Overview

overview

10

Static

static

3

e2e3adca74...99.exe

windows7-x64

10

e2e3adca74...99.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e2e3adca74a101c2ccc9449b7c75aff059d08864ba87698fdc6212e96390c799

  • Size

    319KB

  • Sample

    240629-esc64stelr

  • MD5

    09792127dbc60545639e024d1e2195e5

  • SHA1

    58fe06a353b2a4d6ab3d4fdc10a7c305f7563335

  • SHA256

    e2e3adca74a101c2ccc9449b7c75aff059d08864ba87698fdc6212e96390c799

  • SHA512

    0ea9ea7e7508192ea49db5b4d3da0baa8ae25612e044048c2313e356e2fcb70bfee68b5525305ed626d1186919cea598caf2bcf8ca026a6884e5f43e67b87589

  • SSDEEP

    3072:XVqoCl/YgjxEufVU0TbTyDDalBVnnAQVG/LytaKItS/fiLKS+f5Aq7iu:XsLqdufVUNDa5OTeHI8HiL7+f5b

Score
10/10
ramnitbankerevasionpersistencespywarestealertrojanupxworm

Malware Config

Targets

    • Target

      e2e3adca74a101c2ccc9449b7c75aff059d08864ba87698fdc6212e96390c799

    • Size

      319KB

    • MD5

      09792127dbc60545639e024d1e2195e5

    • SHA1

      58fe06a353b2a4d6ab3d4fdc10a7c305f7563335

    • SHA256

      e2e3adca74a101c2ccc9449b7c75aff059d08864ba87698fdc6212e96390c799

    • SHA512

      0ea9ea7e7508192ea49db5b4d3da0baa8ae25612e044048c2313e356e2fcb70bfee68b5525305ed626d1186919cea598caf2bcf8ca026a6884e5f43e67b87589

    • SSDEEP

      3072:XVqoCl/YgjxEufVU0TbTyDDalBVnnAQVG/LytaKItS/fiLKS+f5Aq7iu:XsLqdufVUNDa5OTeHI8HiL7+f5b

    Score
    10/10
    ramnitbankerevasionpersistencespywarestealertrojanupxworm

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

      trojanspywarestealerwormbankerramnit

    • UPX dump on OEP (original entry point)

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks