ramnit | 724ae7ffeb629f030d940fe90d3fffda844d43ae9c5a2d6e506ee22997ac4814

General

Target

724ae7ffeb629f030d940fe90d3fffda844d43ae9c5a2d6e506ee22997ac4814.exe
Size

296KB
MD5

e39dd036656679707b1aa136ae59d2a5
SHA1

40080468e0f807ac2fbd6a3ccdbd1f61d80e5c93
SHA256

724ae7ffeb629f030d940fe90d3fffda844d43ae9c5a2d6e506ee22997ac4814
SHA512

d9b9803a33ee55b3668ea87ae8de75babe91a3cf078b26c23586ec26d521af62375dc579eab902084d86e1f1de3b519b3348e76ca0c23e45726691e374765b24

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Executes dropped EXE 2 IoCs

Processes:

724ae7ffeb629f030d940fe90d3fffda844d43ae9c5a2d6e506ee22997ac4814Srv.exeDesktopLayer.exe

pid process

64 724ae7ffeb629f030d940fe90d3fffda844d43ae9c5a2d6e506ee22997ac4814Srv.exe
1032 DesktopLayer.exe

pid	process
64	724ae7ffeb629f030d940fe90d3fffda844d43ae9c5a2d6e506ee22997ac4814Srv.exe
1032	DesktopLayer.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\724ae7ffeb629f030d940fe90d3fffda844d43ae9c5a2d6e506ee22997ac4814Srv.exe	upx
C:\Users\Admin\AppData\Local\Temp\724ae7ffeb629f030d940fe90d3fffda844d43ae9c5a2d6e506ee22997ac4814Srv.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
behavioral2/memory/64-122-0x0000000000400000-0x000000000042E000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

Processes:

724ae7ffeb629f030d940fe90d3fffda844d43ae9c5a2d6e506ee22997ac4814Srv.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft\pxFA5.tmp	724ae7ffeb629f030d940fe90d3fffda844d43ae9c5a2d6e506ee22997ac4814Srv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	724ae7ffeb629f030d940fe90d3fffda844d43ae9c5a2d6e506ee22997ac4814Srv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	724ae7ffeb629f030d940fe90d3fffda844d43ae9c5a2d6e506ee22997ac4814Srv.exe

Modifies Internet Explorer settings 1 TTPs 40 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "327832089"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30886205"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30886205"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "327864081"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1151275387"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "327815496"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1151275387"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1159400861"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7003742D-B530-11EB-A11C-7E556571BED2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30886205"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz!	iexplore.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

DesktopLayer.exe

pid	process
1032	DesktopLayer.exe
1032	DesktopLayer.exe
1032	DesktopLayer.exe
1032	DesktopLayer.exe
1032	DesktopLayer.exe
1032	DesktopLayer.exe
1032	DesktopLayer.exe
1032	DesktopLayer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

1184 iexplore.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1184 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1184 iexplore.exe
1184 iexplore.exe
2284 IEXPLORE.EXE
2284 IEXPLORE.EXE
2284 IEXPLORE.EXE
2284 IEXPLORE.EXE

pid	process
1184	iexplore.exe

pid	process
1184	iexplore.exe

pid	process
1184	iexplore.exe
1184	iexplore.exe
2284	IEXPLORE.EXE
2284	IEXPLORE.EXE
2284	IEXPLORE.EXE
2284	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

724ae7ffeb629f030d940fe90d3fffda844d43ae9c5a2d6e506ee22997ac4814.exe724ae7ffeb629f030d940fe90d3fffda844d43ae9c5a2d6e506ee22997ac4814Srv.exeDesktopLayer.exeiexplore.exe

description	pid	process	target process
PID 2204 wrote to memory of 64	2204	724ae7ffeb629f030d940fe90d3fffda844d43ae9c5a2d6e506ee22997ac4814.exe	724ae7ffeb629f030d940fe90d3fffda844d43ae9c5a2d6e506ee22997ac4814Srv.exe
PID 2204 wrote to memory of 64	2204	724ae7ffeb629f030d940fe90d3fffda844d43ae9c5a2d6e506ee22997ac4814.exe	724ae7ffeb629f030d940fe90d3fffda844d43ae9c5a2d6e506ee22997ac4814Srv.exe
PID 2204 wrote to memory of 64	2204	724ae7ffeb629f030d940fe90d3fffda844d43ae9c5a2d6e506ee22997ac4814.exe	724ae7ffeb629f030d940fe90d3fffda844d43ae9c5a2d6e506ee22997ac4814Srv.exe
PID 64 wrote to memory of 1032	64	724ae7ffeb629f030d940fe90d3fffda844d43ae9c5a2d6e506ee22997ac4814Srv.exe	DesktopLayer.exe
PID 64 wrote to memory of 1032	64	724ae7ffeb629f030d940fe90d3fffda844d43ae9c5a2d6e506ee22997ac4814Srv.exe	DesktopLayer.exe
PID 64 wrote to memory of 1032	64	724ae7ffeb629f030d940fe90d3fffda844d43ae9c5a2d6e506ee22997ac4814Srv.exe	DesktopLayer.exe
PID 1032 wrote to memory of 1184	1032	DesktopLayer.exe	iexplore.exe
PID 1032 wrote to memory of 1184	1032	DesktopLayer.exe	iexplore.exe
PID 1184 wrote to memory of 2284	1184	iexplore.exe	IEXPLORE.EXE
PID 1184 wrote to memory of 2284	1184	iexplore.exe	IEXPLORE.EXE
PID 1184 wrote to memory of 2284	1184	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\724ae7ffeb629f030d940fe90d3fffda844d43ae9c5a2d6e506ee22997ac4814.exe
"C:\Users\Admin\AppData\Local\Temp\724ae7ffeb629f030d940fe90d3fffda844d43ae9c5a2d6e506ee22997ac4814.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2204

C:\Users\Admin\AppData\Local\Temp\724ae7ffeb629f030d940fe90d3fffda844d43ae9c5a2d6e506ee22997ac4814Srv.exe
C:\Users\Admin\AppData\Local\Temp\724ae7ffeb629f030d940fe90d3fffda844d43ae9c5a2d6e506ee22997ac4814Srv.exe
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:64

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1032

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1184

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1184 CREDAT:82945 /prefetch:2
5⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2284

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe
MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
MD5
57010df1ded674ce061f8af29a2e6fbb

SHA1
83e50ef272059dc3fab93e694d5e220dc48bf0c4

SHA256
68492169f14b36562d813f4ae7506f4b324b85f0e6aec352a37faba29b289616

SHA512
211ecb686dec8e8dd57cc8aeebdb8953f81aa56eebec9b463df4d41d98942317ed001ae5ffc9cc0c3ce5c542317cd0838447b885016697411b99f68190bd430b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
MD5
80c4f2417bc4b1d202d89e730e36dc0c

SHA1
7511e0005b926496fa1950129c511b1b3f6e9e17

SHA256
bf3b7c8c4b9991f61f07c69380fd2042af503fbb41a5397218a38fbef7428a82

SHA512
e6d66c2e14d4f85f8aaae20d31770b6ca898aafce7cc206d702ae78daad6ea17388fbf03f161d626d31b0c980c4573be62b5500d363edfcca6a6b49979ee228a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\MFLJAIDD.cookie
MD5
ff280a9c0a3de1de75ba0f0a7e3d94f6

SHA1
c3060678d007c9ce8440db9efc0292d8183727f7

SHA256
87f472d85c4158adb817d2e42bd340f155bd428e9ab6fad9be7d74cf9ad3c471

SHA512
9ebfdc77f97ad14e8221c5b993255d21def3fe0c33a2f90739dd4187ae97aca4531d383c6d11b25dfc4ee388f956931dbf74fd25e08555f335cce0557cbb76ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\N9280I3J.cookie
MD5
75e56eaeec9812d2a84274b78e108134

SHA1
fb46a1fda720e6dafdd6c2927ef69d99dc3d4fbb

SHA256
f718ef05593f2c16d03f380a0d7d9a008e47a898dbae5373f8235183ebadd4ce

SHA512
24edc66018415cacf7a77d48bb2d8c08bd48ea6f4f2e4be2b477958e2e4f2408b2fddbe05dd7bfd13d466cc377d8a53576e410c27b70a2f3a6b22344274fc618

Download Submit
C:\Users\Admin\AppData\Local\Temp\724ae7ffeb629f030d940fe90d3fffda844d43ae9c5a2d6e506ee22997ac4814Srv.exe
MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\724ae7ffeb629f030d940fe90d3fffda844d43ae9c5a2d6e506ee22997ac4814Srv.exe
MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
memory/64-122-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/64-114-0x0000000000000000-mapping.dmp

Download
memory/64-121-0x00000000001E0000-0x00000000001EF000-memory.dmp

Filesize
60KB

Download
memory/1032-120-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/1032-117-0x0000000000000000-mapping.dmp

Download
memory/1184-123-0x0000000000000000-mapping.dmp

Download
memory/1184-126-0x00007FF833D70000-0x00007FF833DDB000-memory.dmp

Filesize
428KB

Download
memory/2284-127-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads