ramnit | 757854b3f19b660722ac81f876db4fcb5c988b3c50fabe3e0640d111475f73eb

General

Target

757854b3f19b660722ac81f876db4fcb5c988b3c50fabe3e0640d111475f73eb.exe
Size

756KB
MD5

d4450b2884d7f412d206d2bba4375484
SHA1

90cddf20da8576ffcf8e90f810eda4ba5d177c70
SHA256

757854b3f19b660722ac81f876db4fcb5c988b3c50fabe3e0640d111475f73eb
SHA512

95bcfec992063eab5139116dea8f2a0ef38163fd1754e9de552c6ca2a17ace714355fb5410b861496c2f8ca251bbdd39ca5290f81edd1ce79ca896aeb798ad60

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Executes dropped EXE 2 IoCs

Processes:

757854b3f19b660722ac81f876db4fcb5c988b3c50fabe3e0640d111475f73ebSrv.exeDesktopLayer.exe

pid process

60 757854b3f19b660722ac81f876db4fcb5c988b3c50fabe3e0640d111475f73ebSrv.exe
652 DesktopLayer.exe

pid	process
60	757854b3f19b660722ac81f876db4fcb5c988b3c50fabe3e0640d111475f73ebSrv.exe
652	DesktopLayer.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\757854b3f19b660722ac81f876db4fcb5c988b3c50fabe3e0640d111475f73ebSrv.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
C:\Users\Admin\AppData\Local\Temp\757854b3f19b660722ac81f876db4fcb5c988b3c50fabe3e0640d111475f73ebSrv.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
behavioral2/memory/60-125-0x0000000000400000-0x000000000042E000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

Processes:

757854b3f19b660722ac81f876db4fcb5c988b3c50fabe3e0640d111475f73ebSrv.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	757854b3f19b660722ac81f876db4fcb5c988b3c50fabe3e0640d111475f73ebSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	757854b3f19b660722ac81f876db4fcb5c988b3c50fabe3e0640d111475f73ebSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px610.tmp	757854b3f19b660722ac81f876db4fcb5c988b3c50fabe3e0640d111475f73ebSrv.exe

Modifies Internet Explorer settings 1 TTPs 40 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30885133"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30885133"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "327355314"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30885133"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz!	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "327371908"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3546272325"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3546272325"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "327403900"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FEA79936-B100-11EB-A11C-46584878C9AA} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3553304036"	IEXPLORE.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

DesktopLayer.exe

pid	process
652	DesktopLayer.exe
652	DesktopLayer.exe
652	DesktopLayer.exe
652	DesktopLayer.exe
652	DesktopLayer.exe
652	DesktopLayer.exe
652	DesktopLayer.exe
652	DesktopLayer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

820 iexplore.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

820 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

820 iexplore.exe
820 iexplore.exe
2108 IEXPLORE.EXE
2108 IEXPLORE.EXE
2108 IEXPLORE.EXE
2108 IEXPLORE.EXE

pid	process
820	iexplore.exe

pid	process
820	iexplore.exe

pid	process
820	iexplore.exe
820	iexplore.exe
2108	IEXPLORE.EXE
2108	IEXPLORE.EXE
2108	IEXPLORE.EXE
2108	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

757854b3f19b660722ac81f876db4fcb5c988b3c50fabe3e0640d111475f73eb.exe757854b3f19b660722ac81f876db4fcb5c988b3c50fabe3e0640d111475f73ebSrv.exeDesktopLayer.exeiexplore.exe

