ramnit | 4fabf04b7caba69d19f0db876f22d9a994cb143710f1d44d7204dcef03454ccc

Analysis

max time kernel
150s
max time network
142s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 20:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

175f69bb5f3df6df139d3711f6fac46b_JaffaCakes118.dll
Size

208KB
MD5

175f69bb5f3df6df139d3711f6fac46b
SHA1

16c6e5c4bb04d0189cf718d211c2551473db1550
SHA256

4fabf04b7caba69d19f0db876f22d9a994cb143710f1d44d7204dcef03454ccc
SHA512

e0c244594152b9a3dd955be528844f72cc61642afc482e690d714dfd37c5a7425600574f491021649e4eb9ff4b3a3a3d69cb65cbd18b832133a9afc81c270680
SSDEEP

3072:K2UxPvVKNiNz1a2JRC+Tq/KcKFUvJeXAMWRb3B+me4Tj3ejUP:pGvQ4Nx9RHTV5UvJx/Rr3eG

Score

10^/10

ramnit banker persistence spyware stealer trojan upx worm

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe"	svchost.exe

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Executes dropped EXE 2 IoCs

Processes:

rundll32mgr.exeWaterMark.exe

pid process

1944 rundll32mgr.exe
2472 WaterMark.exe
Loads dropped DLL 4 IoCs

Processes:

rundll32.exerundll32mgr.exe

pid process

1684 rundll32.exe
1684 rundll32.exe
1944 rundll32mgr.exe
1944 rundll32mgr.exe

pid	process
1944	rundll32mgr.exe
2472	WaterMark.exe

pid	process
1684	rundll32.exe
1684	rundll32.exe
1944	rundll32mgr.exe
1944	rundll32mgr.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1944-14-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1944-16-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1944-18-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1944-25-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2472-44-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral1/memory/2472-43-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1944-19-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1944-17-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1944-15-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2472-572-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Drops file in System32 directory 3 IoCs

Processes:

rundll32.exesvchost.exe

description	ioc	process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe
File created	C:\Windows\SysWOW64\dmlconf.dat	svchost.exe
File opened for modification	C:\Windows\SysWOW64\dmlconf.dat	svchost.exe

Drops file in Program Files directory 64 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_dummy_plugin.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dt_socket.dll	svchost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.IdentityModel.Selectors.Resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libamem_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Media Player\WMPDMC.exe	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\OSETUPUI.DLL	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2iexp.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\license.html	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Web.Entity.Design.Resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\control\libwin_hotkeys_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\spu\liblogo_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\nio.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\PresentationFramework.resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libvorbis_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mlp_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\settings.html	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\OARPMANR.DLL	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe	svchost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\api-ms-win-crt-process-l1-1-0.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\liblpcm_plugin.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEOLEDB.DLL	svchost.exe
File opened for modification	C:\Program Files\DVD Maker\Pipeline.dll	svchost.exe
File opened for modification	C:\Program Files\DVD Maker\WMM2CLIP.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\awt.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Management.Instrumentation.Resources.dll	svchost.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Checkers\Chkr.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\PresentationCore.resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_output\libwingdi_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_output\libglinterop_dxva2_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_output\libglwin32_plugin.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\BIBUtils.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\decora-sse.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\ssvagent.exe	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Web.Entity.Resources.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Utilities.v3.5.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.DirectoryServices.AccountManagement.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\calendar.html	svchost.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\msadcfr.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\epl-v10.html	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\plugin2\msvcr100.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\imjplm.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\penjpn.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\System\ado\msadomd.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Entity.Design.Resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libugly_resampler_plugin.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\airappinstaller.exe	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libvnc_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Mail\MSOERES.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\settings.html	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\sbdrop.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\msdarem.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.DataSetExtensions.Resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libsatip_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\sunmscapi.dll	svchost.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

Processes:

WaterMark.exesvchost.exe

pid	process
2472	WaterMark.exe
2472	WaterMark.exe
2472	WaterMark.exe
2472	WaterMark.exe
2472	WaterMark.exe
2472	WaterMark.exe
2472	WaterMark.exe
2472	WaterMark.exe
2532	svchost.exe
2532	svchost.exe
2532	svchost.exe
2532	svchost.exe
2532	svchost.exe
2532	svchost.exe
2532	svchost.exe
2532	svchost.exe
2532	svchost.exe
2532	svchost.exe
2532	svchost.exe
2532	svchost.exe
2532	svchost.exe
2532	svchost.exe
2532	svchost.exe
2532	svchost.exe
2532	svchost.exe
2532	svchost.exe
2532	svchost.exe
2532	svchost.exe
2532	svchost.exe
2532	svchost.exe
2532	svchost.exe
2532	svchost.exe
2532	svchost.exe
2532	svchost.exe
2532	svchost.exe
2532	svchost.exe
2532	svchost.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WaterMark.exesvchost.exe

description pid process

Token: SeDebugPrivilege 2472 WaterMark.exe
Token: SeDebugPrivilege 2532 svchost.exe
Token: SeDebugPrivilege 2472 WaterMark.exe
Suspicious use of UnmapMainImage 2 IoCs

Processes:

rundll32mgr.exeWaterMark.exe

pid process

1944 rundll32mgr.exe
2472 WaterMark.exe

description	pid	process
Token: SeDebugPrivilege	2472	WaterMark.exe
Token: SeDebugPrivilege	2532	svchost.exe
Token: SeDebugPrivilege	2472	WaterMark.exe

pid	process
1944	rundll32mgr.exe
2472	WaterMark.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

rundll32.exerundll32.exerundll32mgr.exeWaterMark.exesvchost.exe

description	pid	process	target process
PID 1936 wrote to memory of 1684	1936	rundll32.exe	rundll32.exe
PID 1936 wrote to memory of 1684	1936	rundll32.exe	rundll32.exe
PID 1936 wrote to memory of 1684	1936	rundll32.exe	rundll32.exe
PID 1936 wrote to memory of 1684	1936	rundll32.exe	rundll32.exe
PID 1936 wrote to memory of 1684	1936	rundll32.exe	rundll32.exe
PID 1936 wrote to memory of 1684	1936	rundll32.exe	rundll32.exe
PID 1936 wrote to memory of 1684	1936	rundll32.exe	rundll32.exe
PID 1684 wrote to memory of 1944	1684	rundll32.exe	rundll32mgr.exe
PID 1684 wrote to memory of 1944	1684	rundll32.exe	rundll32mgr.exe
PID 1684 wrote to memory of 1944	1684	rundll32.exe	rundll32mgr.exe
PID 1684 wrote to memory of 1944	1684	rundll32.exe	rundll32mgr.exe
PID 1944 wrote to memory of 2472	1944	rundll32mgr.exe	WaterMark.exe
PID 1944 wrote to memory of 2472	1944	rundll32mgr.exe	WaterMark.exe
PID 1944 wrote to memory of 2472	1944	rundll32mgr.exe	WaterMark.exe
PID 1944 wrote to memory of 2472	1944	rundll32mgr.exe	WaterMark.exe
PID 2472 wrote to memory of 2604	2472	WaterMark.exe	svchost.exe
PID 2472 wrote to memory of 2604	2472	WaterMark.exe	svchost.exe
PID 2472 wrote to memory of 2604	2472	WaterMark.exe	svchost.exe
PID 2472 wrote to memory of 2604	2472	WaterMark.exe	svchost.exe
PID 2472 wrote to memory of 2604	2472	WaterMark.exe	svchost.exe
PID 2472 wrote to memory of 2604	2472	WaterMark.exe	svchost.exe
PID 2472 wrote to memory of 2604	2472	WaterMark.exe	svchost.exe
PID 2472 wrote to memory of 2604	2472	WaterMark.exe	svchost.exe
PID 2472 wrote to memory of 2604	2472	WaterMark.exe	svchost.exe
PID 2472 wrote to memory of 2604	2472	WaterMark.exe	svchost.exe
PID 2472 wrote to memory of 2532	2472	WaterMark.exe	svchost.exe
PID 2472 wrote to memory of 2532	2472	WaterMark.exe	svchost.exe
PID 2472 wrote to memory of 2532	2472	WaterMark.exe	svchost.exe
PID 2472 wrote to memory of 2532	2472	WaterMark.exe	svchost.exe
PID 2472 wrote to memory of 2532	2472	WaterMark.exe	svchost.exe
PID 2472 wrote to memory of 2532	2472	WaterMark.exe	svchost.exe
PID 2472 wrote to memory of 2532	2472	WaterMark.exe	svchost.exe
PID 2472 wrote to memory of 2532	2472	WaterMark.exe	svchost.exe
PID 2472 wrote to memory of 2532	2472	WaterMark.exe	svchost.exe
PID 2472 wrote to memory of 2532	2472	WaterMark.exe	svchost.exe
PID 2532 wrote to memory of 256	2532	svchost.exe	smss.exe
PID 2532 wrote to memory of 256	2532	svchost.exe	smss.exe
PID 2532 wrote to memory of 256	2532	svchost.exe	smss.exe
PID 2532 wrote to memory of 256	2532	svchost.exe	smss.exe
PID 2532 wrote to memory of 256	2532	svchost.exe	smss.exe
PID 2532 wrote to memory of 336	2532	svchost.exe	csrss.exe
PID 2532 wrote to memory of 336	2532	svchost.exe	csrss.exe
PID 2532 wrote to memory of 336	2532	svchost.exe	csrss.exe
PID 2532 wrote to memory of 336	2532	svchost.exe	csrss.exe
PID 2532 wrote to memory of 336	2532	svchost.exe	csrss.exe
PID 2532 wrote to memory of 384	2532	svchost.exe	wininit.exe
PID 2532 wrote to memory of 384	2532	svchost.exe	wininit.exe
PID 2532 wrote to memory of 384	2532	svchost.exe	wininit.exe
PID 2532 wrote to memory of 384	2532	svchost.exe	wininit.exe
PID 2532 wrote to memory of 384	2532	svchost.exe	wininit.exe
PID 2532 wrote to memory of 392	2532	svchost.exe	csrss.exe
PID 2532 wrote to memory of 392	2532	svchost.exe	csrss.exe
PID 2532 wrote to memory of 392	2532	svchost.exe	csrss.exe
PID 2532 wrote to memory of 392	2532	svchost.exe	csrss.exe
PID 2532 wrote to memory of 392	2532	svchost.exe	csrss.exe
PID 2532 wrote to memory of 432	2532	svchost.exe	winlogon.exe
PID 2532 wrote to memory of 432	2532	svchost.exe	winlogon.exe
PID 2532 wrote to memory of 432	2532	svchost.exe	winlogon.exe
PID 2532 wrote to memory of 432	2532	svchost.exe	winlogon.exe
PID 2532 wrote to memory of 432	2532	svchost.exe	winlogon.exe
PID 2532 wrote to memory of 480	2532	svchost.exe	services.exe
PID 2532 wrote to memory of 480	2532	svchost.exe	services.exe
PID 2532 wrote to memory of 480	2532	svchost.exe	services.exe
PID 2532 wrote to memory of 480	2532	svchost.exe	services.exe

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe
1⤵
PID:256

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:336

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:384

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
2⤵
PID:480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
3⤵
PID:588

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
4⤵
PID:836

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -Embedding
4⤵
PID:1704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS
3⤵
PID:668

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
3⤵
PID:752

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
3⤵
PID:804

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
4⤵
PID:1000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
3⤵
PID:848

C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
4⤵
PID:984

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
3⤵
PID:960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService
3⤵
PID:236

C:\Windows\system32\taskhost.exe
"taskhost.exe"
3⤵
PID:1040

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
3⤵
PID:1060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
3⤵
PID:1144

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
3⤵
PID:2928

C:\Windows\system32\sppsvc.exe
C:\Windows\system32\sppsvc.exe
3⤵
PID:3048

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
2⤵
PID:488

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
2⤵
PID:496

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:392

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:432

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1096

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\175f69bb5f3df6df139d3711f6fac46b_JaffaCakes118.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1936

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\175f69bb5f3df6df139d3711f6fac46b_JaffaCakes118.dll,#1
3⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1684

C:\Windows\SysWOW64\rundll32mgr.exe
C:\Windows\SysWOW64\rundll32mgr.exe
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1944

C:\Program Files (x86)\Microsoft\WaterMark.exe
"C:\Program Files (x86)\Microsoft\WaterMark.exe"
5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2472

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
6⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
PID:2604

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2532

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html
Filesize
232KB

MD5
a89e956da81cc963af15e34fdde6d52e

SHA1
c9fe11aeea3411c192035cc3d9c211df5683d84b

SHA256
cac13e9ead53ff3a0ef1d3a766a5925999bbd36da8f4c049bd27c8b1ec82e168

SHA512
efaf6c5135edd01875549d6a3a1d676dce088aee016541905d33a388446345144e0c5182153f9c0a161c1191d284ccf93616ff2621a7ed234fd5d705b2a8684c

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html
Filesize
228KB

MD5
e4c42c8a2e9d28c9a8cf1ff282fba7de

SHA1
c7af4ca3fa1577c0ebe460125a03f7f7fc2c0673

SHA256
ccc8b0b8156d4158dde6a445c90bd9698ece24bbafb43637cc0dd46bc03c3b9b

SHA512
1698ce72eb795abb5748df8766a21b5cd04dc580bc656af2d1d454424662c7e30cd67f30b85810550ffa94441d8a0e60ada190075d1e98a096fbcb07926d8da7

Download Submit
\Windows\SysWOW64\rundll32mgr.exe
Filesize
109KB

MD5
9cb1d76074df9146c68ddf4ccf45ad0c

SHA1
cfd8e8afcb4d01b8a33bb996f38e8a8ae5902048

SHA256
124fca6b9dd184840ec013d834aa93207f592853aa4e43a3c3c3464ceaf5eecd

SHA512
8c61494be068468283e6da9dcd9893d883e1c22e7a946cf7a69f4159cd7bd09826eca322b4f38c8c9501ac210a6133df89426a22efacd3591dd9950b407dea2c

Download Submit
memory/1684-12-0x00000000001A0000-0x00000000001C6000-memory.dmp

Filesize
152KB

Download
memory/1684-1-0x000000006D280000-0x000000006D2B4000-memory.dmp

Filesize
208KB

Download
memory/1684-0-0x000000006D280000-0x000000006D2B4000-memory.dmp

Filesize
208KB

Download
memory/1684-5-0x00000000001A0000-0x00000000001C6000-memory.dmp

Filesize
152KB

Download
memory/1684-3-0x000000006D280000-0x000000006D2B4000-memory.dmp

Filesize
208KB

Download
memory/1944-25-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1944-18-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1944-15-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1944-32-0x00000000001B0000-0x00000000001D6000-memory.dmp

Filesize
152KB

Download
memory/1944-31-0x00000000001B0000-0x00000000001D6000-memory.dmp

Filesize
152KB

Download
memory/1944-19-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1944-16-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1944-14-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1944-24-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/1944-17-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1944-13-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2472-46-0x000000007738F000-0x0000000077390000-memory.dmp

Filesize
4KB

Download
memory/2472-75-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2472-92-0x000000007738F000-0x0000000077390000-memory.dmp

Filesize
4KB

Download
memory/2472-572-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2472-45-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/2472-44-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2472-43-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2532-91-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2532-93-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/2532-96-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2532-98-0x0000000077390000-0x0000000077391000-memory.dmp

Filesize
4KB

Download
memory/2532-97-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2532-77-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2532-95-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2532-94-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2532-87-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2604-48-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2604-71-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/2604-70-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2604-69-0x00000000000A0000-0x00000000000A1000-memory.dmp

Filesize
4KB

Download
memory/2604-62-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2604-57-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2604-72-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2604-1013-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2604-67-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2604-50-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download