emotet | fb63673ed7f692b0d3610a2629a26e598ec916440a32149ac0aeffb7c25305fc

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27/02/2025, 11:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnit.exe
Size

384KB
MD5

97b5211be2a493d35ed933b4b89bc1d5
SHA1

1caedc79c8857c16c3c50a526eb349a5c6176a28
SHA256

fb63673ed7f692b0d3610a2629a26e598ec916440a32149ac0aeffb7c25305fc
SHA512

847a584e2818e2819f2896b81501e680ff2a58bd96160e5e9a58e94bfa4d39e9908a3d33c1b1fd20490e3f37e35870b4d7460d68cefcf8cac3a6db99ba78d6aa
SSDEEP

6144:sF3MtP2xXEeeWFEuC3h93Fx8u2qEuIE2T9Iyo/Q0VNhveGbfUTpYDDmu/+3fbT:svxaUCh93FxmuIE2Vo/tWG+pG/YT

Score

10^/10

emotet ramnit epoch1 banker discovery spyware stealer trojan upx worm

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

219.92.13.25:80

91.236.4.234:443

192.241.143.52:8080

186.3.232.68:80

192.241.146.84:8080

12.162.84.2:8080

50.28.51.143:8080

221.133.46.86:443

185.94.252.27:443

114.109.179.60:80

186.33.141.88:80

172.104.169.32:8080

184.57.130.8:80

177.139.131.143:443

77.55.211.77:8080

81.169.202.3:443

72.47.248.48:7080

212.71.237.140:8080

190.229.148.144:80

178.79.163.131:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Emotet family
emotet
Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Ramnit family
ramnit

Executes dropped EXE 2 IoCs

pid	Process
1184	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe
2620	runoncemgr.exe

Loads dropped DLL 4 IoCs

pid	Process
1568	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnit.exe
1568	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnit.exe
2576	runonce.exe
2576	runonce.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\runonce\runoncemgr.exe	runonce.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000a0000000120d6-9.dat	upx
behavioral1/memory/1184-10-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral1/memory/1184-12-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral1/memory/1184-16-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral1/memory/1184-15-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral1/memory/2620-34-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral1/memory/2620-37-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral1/memory/1184-42-0x0000000000400000-0x000000000045D000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	runonce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	runoncemgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 56 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8B5EB0B1-F4FB-11EF-9DC4-5A85C185DB3E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "446816535"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8B5ED7C1-F4FB-11EF-9DC4-5A85C185DB3E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff5600000000000000dc04000065020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff6f00000019000000f50400007e020000	iexplore.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
1184	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe
1184	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe
1184	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe
1184	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe
1184	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe
1184	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe
1184	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe
1184	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe
2620	runoncemgr.exe
2620	runoncemgr.exe
2620	runoncemgr.exe
2620	runoncemgr.exe
2620	runoncemgr.exe
2620	runoncemgr.exe
2620	runoncemgr.exe
2620	runoncemgr.exe
2576	runonce.exe
2576	runonce.exe
2576	runonce.exe
2576	runonce.exe
2576	runonce.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1568	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnit.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1184	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe
Token: SeDebugPrivilege	2620	runoncemgr.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2104	iexplore.exe
2860	iexplore.exe
2860	iexplore.exe
2860	iexplore.exe

Suspicious use of SetWindowsHookEx 22 IoCs

pid	Process
1568	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnit.exe
1568	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnit.exe
2104	iexplore.exe
2104	iexplore.exe
2860	iexplore.exe
2860	iexplore.exe
2516	IEXPLORE.EXE
2516	IEXPLORE.EXE
2300	IEXPLORE.EXE
2300	IEXPLORE.EXE
2576	runonce.exe
2576	runonce.exe
2860	iexplore.exe
2860	iexplore.exe
2860	iexplore.exe
2860	iexplore.exe
1540	IEXPLORE.EXE
1540	IEXPLORE.EXE
2480	IEXPLORE.EXE
2480	IEXPLORE.EXE
2480	IEXPLORE.EXE
2480	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 1568 wrote to memory of 1184	1568	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnit.exe	30
PID 1568 wrote to memory of 1184	1568	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnit.exe	30
PID 1568 wrote to memory of 1184	1568	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnit.exe	30
PID 1568 wrote to memory of 1184	1568	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnit.exe	30
PID 1184 wrote to memory of 2860	1184	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe	31
PID 1184 wrote to memory of 2860	1184	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe	31
PID 1184 wrote to memory of 2860	1184	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe	31
PID 1184 wrote to memory of 2860	1184	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe	31
PID 1184 wrote to memory of 2104	1184	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe	32
PID 1184 wrote to memory of 2104	1184	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe	32
PID 1184 wrote to memory of 2104	1184	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe	32
PID 1184 wrote to memory of 2104	1184	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe	32
PID 2104 wrote to memory of 2516	2104	iexplore.exe	33
PID 2104 wrote to memory of 2516	2104	iexplore.exe	33
PID 2104 wrote to memory of 2516	2104	iexplore.exe	33
PID 2104 wrote to memory of 2516	2104	iexplore.exe	33
PID 2860 wrote to memory of 2300	2860	iexplore.exe	34
PID 2860 wrote to memory of 2300	2860	iexplore.exe	34
PID 2860 wrote to memory of 2300	2860	iexplore.exe	34
PID 2860 wrote to memory of 2300	2860	iexplore.exe	34
PID 1568 wrote to memory of 2576	1568	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnit.exe	36
PID 1568 wrote to memory of 2576	1568	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnit.exe	36
PID 1568 wrote to memory of 2576	1568	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnit.exe	36
PID 1568 wrote to memory of 2576	1568	2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnit.exe	36
PID 2576 wrote to memory of 2620	2576	runonce.exe	37
PID 2576 wrote to memory of 2620	2576	runonce.exe	37
PID 2576 wrote to memory of 2620	2576	runonce.exe	37
PID 2576 wrote to memory of 2620	2576	runonce.exe	37
PID 2620 wrote to memory of 1048	2620	runoncemgr.exe	38
PID 2620 wrote to memory of 1048	2620	runoncemgr.exe	38
PID 2620 wrote to memory of 1048	2620	runoncemgr.exe	38
PID 2620 wrote to memory of 1048	2620	runoncemgr.exe	38
PID 2620 wrote to memory of 3032	2620	runoncemgr.exe	39
PID 2620 wrote to memory of 3032	2620	runoncemgr.exe	39
PID 2620 wrote to memory of 3032	2620	runoncemgr.exe	39
PID 2620 wrote to memory of 3032	2620	runoncemgr.exe	39
PID 2860 wrote to memory of 2480	2860	iexplore.exe	41
PID 2860 wrote to memory of 2480	2860	iexplore.exe	41
PID 2860 wrote to memory of 2480	2860	iexplore.exe	41
PID 2860 wrote to memory of 2480	2860	iexplore.exe	41
PID 2860 wrote to memory of 1540	2860	iexplore.exe	40
PID 2860 wrote to memory of 1540	2860	iexplore.exe	40
PID 2860 wrote to memory of 1540	2860	iexplore.exe	40
PID 2860 wrote to memory of 1540	2860	iexplore.exe	40

C:\Users\Admin\AppData\Local\Temp\2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnit.exe
"C:\Users\Admin\AppData\Local\Temp\2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnit.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1568
- C:\Users\Admin\AppData\Local\Temp\2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe
  C:\Users\Admin\AppData\Local\Temp\2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1184
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2860
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2860 CREDAT:275457 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2300
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2860 CREDAT:537606 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1540
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2860 CREDAT:406533 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2480
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2104
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2104 CREDAT:275457 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2516
- C:\Windows\SysWOW64\runonce\runonce.exe
  "C:\Windows\SysWOW64\runonce\runonce.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2576
- - C:\Windows\SysWOW64\runonce\runoncemgr.exe
    C:\Windows\SysWOW64\runonce\runoncemgr.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2620
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      PID:1048
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
71KB

MD5
83142242e97b8953c386f988aa694e4a

SHA1
833ed12fc15b356136dcdd27c61a50f59c5c7d50

SHA256
d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755

SHA512
bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a3c7df8215ea41dfb0f7a2fabcab72f

SHA1
b0c7aa6c3b69c68277d6544b7b8bd0090f809718

SHA256
aa08cda721580028632eecdff9012bd93d73e295b94cc2261c27ec42ceeef835

SHA512
f31eec31346513441028634936984ee70d8d4a8b7d3ad0e9661536010bdca401b34ba94f2c3a1f96e6c24e095354fe148a9e92543037f494713895a8235472aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3a95f642e41adadc6b5ffbf1ad72284

SHA1
89a701b5d41f88c15be03fd1fdffbfb6d0b574d7

SHA256
fd220a6c9d8afc208d065a5210cbe869cf2121cdfa1121dbabb0f1f59b80a56b

SHA512
99151411afe16c8187927bb04be667090f3ee944b1fbf8af11bf03b95e37f39ed6e752854e332088ae96fa52c88e3f56d2987d696b1b608dff4e3f81144d3825

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
606fa34b534028f981b28b66a58b4f2f

SHA1
258bedb3a22f56a4d19ef1842a7acc22eff4a972

SHA256
16658afab72d489c9f0d4a1a11cd237b28052ee0595b6f087514b08aaf1caeba

SHA512
91d4ea9bd34b3f34dcc23588bce502f94280d9e4fe41da9a25c798f743a680475c872cc225cbd36d072e8c227165a3dd0a1e0acdce16ea3457ff37d956f67044

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb8d5b7f4b948a8ba20774a313ba2c51

SHA1
74665596d69178287b9a0c3c96de66f04440d25d

SHA256
9ac3f707cbeb19bd4c203e40b1183aa81975ceafb4401a477f4054dee08571c0

SHA512
f732c9bde33eb5351b4d3e2ab02c21a478373b41fbaf5198c339629b0a7fe26eb117adb1e7e8663dc24204fd16d294d0b8c1a5aa92fdedafb0e7577c8a50429d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
062186c690ba4af190d9f877c85e3071

SHA1
1b8ebe3eb54e6ed350f9d1783fd5e49d73a611df

SHA256
d7a3170aeceb5ba60bbd29673aea98cecc5d3b8f81d3d2581e7a93cc44f27989

SHA512
0f789ef98aafcff9acbcfc421cfe8076bd26d3d58fd9e1c6eb0ce44a4a2c7d2acca81762aeca262f47eb7f299bcf37bc59ae6ecbcb46216622bc425a40527bc6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8811ca69d7093bf6e56472286a3a194b

SHA1
dd0d39a4dcdce2022890c123e02b75c23cbc6b1b

SHA256
64f67d7ea3701637ceeed870c67554075a36f94db8ef0ee86218595711036247

SHA512
4d81a0ef6754e3671db57de33e859b48fe32b703244c0023aa587474afcdd66a9048ca87b54794cf955068c8dd431ceea4239d2cbd1ecbfc85720401faceb4a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f7e4d67740999821cef1d14e29bb4f6

SHA1
ba00e7ad5d997c2a5e1e772ce408e1a98dc3b43a

SHA256
00cb3830f2442ba6dee9e5799af4ee3f2f5f32b5caeb930c8dcf0ed87bc1e413

SHA512
d9246188e1634cf9b67bd145927198b6b53d3093b640f8025a10a72ae8ba412b9e4673258697ad203e29257df12597f1006cab1d342c08a1037243d1f71867ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57ba5c2fd94527f2434f25d4b297612c

SHA1
363ac6733ed4dad05e021fd81bdcf38e63502666

SHA256
117f32f8783314b47dec718921db56a9575624cc7491cc4b89b47ba9eb1b1e91

SHA512
836d7466921431f3e9bcb9724996caae72906444ce5e107e1b5cdc666abd107d9816b7793f0c7e5277d80b88b6e9f3b01d9d006207f21b8ea77b9834694bd8ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f663b9c7c0968ab08f8124f724355e82

SHA1
609afdf8da7c3cfd184f7a5ad24ad614b88a5cab

SHA256
d21a169e3d83a074da81a4ca43ba6d981505dbe8553c2236e476309126d6506e

SHA512
25a25f59b8f92932459027fbc93e3760a0fb0a38072802eddcf44c036750456d292acba5e88d95e6b48c3688896daecccec24052b33bd099b9e4b796c489b76a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e4350152d242ce7e6651a15d47c8eaa

SHA1
341686f63858aafc9251381f6c2adf7a3bb23d1a

SHA256
0e4d9a26ce40391a6f5884918cb4c17e677b4abc80cee2f8d2ded225d5d0d8d6

SHA512
56deebf13a6b3f8adaeabcb61f6b061866b9e6c3fdbb17602f644ee2263c8add1da5304c4d1863aec40d2f38a90ffdc60fcda01390f37481b625a254e67ef16e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17206a9091ecef39fe55efed7c9a96ea

SHA1
6c238fe41f0a0edf4a196608af634d068f8d0dba

SHA256
1a2a96c0142d4159eefbdbdc008bcf3dba7d4d1d6ff56d1ddb6a20eecd87cb3f

SHA512
ccc883bed202642e334460ee6539272f804cad1ace13474073aab51b0c977f4bc03ae3aae63280d04a798b31a9eaad9187f9fd7e36d230a5bebc9db2c7ccbb45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f712bcb1aa79924c18600c9a5899b8b

SHA1
dfadd0a2b8663b4c57b12837807a9a5b074285d8

SHA256
d43e528a868a59d3d29cb645238e5c14b3a8a78f881af65187ca6c7607756575

SHA512
0b20376bb5a7f952e6430eb07ed3f56f33befbdb8dc55427f435affb703ef0fcaf7ccebbca3ecdce29df1fe0d652df67c7a2427d0362b95a65b56dfa0a4e7015

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e51c5498f010996818fa8161fd19d98

SHA1
9f3affb08730c40628b93803f264867a1461a50e

SHA256
2227495641d7693373544c64f16dd7da9709c71c3ef54cdb0652c643e7ba15cd

SHA512
017e3a149de8478e46692e9f9a282b59d022bb0762d1d9ed00b837f4f8c6c727efb84f5c3dd8b678a7b6b709aa18884a830b5a50dc9927d9a15356243e76fcdc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6f2045d82f3959bc4138f336872c534

SHA1
cee3767eda15d1d12622d6f3e8f926c4b55a4a40

SHA256
c9540b5edd0023d573f858e9b733df61e4ad6deb3241b67562ab1fb5198b9a55

SHA512
a20daee894e670ed3c6202f0ca767f1897e20448e8a211860f2e64123749e2b3477f9637fc8c3dcd50c3a2042aea417cae19517ccbeb1ebb786eaa388e7a773f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d5a3009a8f752da1f5d1b8ca6ba8811

SHA1
812ba4cb2c2216a4d2951c42e8e895a6e611bb5a

SHA256
0b6398ae790ab2b2c3371b6ac393875bcde376ab837f461a167c773ab8879f14

SHA512
4ef3b4a941497210e8ddd2111f73d5d746f8c2120d2a298479257a88ff7b523067f8f8a9457b1b8544b32fab1427b41520ec49a93acc4866dcaaae2ae00915dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b769a8e58d0f08c08e91c55b563109fd

SHA1
7e49b477490466716fbb35b0eee11467d85785dd

SHA256
def762bdeb264b4a73288785450a34a9f07ab4fa89ef25f1a435cfead507cd02

SHA512
276dc64e2d7477cf390e8e61d369c1c10dcdc1d028af533fbc89486054240139de6fa3cf5a2c7b7e7ffce347bd848f50b9a11c6f00273183da8e464577318dc4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16780e174c7d9d6617d93650e40a9812

SHA1
c84f17c7f8b412e96d09865f07fc1aa40d60b823

SHA256
e80c22447eaa853fe3ee19840a4497dc2dec48d5a500c5d34188197670c7d0e5

SHA512
814cd184cc8226a71e8b31d109f259adc771cfbefdba32b9b95f1bfb5d5d24812cc40bbec6daa622abfa3e4f8585582bcc00c16bf937aee38f821e77b53e2e1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6aecca1e8b58e35dc0e102dd691a2076

SHA1
3f720693159e4f1e027a7286dd0a0db76c6ab411

SHA256
cc1c539ded917071f1b837e553a23fc0ecd809b931ddc8180befd9eac2216476

SHA512
1f81d72267263201fba91b020c2e051992e05b4fdae32b8c0853afdd96833fd569ee0d002e7486f0bdd867707e3185d7e2ede1a1d3d83ad56e139fc548e4f00b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59cf25c8c2fd8e2e5d3cf7628196f7eb

SHA1
404fa3728e01bce24a08a9fe60d654fcad1f0e3b

SHA256
3016fa6213f347d84181054814c49ce15e3375889564c815862800c9e16149d1

SHA512
d2ef914fbbb351a3b07a5b337d67adbc55124fb16f61ff15bc95ab4457201076e7c65e0dbb9fa56b167c186b09692c05995c611d90b6aed3e914f8f086b96368

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e94a2bd462a93f07414a83523a050ddc

SHA1
1884584c4ab76bce53948fd562677fd449bbcb95

SHA256
cb02668b7fdc6bada141eeb9b1187155955a139a743019b08db5ce54e6a51f4d

SHA512
d93f113708ab79cad7451ae3b7aaa8480766c816f0d7445d329372da4426fcf84988360df832a6ffff67be1856eb93c56038af5d5d40a9f8a4348b29a6352e72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{8B5EB0B1-F4FB-11EF-9DC4-5A85C185DB3E}.dat

Filesize
5KB

MD5
cb5a922f4de25bd9b24b1a32d011c33b

SHA1
03fc27c0fe9cbdcc76d8746e1a303f2c092fd95e

SHA256
756379a50d63c7c65b47cb38b43bd8db4afe3be4b2150652a30b261ea7723a8e

SHA512
4f7955d583d508e98b0fb5ec83dc4ac06904d82dac1eda22369bff777175353af45151de996dd590198f28a0af0df8c85ecc742879071a8cf9007d80c37fd561

Download Submit
C:\Users\Admin\AppData\Local\Temp\2025-02-27_97b5211be2a493d35ed933b4b89bc1d5_icedid_ramnitmgr.exe

Filesize
105KB

MD5
d5ca6e1f080abc64bbb11e098acbeabb

SHA1
1849634bf5a65e1baddddd4452c99dfa003e2647

SHA256
30193b5ccf8a1834eac3502ef165350ab74b107451145f3d2937fdf24b9eceae

SHA512
aa57ce51de38af6212d7339c4baac543a54b0f527621b0ef9e78eca5e5699e8508a154f54f8ac04135527d8417275eeee72a502a362547575699330cc756b161

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE350.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE3E4.tmp

Filesize
183KB

MD5
109cab5505f5e065b63d01361467a83b

SHA1
4ed78955b9272a9ed689b51bf2bf4a86a25e53fc

SHA256
ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673

SHA512
753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc

Download Submit
memory/1184-42-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/1184-10-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/1184-13-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/1184-12-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/1184-16-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/1184-14-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/1184-15-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/1184-11-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1568-21-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1568-0-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1568-4-0x0000000000220000-0x000000000027D000-memory.dmp

Filesize
372KB

Download
memory/1568-18-0x00000000003D0000-0x00000000003DC000-memory.dmp

Filesize
48KB

Download
memory/2576-24-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2576-43-0x0000000000220000-0x000000000027D000-memory.dmp

Filesize
372KB

Download
memory/2576-32-0x0000000000220000-0x000000000027D000-memory.dmp

Filesize
372KB

Download
memory/2576-31-0x0000000000220000-0x000000000027D000-memory.dmp

Filesize
372KB

Download
memory/2576-41-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2576-38-0x00000000002E0000-0x00000000002EC000-memory.dmp

Filesize
48KB

Download
memory/2620-34-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2620-36-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/2620-35-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/2620-37-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download