ramnit | b5c6c407900323c075b22bcf983d851b718aa57146a8bca08b02bb6cdbcd3935

General

Target

b5c6c407900323c075b22bcf983d851b718aa57146a8bca08b02bb6cdbcd3935.exe
Size

2.4MB
MD5

d14ab4192771b0eb817a7efd4791a141
SHA1

921a80ddaa048c07e26c90c9ee72930bdcd9985d
SHA256

b5c6c407900323c075b22bcf983d851b718aa57146a8bca08b02bb6cdbcd3935
SHA512

96a5f6475fd5de9d0740972553ac45255888f744895e3628afa553b444dc5c51c18e72c3dbfa3488ac2d62274f8d171a3b6abe4d72246410831bc0551793a1f1

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Executes dropped EXE 2 IoCs

Processes:

b5c6c407900323c075b22bcf983d851b718aa57146a8bca08b02bb6cdbcd3935Srv.exeDesktopLayer.exe

pid process

1256 b5c6c407900323c075b22bcf983d851b718aa57146a8bca08b02bb6cdbcd3935Srv.exe
1376 DesktopLayer.exe

pid	process
1256	b5c6c407900323c075b22bcf983d851b718aa57146a8bca08b02bb6cdbcd3935Srv.exe
1376	DesktopLayer.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\b5c6c407900323c075b22bcf983d851b718aa57146a8bca08b02bb6cdbcd3935Srv.exe	upx
C:\Users\Admin\AppData\Local\Temp\b5c6c407900323c075b22bcf983d851b718aa57146a8bca08b02bb6cdbcd3935Srv.exe	upx
C:\Users\Admin\AppData\Local\Temp\b5c6c407900323c075b22bcf983d851b718aa57146a8bca08b02bb6cdbcd3935Srv.exe	upx
\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
behavioral1/memory/1256-75-0x0000000000400000-0x000000000042E000-memory.dmp	upx

Loads dropped DLL 2 IoCs

Processes:

b5c6c407900323c075b22bcf983d851b718aa57146a8bca08b02bb6cdbcd3935.exeb5c6c407900323c075b22bcf983d851b718aa57146a8bca08b02bb6cdbcd3935Srv.exe

pid	process
1996	b5c6c407900323c075b22bcf983d851b718aa57146a8bca08b02bb6cdbcd3935.exe
1256	b5c6c407900323c075b22bcf983d851b718aa57146a8bca08b02bb6cdbcd3935Srv.exe

Drops file in Program Files directory 3 IoCs

Processes:

b5c6c407900323c075b22bcf983d851b718aa57146a8bca08b02bb6cdbcd3935Srv.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	b5c6c407900323c075b22bcf983d851b718aa57146a8bca08b02bb6cdbcd3935Srv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px94B1.tmp	b5c6c407900323c075b22bcf983d851b718aa57146a8bca08b02bb6cdbcd3935Srv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	b5c6c407900323c075b22bcf983d851b718aa57146a8bca08b02bb6cdbcd3935Srv.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

b5c6c407900323c075b22bcf983d851b718aa57146a8bca08b02bb6cdbcd3935.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	b5c6c407900323c075b22bcf983d851b718aa57146a8bca08b02bb6cdbcd3935.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	b5c6c407900323c075b22bcf983d851b718aa57146a8bca08b02bb6cdbcd3935.exe

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "327296181"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4E34B9F1-B077-11EB-896A-766459B397AD} = "0"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

DesktopLayer.exe

pid process

1376 DesktopLayer.exe
1376 DesktopLayer.exe
1376 DesktopLayer.exe
1376 DesktopLayer.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1984 iexplore.exe

pid	process
1376	DesktopLayer.exe
1376	DesktopLayer.exe
1376	DesktopLayer.exe
1376	DesktopLayer.exe

pid	process
1984	iexplore.exe

Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

b5c6c407900323c075b22bcf983d851b718aa57146a8bca08b02bb6cdbcd3935.exeiexplore.exeIEXPLORE.EXE

pid	process
1996	b5c6c407900323c075b22bcf983d851b718aa57146a8bca08b02bb6cdbcd3935.exe
1984	iexplore.exe
1984	iexplore.exe
776	IEXPLORE.EXE
776	IEXPLORE.EXE
776	IEXPLORE.EXE
776	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

b5c6c407900323c075b22bcf983d851b718aa57146a8bca08b02bb6cdbcd3935.exeb5c6c407900323c075b22bcf983d851b718aa57146a8bca08b02bb6cdbcd3935Srv.exeDesktopLayer.exeiexplore.exe

description	pid	process	target process
PID 1996 wrote to memory of 1256	1996	b5c6c407900323c075b22bcf983d851b718aa57146a8bca08b02bb6cdbcd3935.exe	b5c6c407900323c075b22bcf983d851b718aa57146a8bca08b02bb6cdbcd3935Srv.exe
PID 1996 wrote to memory of 1256	1996	b5c6c407900323c075b22bcf983d851b718aa57146a8bca08b02bb6cdbcd3935.exe	b5c6c407900323c075b22bcf983d851b718aa57146a8bca08b02bb6cdbcd3935Srv.exe
PID 1996 wrote to memory of 1256	1996	b5c6c407900323c075b22bcf983d851b718aa57146a8bca08b02bb6cdbcd3935.exe	b5c6c407900323c075b22bcf983d851b718aa57146a8bca08b02bb6cdbcd3935Srv.exe
PID 1996 wrote to memory of 1256	1996	b5c6c407900323c075b22bcf983d851b718aa57146a8bca08b02bb6cdbcd3935.exe	b5c6c407900323c075b22bcf983d851b718aa57146a8bca08b02bb6cdbcd3935Srv.exe
PID 1256 wrote to memory of 1376	1256	b5c6c407900323c075b22bcf983d851b718aa57146a8bca08b02bb6cdbcd3935Srv.exe	DesktopLayer.exe
PID 1256 wrote to memory of 1376	1256	b5c6c407900323c075b22bcf983d851b718aa57146a8bca08b02bb6cdbcd3935Srv.exe	DesktopLayer.exe
PID 1256 wrote to memory of 1376	1256	b5c6c407900323c075b22bcf983d851b718aa57146a8bca08b02bb6cdbcd3935Srv.exe	DesktopLayer.exe
PID 1256 wrote to memory of 1376	1256	b5c6c407900323c075b22bcf983d851b718aa57146a8bca08b02bb6cdbcd3935Srv.exe	DesktopLayer.exe
PID 1376 wrote to memory of 1984	1376	DesktopLayer.exe	iexplore.exe
PID 1376 wrote to memory of 1984	1376	DesktopLayer.exe	iexplore.exe
PID 1376 wrote to memory of 1984	1376	DesktopLayer.exe	iexplore.exe
PID 1376 wrote to memory of 1984	1376	DesktopLayer.exe	iexplore.exe
PID 1984 wrote to memory of 776	1984	iexplore.exe	IEXPLORE.EXE
PID 1984 wrote to memory of 776	1984	iexplore.exe	IEXPLORE.EXE
PID 1984 wrote to memory of 776	1984	iexplore.exe	IEXPLORE.EXE
PID 1984 wrote to memory of 776	1984	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\b5c6c407900323c075b22bcf983d851b718aa57146a8bca08b02bb6cdbcd3935.exe
"C:\Users\Admin\AppData\Local\Temp\b5c6c407900323c075b22bcf983d851b718aa57146a8bca08b02bb6cdbcd3935.exe"
1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1996

C:\Users\Admin\AppData\Local\Temp\b5c6c407900323c075b22bcf983d851b718aa57146a8bca08b02bb6cdbcd3935Srv.exe
C:\Users\Admin\AppData\Local\Temp\b5c6c407900323c075b22bcf983d851b718aa57146a8bca08b02bb6cdbcd3935Srv.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1256

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1376

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1984 CREDAT:275457 /prefetch:2
5⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:776

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
MD5
8b98c6e15294bc40da3cefe4edaf4239

SHA1
adad48d3d0df469a89d11c57eb7d83e53b87e463

SHA256
f68c724058e29413bd07ea56477af94e05f3297121f385eb4b7db0f738dc8913

SHA512
7947a5cfbe74877a1d868a6fa9b30f9984751f4605409713a083ddbd1c4c64e1a56d367da7b26587bdd29e463f5c17cc28bb45e2fca46a8087313fc5f918895c

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe
MD5
8b98c6e15294bc40da3cefe4edaf4239

SHA1
adad48d3d0df469a89d11c57eb7d83e53b87e463

SHA256
f68c724058e29413bd07ea56477af94e05f3297121f385eb4b7db0f738dc8913

SHA512
7947a5cfbe74877a1d868a6fa9b30f9984751f4605409713a083ddbd1c4c64e1a56d367da7b26587bdd29e463f5c17cc28bb45e2fca46a8087313fc5f918895c

Download Submit
C:\Users\Admin\AppData\Local\Temp\b5c6c407900323c075b22bcf983d851b718aa57146a8bca08b02bb6cdbcd3935Srv.exe
MD5
8b98c6e15294bc40da3cefe4edaf4239

SHA1
adad48d3d0df469a89d11c57eb7d83e53b87e463

SHA256
f68c724058e29413bd07ea56477af94e05f3297121f385eb4b7db0f738dc8913

SHA512
7947a5cfbe74877a1d868a6fa9b30f9984751f4605409713a083ddbd1c4c64e1a56d367da7b26587bdd29e463f5c17cc28bb45e2fca46a8087313fc5f918895c

Download Submit
C:\Users\Admin\AppData\Local\Temp\b5c6c407900323c075b22bcf983d851b718aa57146a8bca08b02bb6cdbcd3935Srv.exe
MD5
8b98c6e15294bc40da3cefe4edaf4239

SHA1
adad48d3d0df469a89d11c57eb7d83e53b87e463

SHA256
f68c724058e29413bd07ea56477af94e05f3297121f385eb4b7db0f738dc8913

SHA512
7947a5cfbe74877a1d868a6fa9b30f9984751f4605409713a083ddbd1c4c64e1a56d367da7b26587bdd29e463f5c17cc28bb45e2fca46a8087313fc5f918895c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\SBVYGOO5.txt
MD5
de15b5702ad96d495e7f64f009c6b8d4

SHA1
b164096b375a6bda5f75174c973ad11fcf7f2774

SHA256
ed1c4ac03ddad62195d6ecfae2a960f219c1cb916cca5b234de31c70e29ec800

SHA512
9cdf795dc18916faf2399cb36b30ed7439225bd6a8809f333bf474aefe6c283bcf3670098da706d1a291d38449fbf163652cc58df9ef2d204ffe9f706c3174f8

Download Submit
\Program Files (x86)\Microsoft\DesktopLayer.exe
MD5
8b98c6e15294bc40da3cefe4edaf4239

SHA1
adad48d3d0df469a89d11c57eb7d83e53b87e463

SHA256
f68c724058e29413bd07ea56477af94e05f3297121f385eb4b7db0f738dc8913

SHA512
7947a5cfbe74877a1d868a6fa9b30f9984751f4605409713a083ddbd1c4c64e1a56d367da7b26587bdd29e463f5c17cc28bb45e2fca46a8087313fc5f918895c

Download Submit
\Users\Admin\AppData\Local\Temp\b5c6c407900323c075b22bcf983d851b718aa57146a8bca08b02bb6cdbcd3935Srv.exe
MD5
8b98c6e15294bc40da3cefe4edaf4239

SHA1
adad48d3d0df469a89d11c57eb7d83e53b87e463

SHA256
f68c724058e29413bd07ea56477af94e05f3297121f385eb4b7db0f738dc8913

SHA512
7947a5cfbe74877a1d868a6fa9b30f9984751f4605409713a083ddbd1c4c64e1a56d367da7b26587bdd29e463f5c17cc28bb45e2fca46a8087313fc5f918895c

Download Submit
memory/776-78-0x0000000000000000-mapping.dmp

Download
memory/1256-75-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1256-74-0x00000000003B0000-0x00000000003BF000-memory.dmp

Filesize
60KB

Download
memory/1256-63-0x00000000767B1000-0x00000000767B3000-memory.dmp

Filesize
8KB

Download
memory/1256-61-0x0000000000000000-mapping.dmp

Download
memory/1376-71-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1376-66-0x0000000000000000-mapping.dmp

Download
memory/1984-72-0x0000000000000000-mapping.dmp

Download
memory/1984-73-0x000007FEFC051000-0x000007FEFC053000-memory.dmp

Filesize
8KB

Download
memory/1984-79-0x0000000004630000-0x0000000004631000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads