Overview

overview

10

Static

static

3

1c790e3f90...18.dll

windows7-x64

10

1c790e3f90...18.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1c790e3f90d5833165b99a2c263ec25f_JaffaCakes118

  • Size

    132KB

  • Sample

    240701-zr243atakk

  • MD5

    1c790e3f90d5833165b99a2c263ec25f

  • SHA1

    7ce6c7cd210fe4373a3a6a000e22b4171034fb9d

  • SHA256

    e13ede16535b61066908b31421dbab35708d571753394abaa68c7ae626651366

  • SHA512

    ec129aba61e0c01b83d698867a2493fc31932f99431bdd86cb77d36f377436789755b475bbc40d7134853f812ad09c27fc6aa1cc2ed547a73ab58b6ad1a93bd3

  • SSDEEP

    3072:lo6nwLqrSa4I+VCpy330wN6qb3MAxwgKYs:K6uj0wRb37xjs

Score
10/10
ramnitbankerpersistencespywarestealertrojanupxworm

Malware Config

Targets

    • Target

      1c790e3f90d5833165b99a2c263ec25f_JaffaCakes118

    • Size

      132KB

    • MD5

      1c790e3f90d5833165b99a2c263ec25f

    • SHA1

      7ce6c7cd210fe4373a3a6a000e22b4171034fb9d

    • SHA256

      e13ede16535b61066908b31421dbab35708d571753394abaa68c7ae626651366

    • SHA512

      ec129aba61e0c01b83d698867a2493fc31932f99431bdd86cb77d36f377436789755b475bbc40d7134853f812ad09c27fc6aa1cc2ed547a73ab58b6ad1a93bd3

    • SSDEEP

      3072:lo6nwLqrSa4I+VCpy330wN6qb3MAxwgKYs:K6uj0wRb37xjs

    Score
    10/10
    ramnitbankerpersistencespywarestealertrojanupxworm

    • Modifies WinLogon for persistence

      persistence

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

      trojanspywarestealerwormbankerramnit

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Winlogon Helper DLL

1
T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Winlogon Helper DLL

1
T1547.004

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks