ramnit | 615e5ac3059618fe2544e014b6ef4f92d9d87a1a748d96ea4516f9ed3418f666

General

Target

615e5ac3059618fe2544e014b6ef4f92d9d87a1a748d96ea4516f9ed3418f666.exe
Size

250KB
MD5

c748d4ea3d6476a362f08540edc00376
SHA1

5ea3aa31e8f93e4978e83b2c0926a20d42094422
SHA256

615e5ac3059618fe2544e014b6ef4f92d9d87a1a748d96ea4516f9ed3418f666
SHA512

d960e29e01c6f275d9cc5f2afc161fee0129524a4a4feb788df070cf00ca533b6b3c2d1c34dd76e4272042f03c2325dd2cf21bbd5952df87e2ab775fcb76d5fc

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Executes dropped EXE 2 IoCs

Processes:

615e5ac3059618fe2544e014b6ef4f92d9d87a1a748d96ea4516f9ed3418f666Srv.exeDesktopLayer.exe

pid process

396 615e5ac3059618fe2544e014b6ef4f92d9d87a1a748d96ea4516f9ed3418f666Srv.exe
1172 DesktopLayer.exe

pid	process
396	615e5ac3059618fe2544e014b6ef4f92d9d87a1a748d96ea4516f9ed3418f666Srv.exe
1172	DesktopLayer.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\615e5ac3059618fe2544e014b6ef4f92d9d87a1a748d96ea4516f9ed3418f666Srv.exe	upx
C:\Users\Admin\AppData\Local\Temp\615e5ac3059618fe2544e014b6ef4f92d9d87a1a748d96ea4516f9ed3418f666Srv.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
behavioral2/memory/396-124-0x0000000000400000-0x000000000042E000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

Processes:

615e5ac3059618fe2544e014b6ef4f92d9d87a1a748d96ea4516f9ed3418f666Srv.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	615e5ac3059618fe2544e014b6ef4f92d9d87a1a748d96ea4516f9ed3418f666Srv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	615e5ac3059618fe2544e014b6ef4f92d9d87a1a748d96ea4516f9ed3418f666Srv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px1013.tmp	615e5ac3059618fe2544e014b6ef4f92d9d87a1a748d96ea4516f9ed3418f666Srv.exe

Modifies Internet Explorer settings 1 TTPs 40 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30886178"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3965498889"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "327852766"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3965498889"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "327804181"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3972998676"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30886178"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz!	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30886178"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "327820775"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{17E13D7F-B516-11EB-A11C-7E556571BED2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4	iexplore.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

DesktopLayer.exe

pid	process
1172	DesktopLayer.exe
1172	DesktopLayer.exe
1172	DesktopLayer.exe
1172	DesktopLayer.exe
1172	DesktopLayer.exe
1172	DesktopLayer.exe
1172	DesktopLayer.exe
1172	DesktopLayer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

3816 iexplore.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

3816 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

3816 iexplore.exe
3816 iexplore.exe
2284 IEXPLORE.EXE
2284 IEXPLORE.EXE
2284 IEXPLORE.EXE
2284 IEXPLORE.EXE

pid	process
3816	iexplore.exe

pid	process
3816	iexplore.exe

pid	process
3816	iexplore.exe
3816	iexplore.exe
2284	IEXPLORE.EXE
2284	IEXPLORE.EXE
2284	IEXPLORE.EXE
2284	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

615e5ac3059618fe2544e014b6ef4f92d9d87a1a748d96ea4516f9ed3418f666.exe615e5ac3059618fe2544e014b6ef4f92d9d87a1a748d96ea4516f9ed3418f666Srv.exeDesktopLayer.exeiexplore.exe

description	pid	process	target process
PID 4064 wrote to memory of 396	4064	615e5ac3059618fe2544e014b6ef4f92d9d87a1a748d96ea4516f9ed3418f666.exe	615e5ac3059618fe2544e014b6ef4f92d9d87a1a748d96ea4516f9ed3418f666Srv.exe
PID 4064 wrote to memory of 396	4064	615e5ac3059618fe2544e014b6ef4f92d9d87a1a748d96ea4516f9ed3418f666.exe	615e5ac3059618fe2544e014b6ef4f92d9d87a1a748d96ea4516f9ed3418f666Srv.exe
PID 4064 wrote to memory of 396	4064	615e5ac3059618fe2544e014b6ef4f92d9d87a1a748d96ea4516f9ed3418f666.exe	615e5ac3059618fe2544e014b6ef4f92d9d87a1a748d96ea4516f9ed3418f666Srv.exe
PID 396 wrote to memory of 1172	396	615e5ac3059618fe2544e014b6ef4f92d9d87a1a748d96ea4516f9ed3418f666Srv.exe	DesktopLayer.exe
PID 396 wrote to memory of 1172	396	615e5ac3059618fe2544e014b6ef4f92d9d87a1a748d96ea4516f9ed3418f666Srv.exe	DesktopLayer.exe
PID 396 wrote to memory of 1172	396	615e5ac3059618fe2544e014b6ef4f92d9d87a1a748d96ea4516f9ed3418f666Srv.exe	DesktopLayer.exe
PID 1172 wrote to memory of 3816	1172	DesktopLayer.exe	iexplore.exe
PID 1172 wrote to memory of 3816	1172	DesktopLayer.exe	iexplore.exe
PID 3816 wrote to memory of 2284	3816	iexplore.exe	IEXPLORE.EXE
PID 3816 wrote to memory of 2284	3816	iexplore.exe	IEXPLORE.EXE
PID 3816 wrote to memory of 2284	3816	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\615e5ac3059618fe2544e014b6ef4f92d9d87a1a748d96ea4516f9ed3418f666.exe
"C:\Users\Admin\AppData\Local\Temp\615e5ac3059618fe2544e014b6ef4f92d9d87a1a748d96ea4516f9ed3418f666.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4064

C:\Users\Admin\AppData\Local\Temp\615e5ac3059618fe2544e014b6ef4f92d9d87a1a748d96ea4516f9ed3418f666Srv.exe
C:\Users\Admin\AppData\Local\Temp\615e5ac3059618fe2544e014b6ef4f92d9d87a1a748d96ea4516f9ed3418f666Srv.exe
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:396

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1172

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3816

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3816 CREDAT:82945 /prefetch:2
5⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2284

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
MD5
da18881ccaefeaa4942af9291cb34826

SHA1
e4f33c21684bede05ccea60dd0767250ff2b3aba

SHA256
1d736643af18fe45f74f67a68c3268b39e7dbd84aaaf46dba5e23e48e8402842

SHA512
2420cf80794f4e74fb95934698714d4386e022d68c0c4e181d9d6e189bf3fab09f920e6e9128e423a1dbf357558bab628133d1084a7a306617c3a9c2461a5901

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe
MD5
da18881ccaefeaa4942af9291cb34826

SHA1
e4f33c21684bede05ccea60dd0767250ff2b3aba

SHA256
1d736643af18fe45f74f67a68c3268b39e7dbd84aaaf46dba5e23e48e8402842

SHA512
2420cf80794f4e74fb95934698714d4386e022d68c0c4e181d9d6e189bf3fab09f920e6e9128e423a1dbf357558bab628133d1084a7a306617c3a9c2461a5901

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
MD5
57010df1ded674ce061f8af29a2e6fbb

SHA1
83e50ef272059dc3fab93e694d5e220dc48bf0c4

SHA256
68492169f14b36562d813f4ae7506f4b324b85f0e6aec352a37faba29b289616

SHA512
211ecb686dec8e8dd57cc8aeebdb8953f81aa56eebec9b463df4d41d98942317ed001ae5ffc9cc0c3ce5c542317cd0838447b885016697411b99f68190bd430b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
MD5
294828ba4054439d8b8513eeda48997d

SHA1
90e11f246db33dbcb0f4ae04a3e31b13e00f3749

SHA256
33d0605904c50ea5cc267b25428d9dd06e50d553977d8db234bd70fd3a4d6ca8

SHA512
301a3570a729d2feb2010b6891244bf64774dde1d3b73729b742bd1e4bff16c869b38f122826621c267b9de0ab7ca5d2b2e3538cb6a61c8c7428426872b2f6b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\L0R6RBJP.cookie
MD5
e6bbeb84337826c2b39de026d95f20d3

SHA1
dca6844451827891f8aa46b406997bc70f686579

SHA256
a0c745df5a8b396452285ae7bb049daffd664af8bf2694cb2c4d5fd7dfe6baf4

SHA512
9dbc8e5c955cd5cbb1aceba2dfe163c904c8fde088482b835823014eb81b6bc4469a53cdd62da6d8af2b6352f41454fdf5096c061696d52db2f2a98943538480

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\W897DU25.cookie
MD5
0e975113d4aae6c0c064974b42622c0a

SHA1
db4ca1ba42b4eb84ea501770645f14fb0a20b60b

SHA256
49c91d3c03cc59c777798a0678e8d9a4983feea6a0dd7a5004ba150932699f67

SHA512
a49ee884ac4f9471d1a23f5ceda35c51ffb8e4c8ccff54f2274d527e8330444c941195706795e5708bcd7ba987a8308605562e76fdfaebc37de6a315818baec2

Download Submit
C:\Users\Admin\AppData\Local\Temp\615e5ac3059618fe2544e014b6ef4f92d9d87a1a748d96ea4516f9ed3418f666Srv.exe
MD5
da18881ccaefeaa4942af9291cb34826

SHA1
e4f33c21684bede05ccea60dd0767250ff2b3aba

SHA256
1d736643af18fe45f74f67a68c3268b39e7dbd84aaaf46dba5e23e48e8402842

SHA512
2420cf80794f4e74fb95934698714d4386e022d68c0c4e181d9d6e189bf3fab09f920e6e9128e423a1dbf357558bab628133d1084a7a306617c3a9c2461a5901

Download Submit
C:\Users\Admin\AppData\Local\Temp\615e5ac3059618fe2544e014b6ef4f92d9d87a1a748d96ea4516f9ed3418f666Srv.exe
MD5
da18881ccaefeaa4942af9291cb34826

SHA1
e4f33c21684bede05ccea60dd0767250ff2b3aba

SHA256
1d736643af18fe45f74f67a68c3268b39e7dbd84aaaf46dba5e23e48e8402842

SHA512
2420cf80794f4e74fb95934698714d4386e022d68c0c4e181d9d6e189bf3fab09f920e6e9128e423a1dbf357558bab628133d1084a7a306617c3a9c2461a5901

Download Submit
memory/396-122-0x00000000001F0000-0x00000000001FF000-memory.dmp

Filesize
60KB

Download
memory/396-124-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/396-114-0x0000000000000000-mapping.dmp

Download
memory/1172-120-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/1172-117-0x0000000000000000-mapping.dmp

Download
memory/2284-128-0x0000000000000000-mapping.dmp

Download
memory/3816-123-0x00007FF8339C0000-0x00007FF833A2B000-memory.dmp

Filesize
428KB

Download
memory/3816-121-0x0000000000000000-mapping.dmp

Download
memory/4064-125-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads