ramnit | 382693e103272f575075d138544d2d2a2c08344ded01621035b2ad4b3adeb5d1

General

Target

382693e103272f575075d138544d2d2a2c08344ded01621035b2ad4b3adeb5d1.exe
Size

193KB
MD5

6b14303e1bce59b6ec5d316588a11667
SHA1

ca1e99756646f0102f4acc588e964f4a9e35c35b
SHA256

382693e103272f575075d138544d2d2a2c08344ded01621035b2ad4b3adeb5d1
SHA512

f3f10568a749c7a571e3c21f52366b1293170d3ec70040bc7ed7757fa700f4975aef367e18058312d8ca20c4b8f7225b5bbc6fffc9dec71fd1fb6cf7ffb5987c

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Executes dropped EXE 1 IoCs

Processes:

DesktopLayer.exe

pid process

2012 DesktopLayer.exe

pid	process
2012	DesktopLayer.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
behavioral1/memory/484-72-0x0000000000400000-0x000000000043F000-memory.dmp	upx

Loads dropped DLL 1 IoCs

Processes:

382693e103272f575075d138544d2d2a2c08344ded01621035b2ad4b3adeb5d1.exe

pid process

484 382693e103272f575075d138544d2d2a2c08344ded01621035b2ad4b3adeb5d1.exe

pid	process
484	382693e103272f575075d138544d2d2a2c08344ded01621035b2ad4b3adeb5d1.exe

Drops file in Program Files directory 3 IoCs

Processes:

382693e103272f575075d138544d2d2a2c08344ded01621035b2ad4b3adeb5d1.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft\px21E2.tmp	382693e103272f575075d138544d2d2a2c08344ded01621035b2ad4b3adeb5d1.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	382693e103272f575075d138544d2d2a2c08344ded01621035b2ad4b3adeb5d1.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	382693e103272f575075d138544d2d2a2c08344ded01621035b2ad4b3adeb5d1.exe

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{41973A51-B53C-11EB-AB32-6E76A0352788} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "327820575"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

DesktopLayer.exe

pid process

2012 DesktopLayer.exe
2012 DesktopLayer.exe
2012 DesktopLayer.exe
2012 DesktopLayer.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

1232 iexplore.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1232 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1232 iexplore.exe
1232 iexplore.exe
1204 IEXPLORE.EXE
1204 IEXPLORE.EXE
1204 IEXPLORE.EXE
1204 IEXPLORE.EXE

pid	process
2012	DesktopLayer.exe
2012	DesktopLayer.exe
2012	DesktopLayer.exe
2012	DesktopLayer.exe

pid	process
1232	iexplore.exe

pid	process
1232	iexplore.exe

pid	process
1232	iexplore.exe
1232	iexplore.exe
1204	IEXPLORE.EXE
1204	IEXPLORE.EXE
1204	IEXPLORE.EXE
1204	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

382693e103272f575075d138544d2d2a2c08344ded01621035b2ad4b3adeb5d1.exeDesktopLayer.exeiexplore.exe

description	pid	process	target process
PID 484 wrote to memory of 2012	484	382693e103272f575075d138544d2d2a2c08344ded01621035b2ad4b3adeb5d1.exe	DesktopLayer.exe
PID 484 wrote to memory of 2012	484	382693e103272f575075d138544d2d2a2c08344ded01621035b2ad4b3adeb5d1.exe	DesktopLayer.exe
PID 484 wrote to memory of 2012	484	382693e103272f575075d138544d2d2a2c08344ded01621035b2ad4b3adeb5d1.exe	DesktopLayer.exe
PID 484 wrote to memory of 2012	484	382693e103272f575075d138544d2d2a2c08344ded01621035b2ad4b3adeb5d1.exe	DesktopLayer.exe
PID 2012 wrote to memory of 1232	2012	DesktopLayer.exe	iexplore.exe
PID 2012 wrote to memory of 1232	2012	DesktopLayer.exe	iexplore.exe
PID 2012 wrote to memory of 1232	2012	DesktopLayer.exe	iexplore.exe
PID 2012 wrote to memory of 1232	2012	DesktopLayer.exe	iexplore.exe
PID 1232 wrote to memory of 1204	1232	iexplore.exe	IEXPLORE.EXE
PID 1232 wrote to memory of 1204	1232	iexplore.exe	IEXPLORE.EXE
PID 1232 wrote to memory of 1204	1232	iexplore.exe	IEXPLORE.EXE
PID 1232 wrote to memory of 1204	1232	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\382693e103272f575075d138544d2d2a2c08344ded01621035b2ad4b3adeb5d1.exe
"C:\Users\Admin\AppData\Local\Temp\382693e103272f575075d138544d2d2a2c08344ded01621035b2ad4b3adeb5d1.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:484

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2012

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1232

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1232 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1204

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
MD5
6b14303e1bce59b6ec5d316588a11667

SHA1
ca1e99756646f0102f4acc588e964f4a9e35c35b

SHA256
382693e103272f575075d138544d2d2a2c08344ded01621035b2ad4b3adeb5d1

SHA512
f3f10568a749c7a571e3c21f52366b1293170d3ec70040bc7ed7757fa700f4975aef367e18058312d8ca20c4b8f7225b5bbc6fffc9dec71fd1fb6cf7ffb5987c

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe
MD5
6b14303e1bce59b6ec5d316588a11667

SHA1
ca1e99756646f0102f4acc588e964f4a9e35c35b

SHA256
382693e103272f575075d138544d2d2a2c08344ded01621035b2ad4b3adeb5d1

SHA512
f3f10568a749c7a571e3c21f52366b1293170d3ec70040bc7ed7757fa700f4975aef367e18058312d8ca20c4b8f7225b5bbc6fffc9dec71fd1fb6cf7ffb5987c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\SCHXOG2A.txt
MD5
3ac7de30c561afc0b5757ecc6c3b4e5a

SHA1
e2b2f85b94bc6ccd870ff9632c1f161e5775eece

SHA256
74f9f1b9d7033935e8574a7e53f8d1c13eeaef11ce590a304cb314ac25f41bd0

SHA512
9a26064bd44adc9d1e0a1439a6d00f587b3a599882d39181c2613a81e5007a962bd484b26aca0667d42fab711301284ec42a128b6e4a47f9cd127af346886ad7

Download Submit
\Program Files (x86)\Microsoft\DesktopLayer.exe
MD5
6b14303e1bce59b6ec5d316588a11667

SHA1
ca1e99756646f0102f4acc588e964f4a9e35c35b

SHA256
382693e103272f575075d138544d2d2a2c08344ded01621035b2ad4b3adeb5d1

SHA512
f3f10568a749c7a571e3c21f52366b1293170d3ec70040bc7ed7757fa700f4975aef367e18058312d8ca20c4b8f7225b5bbc6fffc9dec71fd1fb6cf7ffb5987c

Download Submit
memory/484-59-0x0000000075EF1000-0x0000000075EF3000-memory.dmp

Filesize
8KB

Download
memory/484-71-0x0000000000230000-0x000000000023F000-memory.dmp

Filesize
60KB

Download
memory/484-72-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1204-70-0x0000000000C50000-0x0000000000C52000-memory.dmp

Filesize
8KB

Download
memory/1204-68-0x0000000000000000-mapping.dmp

Download
memory/1232-67-0x000007FEFC181000-0x000007FEFC183000-memory.dmp

Filesize
8KB

Download
memory/1232-66-0x0000000000000000-mapping.dmp

Download
memory/1232-75-0x0000000004460000-0x0000000004461000-memory.dmp

Filesize
4KB

Download
memory/2012-65-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2012-61-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads