ramnit | 377031a94559fef772cda1593232a3b2c7fa6ac7ec57dc44a37cacef3cfa2c06

Analysis

max time kernel
149s
max time network
134s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 21:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-03-22_11440d40b4dcfc3cf8383f9097433bb8_amadey_icedid_ramnit_rhadamanthys.exe
Size

1.9MB
MD5

11440d40b4dcfc3cf8383f9097433bb8
SHA1

f0f69363ebceee5c5945f44867ab7feb7ea2f57b
SHA256

377031a94559fef772cda1593232a3b2c7fa6ac7ec57dc44a37cacef3cfa2c06
SHA512

36c10cdcd318638aab437a4bdd9e3088d5194dea1359786a960f1d595727f734349104c02cd5fab5258d95591a990ef9e1ec113958e1c81f27eff020b1f1feeb
SSDEEP

24576:87ZGy9+Acpjdv+K3eqA6dj6YU1s20UPxXMP2Wk4AX:+/Sp5AyAXtWk1

Score

10^/10

ramnit banker discovery spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Ramnit family
ramnit

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\Rockey4.sys	2025-03-22_11440d40b4dcfc3cf8383f9097433bb8_amadey_icedid_ramnit_rhadamanthys.exe
File created	C:\Windows\SysWOW64\drivers\Rockey4USB.sys	2025-03-22_11440d40b4dcfc3cf8383f9097433bb8_amadey_icedid_ramnit_rhadamanthys.exe

Executes dropped EXE 2 IoCs

pid	Process
2816	2025-03-22_11440d40b4dcfc3cf8383f9097433bb8_amadey_icedid_ramnit_rhadamanthysSrv.exe
2724	DesktopLayer.exe

Loads dropped DLL 3 IoCs

pid	Process
2728	2025-03-22_11440d40b4dcfc3cf8383f9097433bb8_amadey_icedid_ramnit_rhadamanthys.exe
2816	2025-03-22_11440d40b4dcfc3cf8383f9097433bb8_amadey_icedid_ramnit_rhadamanthysSrv.exe
2728	2025-03-22_11440d40b4dcfc3cf8383f9097433bb8_amadey_icedid_ramnit_rhadamanthys.exe

Drops file in System32 directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\infstor.dat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\rockey4.inf_amd64_neutral_634c4492dc802a31\rockey4.PNF	DrvInst.exe
File created	C:\Windows\System32\DriverStore\INFCACHE.0	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infstrng.dat	2025-03-22_11440d40b4dcfc3cf8383f9097433bb8_amadey_icedid_ramnit_rhadamanthys.exe
File created	C:\Windows\System32\DriverStore\Temp\{15533736-3ff8-0a91-5534-0d29af3cae37}\SETAA54.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{15533736-3ff8-0a91-5534-0d29af3cae37}\SETAA65.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{15533736-3ff8-0a91-5534-0d29af3cae37}\SETAA66.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{15533736-3ff8-0a91-5534-0d29af3cae37}\Rockey4USB.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\rockey4.inf_amd64_neutral_634c4492dc802a31\rockey4.PNF	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{15533736-3ff8-0a91-5534-0d29af3cae37}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{15533736-3ff8-0a91-5534-0d29af3cae37}\Rockey4.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{15533736-3ff8-0a91-5534-0d29af3cae37}\SETAA54.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{15533736-3ff8-0a91-5534-0d29af3cae37}\SETAA65.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{15533736-3ff8-0a91-5534-0d29af3cae37}\Ry4CoInst.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{15533736-3ff8-0a91-5534-0d29af3cae37}\SETAA67.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infpub.dat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infstrng.dat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\rockey4.inf_amd64_neutral_634c4492dc802a31\Rockey4.PNF	DrvInst.exe
File created	C:\Windows\SysWOW64\InstDll.dll	2025-03-22_11440d40b4dcfc3cf8383f9097433bb8_amadey_icedid_ramnit_rhadamanthys.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{15533736-3ff8-0a91-5534-0d29af3cae37}\SETAA43.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{15533736-3ff8-0a91-5534-0d29af3cae37}\SETAA43.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{15533736-3ff8-0a91-5534-0d29af3cae37}\Rockey4.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{15533736-3ff8-0a91-5534-0d29af3cae37}\SETAA67.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	2025-03-22_11440d40b4dcfc3cf8383f9097433bb8_amadey_icedid_ramnit_rhadamanthys.exe
File opened for modification	C:\Windows\System32\DriverStore\infpub.dat	2025-03-22_11440d40b4dcfc3cf8383f9097433bb8_amadey_icedid_ramnit_rhadamanthys.exe
File created	C:\Windows\SysWOW64\Ry4CoInst.dll	2025-03-22_11440d40b4dcfc3cf8383f9097433bb8_amadey_icedid_ramnit_rhadamanthys.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{15533736-3ff8-0a91-5534-0d29af3cae37}\Rockey4.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{15533736-3ff8-0a91-5534-0d29af3cae37}\SETAA66.tmp	DrvInst.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000800000001227e-2.dat	upx
behavioral1/memory/2816-13-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2724-15-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2724-22-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2724-21-0x0000000000230000-0x000000000023F000-memory.dmp	upx
behavioral1/memory/2724-24-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2724-26-0x0000000000400000-0x000000000042E000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\px447F.tmp	2025-03-22_11440d40b4dcfc3cf8383f9097433bb8_amadey_icedid_ramnit_rhadamanthysSrv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	2025-03-22_11440d40b4dcfc3cf8383f9097433bb8_amadey_icedid_ramnit_rhadamanthysSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	2025-03-22_11440d40b4dcfc3cf8383f9097433bb8_amadey_icedid_ramnit_rhadamanthysSrv.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File created	C:\Windows\INF\oem2.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	2025-03-22_11440d40b4dcfc3cf8383f9097433bb8_amadey_icedid_ramnit_rhadamanthys.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\oem2.inf	DrvInst.exe
File created	C:\Windows\INF\oem2.inf	2025-03-22_11440d40b4dcfc3cf8383f9097433bb8_amadey_icedid_ramnit_rhadamanthys.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-03-22_11440d40b4dcfc3cf8383f9097433bb8_amadey_icedid_ramnit_rhadamanthys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-03-22_11440d40b4dcfc3cf8383f9097433bb8_amadey_icedid_ramnit_rhadamanthysSrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopLayer.exe

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{20A05D71-0764-11F0-BFDF-52AA2C275983} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "448840577"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CTLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2724	DesktopLayer.exe
2724	DesktopLayer.exe
2724	DesktopLayer.exe
2724	DesktopLayer.exe

Suspicious use of AdjustPrivilegeToken 51 IoCs

description	pid	Process
Token: SeRestorePrivilege	2728	2025-03-22_11440d40b4dcfc3cf8383f9097433bb8_amadey_icedid_ramnit_rhadamanthys.exe
Token: SeRestorePrivilege	2728	2025-03-22_11440d40b4dcfc3cf8383f9097433bb8_amadey_icedid_ramnit_rhadamanthys.exe
Token: SeRestorePrivilege	2728	2025-03-22_11440d40b4dcfc3cf8383f9097433bb8_amadey_icedid_ramnit_rhadamanthys.exe
Token: SeRestorePrivilege	2728	2025-03-22_11440d40b4dcfc3cf8383f9097433bb8_amadey_icedid_ramnit_rhadamanthys.exe
Token: SeRestorePrivilege	2728	2025-03-22_11440d40b4dcfc3cf8383f9097433bb8_amadey_icedid_ramnit_rhadamanthys.exe
Token: SeRestorePrivilege	2728	2025-03-22_11440d40b4dcfc3cf8383f9097433bb8_amadey_icedid_ramnit_rhadamanthys.exe
Token: SeRestorePrivilege	2728	2025-03-22_11440d40b4dcfc3cf8383f9097433bb8_amadey_icedid_ramnit_rhadamanthys.exe
Token: SeRestorePrivilege	2728	2025-03-22_11440d40b4dcfc3cf8383f9097433bb8_amadey_icedid_ramnit_rhadamanthys.exe
Token: SeRestorePrivilege	2728	2025-03-22_11440d40b4dcfc3cf8383f9097433bb8_amadey_icedid_ramnit_rhadamanthys.exe
Token: SeRestorePrivilege	2728	2025-03-22_11440d40b4dcfc3cf8383f9097433bb8_amadey_icedid_ramnit_rhadamanthys.exe
Token: SeRestorePrivilege	2728	2025-03-22_11440d40b4dcfc3cf8383f9097433bb8_amadey_icedid_ramnit_rhadamanthys.exe
Token: SeRestorePrivilege	2728	2025-03-22_11440d40b4dcfc3cf8383f9097433bb8_amadey_icedid_ramnit_rhadamanthys.exe
Token: SeRestorePrivilege	2728	2025-03-22_11440d40b4dcfc3cf8383f9097433bb8_amadey_icedid_ramnit_rhadamanthys.exe
Token: SeRestorePrivilege	2728	2025-03-22_11440d40b4dcfc3cf8383f9097433bb8_amadey_icedid_ramnit_rhadamanthys.exe
Token: SeRestorePrivilege	1724	DrvInst.exe
Token: SeRestorePrivilege	1724	DrvInst.exe
Token: SeRestorePrivilege	1724	DrvInst.exe
Token: SeRestorePrivilege	1724	DrvInst.exe
Token: SeRestorePrivilege	1724	DrvInst.exe
Token: SeRestorePrivilege	1724	DrvInst.exe
Token: SeRestorePrivilege	1724	DrvInst.exe
Token: SeRestorePrivilege	1724	DrvInst.exe
Token: SeRestorePrivilege	1724	DrvInst.exe
Token: SeRestorePrivilege	1724	DrvInst.exe
Token: SeRestorePrivilege	1724	DrvInst.exe
Token: SeRestorePrivilege	1724	DrvInst.exe
Token: SeRestorePrivilege	1724	DrvInst.exe
Token: SeRestorePrivilege	1724	DrvInst.exe
Token: SeRestorePrivilege	1916	rundll32.exe
Token: SeRestorePrivilege	1916	rundll32.exe
Token: SeRestorePrivilege	1916	rundll32.exe
Token: SeRestorePrivilege	1916	rundll32.exe
Token: SeRestorePrivilege	1916	rundll32.exe
Token: SeRestorePrivilege	1916	rundll32.exe
Token: SeRestorePrivilege	1916	rundll32.exe
Token: SeBackupPrivilege	2948	vssvc.exe
Token: SeRestorePrivilege	2948	vssvc.exe
Token: SeAuditPrivilege	2948	vssvc.exe
Token: SeBackupPrivilege	1724	DrvInst.exe
Token: SeRestorePrivilege	1724	DrvInst.exe
Token: SeRestorePrivilege	2160	DrvInst.exe
Token: SeRestorePrivilege	2160	DrvInst.exe
Token: SeRestorePrivilege	2160	DrvInst.exe
Token: SeRestorePrivilege	2160	DrvInst.exe
Token: SeRestorePrivilege	2160	DrvInst.exe
Token: SeRestorePrivilege	2160	DrvInst.exe
Token: SeRestorePrivilege	2160	DrvInst.exe
Token: SeLoadDriverPrivilege	2160	DrvInst.exe
Token: SeLoadDriverPrivilege	2160	DrvInst.exe
Token: SeLoadDriverPrivilege	2160	DrvInst.exe
Token: SeRestorePrivilege	2728	2025-03-22_11440d40b4dcfc3cf8383f9097433bb8_amadey_icedid_ramnit_rhadamanthys.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2736	iexplore.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
2728	2025-03-22_11440d40b4dcfc3cf8383f9097433bb8_amadey_icedid_ramnit_rhadamanthys.exe
2728	2025-03-22_11440d40b4dcfc3cf8383f9097433bb8_amadey_icedid_ramnit_rhadamanthys.exe
2728	2025-03-22_11440d40b4dcfc3cf8383f9097433bb8_amadey_icedid_ramnit_rhadamanthys.exe
2736	iexplore.exe
2736	iexplore.exe
2792	IEXPLORE.EXE
2792	IEXPLORE.EXE
2792	IEXPLORE.EXE
2792	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 2816	2728	2025-03-22_11440d40b4dcfc3cf8383f9097433bb8_amadey_icedid_ramnit_rhadamanthys.exe	30
PID 2728 wrote to memory of 2816	2728	2025-03-22_11440d40b4dcfc3cf8383f9097433bb8_amadey_icedid_ramnit_rhadamanthys.exe	30
PID 2728 wrote to memory of 2816	2728	2025-03-22_11440d40b4dcfc3cf8383f9097433bb8_amadey_icedid_ramnit_rhadamanthys.exe	30
PID 2728 wrote to memory of 2816	2728	2025-03-22_11440d40b4dcfc3cf8383f9097433bb8_amadey_icedid_ramnit_rhadamanthys.exe	30
PID 2816 wrote to memory of 2724	2816	2025-03-22_11440d40b4dcfc3cf8383f9097433bb8_amadey_icedid_ramnit_rhadamanthysSrv.exe	31
PID 2816 wrote to memory of 2724	2816	2025-03-22_11440d40b4dcfc3cf8383f9097433bb8_amadey_icedid_ramnit_rhadamanthysSrv.exe	31
PID 2816 wrote to memory of 2724	2816	2025-03-22_11440d40b4dcfc3cf8383f9097433bb8_amadey_icedid_ramnit_rhadamanthysSrv.exe	31
PID 2816 wrote to memory of 2724	2816	2025-03-22_11440d40b4dcfc3cf8383f9097433bb8_amadey_icedid_ramnit_rhadamanthysSrv.exe	31
PID 2724 wrote to memory of 2736	2724	DesktopLayer.exe	32
PID 2724 wrote to memory of 2736	2724	DesktopLayer.exe	32
PID 2724 wrote to memory of 2736	2724	DesktopLayer.exe	32
PID 2724 wrote to memory of 2736	2724	DesktopLayer.exe	32
PID 2736 wrote to memory of 2792	2736	iexplore.exe	33
PID 2736 wrote to memory of 2792	2736	iexplore.exe	33
PID 2736 wrote to memory of 2792	2736	iexplore.exe	33
PID 2736 wrote to memory of 2792	2736	iexplore.exe	33
PID 1724 wrote to memory of 1916	1724	DrvInst.exe	36
PID 1724 wrote to memory of 1916	1724	DrvInst.exe	36
PID 1724 wrote to memory of 1916	1724	DrvInst.exe	36

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2025-03-22_11440d40b4dcfc3cf8383f9097433bb8_amadey_icedid_ramnit_rhadamanthys.exe
"C:\Users\Admin\AppData\Local\Temp\2025-03-22_11440d40b4dcfc3cf8383f9097433bb8_amadey_icedid_ramnit_rhadamanthys.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Users\Admin\AppData\Local\Temp\2025-03-22_11440d40b4dcfc3cf8383f9097433bb8_amadey_icedid_ramnit_rhadamanthysSrv.exe
  C:\Users\Admin\AppData\Local\Temp\2025-03-22_11440d40b4dcfc3cf8383f9097433bb8_amadey_icedid_ramnit_rhadamanthysSrv.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Program Files (x86)\Microsoft\DesktopLayer.exe
    "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2724
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2736
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2736 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2792

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{48260679-aa8e-31cb-f61d-594b52c3e74b}\Rockey4.inf" "9" "6281a14cb" "00000000000003F0" "WinSta0\Default" "00000000000005C0" "208" "C:\Windows\Temp"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{36a8f9bf-8bc3-257c-421a-dc2d45f15b29} Global\{54213acd-034c-6709-9110-d3708240ab12} C:\Windows\System32\DriverStore\Temp\{15533736-3ff8-0a91-5534-0d29af3cae37}\Rockey4.inf C:\Windows\System32\DriverStore\Temp\{15533736-3ff8-0a91-5534-0d29af3cae37}\Rockey4.cat
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1916

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2948

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005F4" "00000000000005F8"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
71KB

MD5
83142242e97b8953c386f988aa694e4a

SHA1
833ed12fc15b356136dcdd27c61a50f59c5c7d50

SHA256
d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755

SHA512
bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
058f45b64a29c9643e4f1c3a2256b30d

SHA1
16791c86c597f24ac7f2b55ecf68009005bf2d08

SHA256
63574ebae514c052d8e85498cbc2493b68389f09251caf614ed1728d8ccf8262

SHA512
b2852607528edddba7d3e1900b19b9bb4957c5d43802ee39ecec7e91bdf14c011c4ecbb94b7ad9697a77a6e0ddc2055802412244a64ea2ee772f6264c9bb4dc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
29051982064042ac0da839e9d885c7b1

SHA1
68463c7f42ee236e9ec01a29f51fab9de3fd9c32

SHA256
8112f5086a8707e9ac913d64add4aa91d093b3437c670373b77230306066a703

SHA512
b7b384e23ae5e0f6ccee5604d7ef8d9c8808cd285d0bc6fd2059bdd287cb96108308503481283b8caee3c12cd06959f5a44f488d24413d37eeb371285497659a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
328a0bee456a43d040f882567333755d

SHA1
b50e1797813b2030bc251c0a6ba17a8bca5052de

SHA256
c336688b5efe470bf2a38bc269ac7cab7c34e9c356783a851ccd6910e2c44073

SHA512
50b23cf16ed37ece3bc0292b9dc2c39e970c142b65fca03b106f109a9c4863d4e2dd532b6cb7b9c8186cacbd6fba3240458b438fad91a9a8ce80e713c0eb01de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e81d4c72d85b862db5ab8b479c3c1a9b

SHA1
6c0e4bd62fad7c3b072d5ff7e91e9467d2b447cc

SHA256
07806e833817a7c8f9a56cc3cf58af61216a76c9252b2f335e53b10c2571c4f2

SHA512
af9c660e552de97afb37a6de7296ab1bf160cc73d89130a5e95059d5d978d3e61fa598827d3751b7709830a79566e853e1b2821846d526fcb3e4f364248eb2a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8eaa4e63b0b83d4be0b971fe2688708e

SHA1
12b12d38dc3b8c3392e5092c26bf1403d8072d56

SHA256
8312444625e3de1545a1db0e4869abe650fc6c3c73c293f5ae46a571372a2294

SHA512
68bd26d8d20663a66b3fe63506a6be4057b596500c26c3f23ee2b7edb7127db1ba3ec9af34299c105200e5db294e865a3a997c587192a9e2279c020a6e4c72f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4be278a4d816a7538f9152dd1f9cfdbf

SHA1
c66283c7814c19934d46f35d9eb9cb62f796e48e

SHA256
456213173f6ba3753edac9a48e64c67f635e4ebff5c44ccc58ab336f17997ed0

SHA512
4266014a4b7954d609c35a5c4a2e7e94cf032ae9c133d53a95d51ac1e57f75c82728e4b79b529cacf30c15d4152044c9d79034d2e32cecd2a862f227b40dd00d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fea10bcdbc286f42e30353ff32839a41

SHA1
703e9dc9475d4a909ffb6260c8fe02fe77ae7544

SHA256
2656c1ce337601615fd6567c786aa2797b2bc219b4f4c699f9df4612b50a52c2

SHA512
5cbf81e9f2e100a234092749a3e2b09c375f6580e97b1c81afcc2f76af6585339ce6e17a9e7876e6afb2a8c04a1787f2a3697d8ced8e9f3c8297e2e5d26814a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8431b4c97001400704eda7d56114392

SHA1
3146c09f2215eaee07fe8682934ac0b224e43574

SHA256
ba4377748518b01610dde31b102dd51f8623dca347cbfb75a7db9bc67a1ef82f

SHA512
9c471c7a2b9133b5a3c105f8e1210ff02e73201e67cd298c998c3571d0fe0c24590abb79caecf6e71ad83739b5b6c34161232861d8e1f3f16090664e8b3c2fb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00774d0e11eb7baf1afbfc1acc7f8e85

SHA1
06ddef06cc5756b89c8cac70635b6db58c47fa7f

SHA256
c9744e972205fe76c0786b26e516c43efd9e012e273c0b966b50ec7ae25ae450

SHA512
da3abf0585f783aeb916faf008c6c410a904e200a8ce9270831d341178d3139c2cdad1d80e98d504f896c2acc7649ddaba9ea52688954213d296622f2dfd5b4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
111874b262889c31a554d00defe60fd6

SHA1
acba5d54d71b47ecb010ca2c356e4560ec67478f

SHA256
b5ca3cd5a4a2b75bf7206f4704dc856a6c49576aea6bbf4f74c7131ac1cc256c

SHA512
63388a90a626ddd45b755d525be60ecea100548a6e955f29ebeae2787322c5fd7f295b6dc55d14b25a2ea0095257d86e779cae7645d9a62e777b58f1954cade0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
abd33faf99adaa5685cd1403d526c272

SHA1
aba1332361a19f32d5d6051989bf8494bcb770d6

SHA256
67ca00c80d0eabc336ec54f4da3f2a4200661c94c8c8660a1493d6cf664894da

SHA512
51d33857933c8b2a6b1f46ad89402c3d622a5d380ebe35def1827b0b539de9d0626ce9c788465ce5b9d74546735fd94d0ed9c2272e81d31d08c791a32b35caa9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c27abb1f159e5d5f61120598b7eb214

SHA1
5d3319fb32b8d34cf590e270024aaa8cd173aa74

SHA256
0208e4449df411d283bc9b0bf84a531e2383d585e38496922e8a94fbaa6dc8f0

SHA512
670780101474f8d68187eeed329c7133bfafe7813f30c6cbc9c01ffcbf1116864e68e77f149a1313d42213ffe3fb61fdda34ac485726e709822e8e88aa44f26b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e18c277c19d6ac5357eaf3d78f7f1016

SHA1
6e04beb275fd4f61ee9d7d696ce35025437d5609

SHA256
d9ec5e856d07ef972c6a10c2aafda79aaa1f4406922f288d03e46d0ab412a641

SHA512
2282f2d2621574f9ffaa5cbf5746c9a522fa3e1ff6fd269439e5611c0ee26f58304308b37b1df5cf25c6de07856f853f71e1857dbbcb309cc201a0bd47195bf1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1543591905779464f8f7c37aceb0b933

SHA1
65c55ab09d861dceb8f3a2fc17575a2905c477c5

SHA256
ebb477f1012fb0dae1cc03e8dd81eb2633a49259a1a944ec48f059ebff02e062

SHA512
f7bb93c6c221ed2a1b0a59ddc2e5fd67fb97eea26690c6710c75ceada39035a334e9401505447e647652b479598fa507a56b310c2d81d871f311179f521b0879

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71645e1357ca595f688ca47b6511cb40

SHA1
ef1803c3fbb7113119b2327f33f90dcd18906edc

SHA256
5e73a54f5e4fd53c0f85ed05fbf1f73383be9ab83c361df81c6baa9f88a3400d

SHA512
b2d88c63ecfa0bc68b80691b10e5f66af02bf9a09e7f9cbdabc38e64282a92cf4a1ec7cba5c526efc17af6e9e8bd4b45c4999c1d1b35bee49b38d2cb3509672f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf0dc95d1858b2c48a0b28c98bfc4dfa

SHA1
3553eb43b430cfd538c4eb5a70c33c1cacd46147

SHA256
4b20e05d4d0accbcd07a69b148c0b28807928caca0712507e269c5749e28f9eb

SHA512
b56aad68e022aff2e9cd86d5dffe03512e9ad277a74db6064dcaf412ab74e032acd188e7ba18353eeaa64446a5aac16cd85687d2c165cefe468940e87f696248

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
abcaee886bbe11b154826738b3de6098

SHA1
a6d68f0359c89810ce3856390c612cc96d004a83

SHA256
a3f243c6fbb0a35ed0029fd7216beddf68a4643f1b6df137854127bca8c92e5f

SHA512
b2db858a330e4d8e673a9381619985a057ed2114f11a45e6c760237575a68705a1de9996b9e014b3729bd0785fe699d5378134fd61c2f119ddcfc3cac20dbcf7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf270c0ebec2af543ebd133fcf0bd22d

SHA1
4b6996a497258eeb134b433bb7ece79baf717fba

SHA256
94810b4b24272c41c5a50208c4a2b1e64acc14f3f78435ae233a32556d78e47f

SHA512
c82642ff090d4fb022125caa9ed6f7f9416a10a7276b237f3b1e6117300c3bfc1d4691652ab449c3c4d51dda2dda747e558c9dfa5380e40615f1005855c9f062

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5D7D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5E8F.tmp

Filesize
183KB

MD5
109cab5505f5e065b63d01361467a83b

SHA1
4ed78955b9272a9ed689b51bf2bf4a86a25e53fc

SHA256
ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673

SHA512
753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc

Download Submit
C:\Windows\Temp\CabAB3F.tmp

Filesize
29KB

MD5
d59a6b36c5a94916241a3ead50222b6f

SHA1
e274e9486d318c383bc4b9812844ba56f0cff3c6

SHA256
a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53

SHA512
17012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489

Download Submit
C:\Windows\Temp\Rockey4.inf

Filesize
3KB

MD5
3ce2e5aeef01fa93d94868953406856b

SHA1
10d56292d022f39d8ceefded624f8522f5bdccfd

SHA256
8cf87f05e75dd558eac842ea3eeda9cafe675d4c6d1eaa211c403b7de2e599cb

SHA512
ffeb48efa4254d11d398eb6197ec1a8c0ae398d0bd3dd1cd7d3f66fd8f8e252e726b8adcf651c6e2f2bd9a78023151ca2103349bb63f788aef306010f6f983fc

Download Submit
C:\Windows\Temp\Rockey4.sys

Filesize
29KB

MD5
6b9b088f4921b5114f7916a1cfa90f51

SHA1
be3d21cf1a9eae23ff0464f2ee19d60891ba8777

SHA256
a3fbfe4c4c5195524107d1127e8165d53319f306e07647022a6557750f0b2c29

SHA512
961c9e56bb62098989d55a951da4b05db56d15ca26ca85f9413139f24ae3624056c33d16d711819f1cac97469fa456578fedcd30dde773d87523a29cb337a98d

Download Submit
C:\Windows\Temp\Rockey4USB.sys

Filesize
20KB

MD5
a215e31da7fc0369e315132303582b5b

SHA1
3dbb87e75c01ad93845a6c90602bdcd49f5e1882

SHA256
a55c1b52240efb612b0771f35797f2aa68b249be7f7da930a0ee5d8212c7f7a7

SHA512
c5d132725c3f41357b517341a28220cf205cba4c49376908b03e8780c6c456db70724f48b3ce89f90edb9e865308a607a41db0571e8e871c503e0ff251ce76a2

Download Submit
C:\Windows\Temp\Ry4CoInst.dll

Filesize
6KB

MD5
5d1e774106c240e330e7384f8bd2835c

SHA1
0e6bfc62067d52540eb84852eb1e160fb646e4d5

SHA256
fab2055534c54c8c8d3df3065a481fb8b2d1bc052c29ac500634ba63f32fea09

SHA512
48c4d2ac25e8e3f128201cc0503de7cdb952ad849fe760c112bf32ff0e9df96da16fa356ab99f64cb45eb3a4314fc3bfdc852e06a1263c4cd681c7b42b9df578

Download Submit
C:\Windows\Temp\TarABAF.tmp

Filesize
81KB

MD5
b13f51572f55a2d31ed9f266d581e9ea

SHA1
7eef3111b878e159e520f34410ad87adecf0ca92

SHA256
725980edc240c928bec5a5f743fdabeee1692144da7091cf836dc7d0997cef15

SHA512
f437202723b2817f2fef64b53d4eb67f782bdc61884c0c1890b46deca7ca63313ee2ad093428481f94edfcecd9c77da6e72b604998f7d551af959dbd6915809c

Download Submit
C:\Windows\Temp\rockey4.cat

Filesize
9KB

MD5
f5e17a72ecbe8f0556423e796124f785

SHA1
60b887c365c0541e0aa1518ac687bc3eb7e60a4c

SHA256
d0e390cbe3a1313d0b4348bfdc9da947616fc7dda4ecc414468b5f2151f5b60f

SHA512
4f85087d92b2b6494cb2a1d281c34bb72fa6bd9f31d3369aa9729ba12d320618836f2d25dc92dcec18b1c9cfa0f3977bff809d179a988ddacaf67acfe06ea9c4

Download Submit
\Users\Admin\AppData\Local\Temp\2025-03-22_11440d40b4dcfc3cf8383f9097433bb8_amadey_icedid_ramnit_rhadamanthysSrv.exe

Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
\Windows\SysWOW64\InstDll.dll

Filesize
412KB

MD5
28777af4daf84f9ad4145f7105e02477

SHA1
f2100f4812007a253134d4e134e6208a78263a2c

SHA256
7e0f6280add4c6000d6bf548402e849b83047b960ad89be067ae87e4dc103b77

SHA512
543e81509693ed6b75f9dbce536ab15f1bcac5f1fc71646b53ac2bafd2af5859add9acf21b247719e2cf6d2974c3c8552a1fb2f13d3f3be428099fc62e62dcad

Download Submit
memory/2724-26-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2724-24-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2724-23-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2724-21-0x0000000000230000-0x000000000023F000-memory.dmp

Filesize
60KB

Download
memory/2724-22-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2724-15-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2728-0-0x0000000000400000-0x00000000005F5000-memory.dmp

Filesize
2.0MB

Download
memory/2728-27-0x0000000000400000-0x00000000005F5000-memory.dmp

Filesize
2.0MB

Download
memory/2728-28-0x0000000000240000-0x000000000026E000-memory.dmp

Filesize
184KB

Download
memory/2728-4-0x0000000000240000-0x000000000026E000-memory.dmp

Filesize
184KB

Download
memory/2816-29-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2816-13-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download