ramnit | 8b7c80a5b1459041a5bbc7eba1f6c10f34288f6763afef63476e6ca83c0ef2d0

Reason

platform exec: Reading agent response: read tcp 10.7.0.1:39286->10.7.0.27:8000: read: connection timed out

General

Target

8b7c80a5b1459041a5bbc7eba1f6c10f34288f6763afef63476e6ca83c0ef2d0.exe
Size

100KB
MD5

15493e865afa720bb1c877f818265f67
SHA1

874a395faeabe5ed20aa3fe295613be0277c9b1d
SHA256

8b7c80a5b1459041a5bbc7eba1f6c10f34288f6763afef63476e6ca83c0ef2d0
SHA512

1e3a7571c6469eb4b39a6a1cbccdc1d2d7e82bdf73ff01865a7950e7cc45b2b4be6cd36cf024034bc193f04b807b55c137a58d5e8228ca92a9d00c57ec5ddc10

Score

10^/10

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Executes dropped EXE 1 IoCs

Processes:

8b7c80a5b1459041a5bbc7eba1f6c10f34288f6763afef63476e6ca83c0ef2d0Srv.exe

pid process

1264 8b7c80a5b1459041a5bbc7eba1f6c10f34288f6763afef63476e6ca83c0ef2d0Srv.exe

pid	process
1264	8b7c80a5b1459041a5bbc7eba1f6c10f34288f6763afef63476e6ca83c0ef2d0Srv.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\8b7c80a5b1459041a5bbc7eba1f6c10f34288f6763afef63476e6ca83c0ef2d0Srv.exe	upx
C:\Users\Admin\AppData\Local\Temp\8b7c80a5b1459041a5bbc7eba1f6c10f34288f6763afef63476e6ca83c0ef2d0Srv.exe	upx

Loads dropped DLL 1 IoCs

Processes:

8b7c80a5b1459041a5bbc7eba1f6c10f34288f6763afef63476e6ca83c0ef2d0.exe

pid process

1840 8b7c80a5b1459041a5bbc7eba1f6c10f34288f6763afef63476e6ca83c0ef2d0.exe

pid	process
1840	8b7c80a5b1459041a5bbc7eba1f6c10f34288f6763afef63476e6ca83c0ef2d0.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

8b7c80a5b1459041a5bbc7eba1f6c10f34288f6763afef63476e6ca83c0ef2d0.exe

description	pid	process	target process
PID 1840 wrote to memory of 1264	1840	8b7c80a5b1459041a5bbc7eba1f6c10f34288f6763afef63476e6ca83c0ef2d0.exe	8b7c80a5b1459041a5bbc7eba1f6c10f34288f6763afef63476e6ca83c0ef2d0Srv.exe
PID 1840 wrote to memory of 1264	1840	8b7c80a5b1459041a5bbc7eba1f6c10f34288f6763afef63476e6ca83c0ef2d0.exe	8b7c80a5b1459041a5bbc7eba1f6c10f34288f6763afef63476e6ca83c0ef2d0Srv.exe
PID 1840 wrote to memory of 1264	1840	8b7c80a5b1459041a5bbc7eba1f6c10f34288f6763afef63476e6ca83c0ef2d0.exe	8b7c80a5b1459041a5bbc7eba1f6c10f34288f6763afef63476e6ca83c0ef2d0Srv.exe
PID 1840 wrote to memory of 1264	1840	8b7c80a5b1459041a5bbc7eba1f6c10f34288f6763afef63476e6ca83c0ef2d0.exe	8b7c80a5b1459041a5bbc7eba1f6c10f34288f6763afef63476e6ca83c0ef2d0Srv.exe

C:\Users\Admin\AppData\Local\Temp\8b7c80a5b1459041a5bbc7eba1f6c10f34288f6763afef63476e6ca83c0ef2d0Srv.exe
C:\Users\Admin\AppData\Local\Temp\8b7c80a5b1459041a5bbc7eba1f6c10f34288f6763afef63476e6ca83c0ef2d0Srv.exe
2⤵
- Executes dropped EXE
PID:1264

C:\Users\Admin\AppData\Local\Temp\8b7c80a5b1459041a5bbc7eba1f6c10f34288f6763afef63476e6ca83c0ef2d0Srv.exe
MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
\Users\Admin\AppData\Local\Temp\8b7c80a5b1459041a5bbc7eba1f6c10f34288f6763afef63476e6ca83c0ef2d0Srv.exe
MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
memory/1264-61-0x0000000000000000-mapping.dmp

Download
memory/1840-59-0x00000000762C1000-0x00000000762C3000-memory.dmp

Filesize
8KB

Download