description	pid	process	target process
PID 2156 wrote to memory of 60	2156	757854b3f19b660722ac81f876db4fcb5c988b3c50fabe3e0640d111475f73eb.exe	757854b3f19b660722ac81f876db4fcb5c988b3c50fabe3e0640d111475f73ebSrv.exe
PID 2156 wrote to memory of 60	2156	757854b3f19b660722ac81f876db4fcb5c988b3c50fabe3e0640d111475f73eb.exe	757854b3f19b660722ac81f876db4fcb5c988b3c50fabe3e0640d111475f73ebSrv.exe
PID 2156 wrote to memory of 60	2156	757854b3f19b660722ac81f876db4fcb5c988b3c50fabe3e0640d111475f73eb.exe	757854b3f19b660722ac81f876db4fcb5c988b3c50fabe3e0640d111475f73ebSrv.exe
PID 60 wrote to memory of 652	60	757854b3f19b660722ac81f876db4fcb5c988b3c50fabe3e0640d111475f73ebSrv.exe	DesktopLayer.exe
PID 60 wrote to memory of 652	60	757854b3f19b660722ac81f876db4fcb5c988b3c50fabe3e0640d111475f73ebSrv.exe	DesktopLayer.exe
PID 60 wrote to memory of 652	60	757854b3f19b660722ac81f876db4fcb5c988b3c50fabe3e0640d111475f73ebSrv.exe	DesktopLayer.exe
PID 652 wrote to memory of 820	652	DesktopLayer.exe	iexplore.exe
PID 652 wrote to memory of 820	652	DesktopLayer.exe	iexplore.exe
PID 820 wrote to memory of 2108	820	iexplore.exe	IEXPLORE.EXE
PID 820 wrote to memory of 2108	820	iexplore.exe	IEXPLORE.EXE
PID 820 wrote to memory of 2108	820	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\757854b3f19b660722ac81f876db4fcb5c988b3c50fabe3e0640d111475f73eb.exe
"C:\Users\Admin\AppData\Local\Temp\757854b3f19b660722ac81f876db4fcb5c988b3c50fabe3e0640d111475f73eb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2156

C:\Users\Admin\AppData\Local\Temp\757854b3f19b660722ac81f876db4fcb5c988b3c50fabe3e0640d111475f73ebSrv.exe
C:\Users\Admin\AppData\Local\Temp\757854b3f19b660722ac81f876db4fcb5c988b3c50fabe3e0640d111475f73ebSrv.exe
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:60

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:652

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:820

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:820 CREDAT:82945 /prefetch:2
5⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2108

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe
MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
MD5
6b816ee93f1cf36935099a4d593bb05f

SHA1
0c0189324d4658217cfb69ed3131f657ee82ef28

SHA256
0f617ef157edf719de5b1281c6f2afb01903acd66aa0a60e075cfc341adcb6f5

SHA512
cd270c8c41db861a78e1a08c08f2186f95e3f45b0d964edb2d9eb8aa4ecf9f796f07ffc2f03a3d96848cb0142cb0d6838fdd08daa68c53bcd176ca27f4320b7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
MD5
94c182bb905f0fb871728f0699f17d1b

SHA1
36bda171ba60a0eeeed87a55acc36f08bffa39b1

SHA256
658d218beefdd19d6f7aeb1ed65bec548c2849694caacadd7cad4cbca642517e

SHA512
6ee60b0a4a1964f54f947bbd0fc89fc7f76812464d48dfa7a4f3e5bccfb7093cadf4a2208def1938e35fbda565c0ec48bebe756df376c8f8d729dc299f66aa1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\1RQWQ5VJ.cookie
MD5
774729c50fc553b58601538d64dcb830

SHA1
db8b19aad6a98c4d049439cbd3c2c584da581051

SHA256
41be63f955fdc4147bbb37f6a62ce270169e2a685689abeb531100d72caf23ee

SHA512
bb8129acd0e398425ddc256133d3f4d81663295dc77251d1a87b692883fb7b17d8f020a1263e9d965be70e2eafa5adb16f103539a0dd5f72f43a22c074b24834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\8XNNCCPQ.cookie
MD5
0d06e25b5d1001319281e80430b482b8

SHA1
8c968873a1a7b44cbdb933fadb31003c16a8352e

SHA256
3d1fc62e27a788ddd3992946f3bc6070c35b502914b895723035bdf0ae4849b3

SHA512
d0d9a3eafb4e3fdb840b81013289c28a4a80f1ed418738f5de80f99e9a28539c04c49bf37a3a350a5a09beaa21438ef0fabbc22c744ac9ff9077812b6c6fb008

Download Submit
C:\Users\Admin\AppData\Local\Temp\757854b3f19b660722ac81f876db4fcb5c988b3c50fabe3e0640d111475f73ebSrv.exe
MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\757854b3f19b660722ac81f876db4fcb5c988b3c50fabe3e0640d111475f73ebSrv.exe
MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
memory/60-125-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/60-124-0x00000000001E0000-0x00000000001EF000-memory.dmp

Filesize
60KB

Download
memory/60-114-0x0000000000000000-mapping.dmp

Download
memory/652-120-0x0000000000580000-0x0000000000581000-memory.dmp

Filesize
4KB

Download
memory/652-117-0x0000000000000000-mapping.dmp

Download
memory/820-122-0x00007FFC17230000-0x00007FFC1729B000-memory.dmp

Filesize
428KB

Download
memory/820-121-0x0000000000000000-mapping.dmp

Download
memory/2108-123-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads