ramnit | 1d736643af18fe45f74f67a68c3268b39e7dbd84aaaf46dba5e23e48e8402842

General

Target

1d736643af18fe45f74f67a68c3268b39e7dbd84aaaf46dba5e23e48e8402842.exe
Size

58KB
MD5

da18881ccaefeaa4942af9291cb34826
SHA1

e4f33c21684bede05ccea60dd0767250ff2b3aba
SHA256

1d736643af18fe45f74f67a68c3268b39e7dbd84aaaf46dba5e23e48e8402842
SHA512

2420cf80794f4e74fb95934698714d4386e022d68c0c4e181d9d6e189bf3fab09f920e6e9128e423a1dbf357558bab628133d1084a7a306617c3a9c2461a5901

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Executes dropped EXE 1 IoCs

Processes:

DesktopLayer.exe

pid process

196 DesktopLayer.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
behavioral2/memory/3904-119-0x0000000000400000-0x000000000042E000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

Processes:

1d736643af18fe45f74f67a68c3268b39e7dbd84aaaf46dba5e23e48e8402842.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	1d736643af18fe45f74f67a68c3268b39e7dbd84aaaf46dba5e23e48e8402842.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	1d736643af18fe45f74f67a68c3268b39e7dbd84aaaf46dba5e23e48e8402842.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxF9CC.tmp	1d736643af18fe45f74f67a68c3268b39e7dbd84aaaf46dba5e23e48e8402842.exe

Modifies Internet Explorer settings 1 TTPs 40 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30886243"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B9492E00-B556-11EB-A11C-7EF74584969E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz!	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "327848533"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30886243"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "327831939"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2378862726"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30886243"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "327880525"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2378862726"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2388550038"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent	iexplore.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

DesktopLayer.exe

pid	process
196	DesktopLayer.exe
196	DesktopLayer.exe
196	DesktopLayer.exe
196	DesktopLayer.exe
196	DesktopLayer.exe
196	DesktopLayer.exe
196	DesktopLayer.exe
196	DesktopLayer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

856 iexplore.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

856 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

856 iexplore.exe
856 iexplore.exe
2388 IEXPLORE.EXE
2388 IEXPLORE.EXE
2388 IEXPLORE.EXE
2388 IEXPLORE.EXE

pid	process
856	iexplore.exe

pid	process
856	iexplore.exe

pid	process
856	iexplore.exe
856	iexplore.exe
2388	IEXPLORE.EXE
2388	IEXPLORE.EXE
2388	IEXPLORE.EXE
2388	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

1d736643af18fe45f74f67a68c3268b39e7dbd84aaaf46dba5e23e48e8402842.exeDesktopLayer.exeiexplore.exe

description	pid	process	target process
PID 3904 wrote to memory of 196	3904	1d736643af18fe45f74f67a68c3268b39e7dbd84aaaf46dba5e23e48e8402842.exe	DesktopLayer.exe
PID 3904 wrote to memory of 196	3904	1d736643af18fe45f74f67a68c3268b39e7dbd84aaaf46dba5e23e48e8402842.exe	DesktopLayer.exe
PID 3904 wrote to memory of 196	3904	1d736643af18fe45f74f67a68c3268b39e7dbd84aaaf46dba5e23e48e8402842.exe	DesktopLayer.exe
PID 196 wrote to memory of 856	196	DesktopLayer.exe	iexplore.exe
PID 196 wrote to memory of 856	196	DesktopLayer.exe	iexplore.exe
PID 856 wrote to memory of 2388	856	iexplore.exe	IEXPLORE.EXE
PID 856 wrote to memory of 2388	856	iexplore.exe	IEXPLORE.EXE
PID 856 wrote to memory of 2388	856	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\1d736643af18fe45f74f67a68c3268b39e7dbd84aaaf46dba5e23e48e8402842.exe
"C:\Users\Admin\AppData\Local\Temp\1d736643af18fe45f74f67a68c3268b39e7dbd84aaaf46dba5e23e48e8402842.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3904

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:196

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:856

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:856 CREDAT:82945 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2388

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
MD5
da18881ccaefeaa4942af9291cb34826

SHA1
e4f33c21684bede05ccea60dd0767250ff2b3aba

SHA256
1d736643af18fe45f74f67a68c3268b39e7dbd84aaaf46dba5e23e48e8402842

SHA512
2420cf80794f4e74fb95934698714d4386e022d68c0c4e181d9d6e189bf3fab09f920e6e9128e423a1dbf357558bab628133d1084a7a306617c3a9c2461a5901

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe
MD5
da18881ccaefeaa4942af9291cb34826

SHA1
e4f33c21684bede05ccea60dd0767250ff2b3aba

SHA256
1d736643af18fe45f74f67a68c3268b39e7dbd84aaaf46dba5e23e48e8402842

SHA512
2420cf80794f4e74fb95934698714d4386e022d68c0c4e181d9d6e189bf3fab09f920e6e9128e423a1dbf357558bab628133d1084a7a306617c3a9c2461a5901

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
MD5
57010df1ded674ce061f8af29a2e6fbb

SHA1
83e50ef272059dc3fab93e694d5e220dc48bf0c4

SHA256
68492169f14b36562d813f4ae7506f4b324b85f0e6aec352a37faba29b289616

SHA512
211ecb686dec8e8dd57cc8aeebdb8953f81aa56eebec9b463df4d41d98942317ed001ae5ffc9cc0c3ce5c542317cd0838447b885016697411b99f68190bd430b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
MD5
4b4dd2c95aa644bee3c8decf929ffa4a

SHA1
70ff5e14489cb71bba208d7bef317d34dd26b468

SHA256
d778b43f4eb6038e0d5c8c97b38bb5fbbcb399f22a6f7247fa7ac850f65b1309

SHA512
5913a23c1b591184106db1a460121b22e5571b6c27a4be29234181d9e4da5c64f7dfd972ebb151d495221c96fc0880e4591bf5ed325e9ff6d9f88643a811a2bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\74UF39XD.cookie
MD5
4c466bbe76ccfc49650d31d3f2123b86

SHA1
aeb35ce26b807d3417540ef5c60cda19dd362ad8

SHA256
f94b6b95624e5c793ec2c65edb34c847bf182bb743bc53e4013709eb9c674993

SHA512
cccea23e051c9ac1b9642e408e57f0bae7c63b867f7c5f24d5ca24bf47d9a2b77bdda12ad10d6fe0bd69046e392edf7fa995a06459a10de9a1c159fe2e0ccc35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\P0UWBN42.cookie
MD5
57e017b005b89fdf5e2f3f45e17dc753

SHA1
62c04ddc94e8a5f2b4adb109b49425b8474a7053

SHA256
9399152a17ee0f53576050cb0170c516647ea98c99bf3e1744bec4b775e0c6f8

SHA512
63d6386728fbbd2058ae388c52edded6de5197a0d1a08c9b4710aca04110f23071b1755a88f62ae67fca37760ab23153cf4972f8e2e13f7e0d65a954652d4fd6

Download Submit
memory/196-117-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/196-114-0x0000000000000000-mapping.dmp

Download
memory/856-120-0x0000000000000000-mapping.dmp

Download
memory/856-123-0x00007FF97CBE0000-0x00007FF97CC4B000-memory.dmp

Filesize
428KB

Download
memory/2388-124-0x0000000000000000-mapping.dmp

Download
memory/3904-118-0x00000000001E0000-0x00000000001EF000-memory.dmp

Filesize
60KB

Download
memory/3904-119-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads