17b7348e445ccb2b6cf26a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{8C0DA5C1-F4FB-11EF-9628-7EC7239491A4}.dat

Filesize
4KB

MD5
9c8191f5d55518017b25716c6b4036a4

SHA1
15ef2f87dcb1093b066741940111af06da6e47ab

SHA256
9fb2d6386b669fb59f57d2d874e59e80a261986407f1998046e142b535b94bb3

SHA512
037cb42f48d8918b402aaf047bfd8763db779aa77743acefeb31c211147addf35dada1a2dcbaae5155f393a8af112a7cdbe177e8728daa248d75877fec4447e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe

Filesize
105KB

MD5
d5ca6e1f080abc64bbb11e098acbeabb

SHA1
1849634bf5a65e1baddddd4452c99dfa003e2647

SHA256
30193b5ccf8a1834eac3502ef165350ab74b107451145f3d2937fdf24b9eceae

SHA512
aa57ce51de38af6212d7339c4baac543a54b0f527621b0ef9e78eca5e5699e8508a154f54f8ac04135527d8417275eeee72a502a362547575699330cc756b161

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3D71.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3E71.tmp

Filesize
183KB

MD5
109cab5505f5e065b63d01361467a83b

SHA1
4ed78955b9272a9ed689b51bf2bf4a86a25e53fc

SHA256
ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673

SHA512
753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc

Download Submit
memory/2408-26-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2408-43-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2408-45-0x0000000001BF0000-0x0000000001C4D000-memory.dmp

Filesize
372KB

Download
memory/2408-179-0x0000000001BF0000-0x0000000001C4D000-memory.dmp

Filesize
372KB

Download
memory/2408-40-0x00000000003E0000-0x00000000003EC000-memory.dmp

Filesize
48KB

Download
memory/2408-29-0x0000000001BF0000-0x0000000001C4D000-memory.dmp

Filesize
372KB

Download
memory/2644-16-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2644-44-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2644-11-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2644-15-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2644-14-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2644-13-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2644-12-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2896-35-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2896-36-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2896-37-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2896-39-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2896-38-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/3064-17-0x0000000000260000-0x000000000026C000-memory.dmp

Filesize
48KB

Download
memory/3064-20-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/3064-0-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/3064-24-0x0000000000330000-0x000000000038D000-memory.dmp

Filesize
372KB

Download
memory/3064-8-0x0000000000330000-0x000000000038D000-memory.dmp

Filesize
372KB

Download
memory/3064-9-0x0000000000330000-0x000000000038D000-memory.dmp

Filesize
372KB

Download