ramnit | 337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341

General

Target

337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
Size

494KB
MD5

46ccdac4f0bbc0b6c8a411db9b058644
SHA1

5e69d0047113d4939cb909f5db0700f9e843ba44
SHA256

337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341
SHA512

292b5ce3c7aba52a53fc756489dd82d48d93891334265478c1a4ace98c18cbc4ee1622e3889f8a9e783c7655585327769e7b28721edd5ff4c31ede206eb16a89

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Executes dropped EXE 1 IoCs

Processes:

337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341Srv.exe

pid process

1644 337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341Srv.exe

pid	process
1644	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341Srv.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341Srv.exe	upx
C:\Users\Admin\AppData\Local\Temp\337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341Srv.exe	upx
C:\USERS\ADMIN\APPDATA\LOCAL\TEMP\337DE1739B18E91DE064E9F50FA0EB5552AFE069012812B6CE29BE3B96DCD341SRV.EXE	upx
behavioral1/memory/1644-67-0x0000000000400000-0x0000000000435000-memory.dmp	upx

Loads dropped DLL 1 IoCs

Processes:

337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe

pid process

1096 337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe

Drops file in Program Files directory 3 IoCs

Processes:

337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341Srv.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft\px2F2B.tmp	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341Srv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341Srv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341Srv.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe

pid process

1096 337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe

Suspicious behavior: MapViewOfSection 21 IoCs

Processes:

337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe

pid	process
1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe

description pid process

Token: SeDebugPrivilege 1096 337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe

description	pid	process
Token: SeDebugPrivilege	1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe

description	pid	process	target process
PID 1096 wrote to memory of 1644	1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341Srv.exe
PID 1096 wrote to memory of 1644	1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341Srv.exe
PID 1096 wrote to memory of 1644	1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341Srv.exe
PID 1096 wrote to memory of 1644	1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341Srv.exe
PID 1096 wrote to memory of 372	1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	wininit.exe
PID 1096 wrote to memory of 372	1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	wininit.exe
PID 1096 wrote to memory of 372	1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	wininit.exe
PID 1096 wrote to memory of 372	1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	wininit.exe
PID 1096 wrote to memory of 372	1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	wininit.exe
PID 1096 wrote to memory of 372	1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	wininit.exe
PID 1096 wrote to memory of 372	1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	wininit.exe
PID 1096 wrote to memory of 380	1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	csrss.exe
PID 1096 wrote to memory of 380	1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	csrss.exe
PID 1096 wrote to memory of 380	1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	csrss.exe
PID 1096 wrote to memory of 380	1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	csrss.exe
PID 1096 wrote to memory of 380	1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	csrss.exe
PID 1096 wrote to memory of 380	1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	csrss.exe
PID 1096 wrote to memory of 380	1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	csrss.exe
PID 1096 wrote to memory of 420	1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	winlogon.exe
PID 1096 wrote to memory of 420	1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	winlogon.exe
PID 1096 wrote to memory of 420	1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	winlogon.exe
PID 1096 wrote to memory of 420	1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	winlogon.exe
PID 1096 wrote to memory of 420	1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	winlogon.exe
PID 1096 wrote to memory of 420	1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	winlogon.exe
PID 1096 wrote to memory of 420	1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	winlogon.exe
PID 1096 wrote to memory of 468	1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	services.exe
PID 1096 wrote to memory of 468	1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	services.exe
PID 1096 wrote to memory of 468	1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	services.exe
PID 1096 wrote to memory of 468	1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	services.exe
PID 1096 wrote to memory of 468	1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	services.exe
PID 1096 wrote to memory of 468	1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	services.exe
PID 1096 wrote to memory of 468	1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	services.exe
PID 1096 wrote to memory of 476	1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	lsass.exe
PID 1096 wrote to memory of 476	1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	lsass.exe
PID 1096 wrote to memory of 476	1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	lsass.exe
PID 1096 wrote to memory of 476	1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	lsass.exe
PID 1096 wrote to memory of 476	1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	lsass.exe
PID 1096 wrote to memory of 476	1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	lsass.exe
PID 1096 wrote to memory of 476	1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	lsass.exe
PID 1096 wrote to memory of 484	1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	lsm.exe
PID 1096 wrote to memory of 484	1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	lsm.exe
PID 1096 wrote to memory of 484	1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	lsm.exe
PID 1096 wrote to memory of 484	1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	lsm.exe
PID 1096 wrote to memory of 484	1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	lsm.exe
PID 1096 wrote to memory of 484	1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	lsm.exe
PID 1096 wrote to memory of 484	1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	lsm.exe
PID 1096 wrote to memory of 580	1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	svchost.exe
PID 1096 wrote to memory of 580	1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	svchost.exe
PID 1096 wrote to memory of 580	1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	svchost.exe
PID 1096 wrote to memory of 580	1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	svchost.exe
PID 1096 wrote to memory of 580	1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	svchost.exe
PID 1096 wrote to memory of 580	1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	svchost.exe
PID 1096 wrote to memory of 580	1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	svchost.exe
PID 1096 wrote to memory of 656	1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	svchost.exe
PID 1096 wrote to memory of 656	1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	svchost.exe
PID 1096 wrote to memory of 656	1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	svchost.exe
PID 1096 wrote to memory of 656	1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	svchost.exe
PID 1096 wrote to memory of 656	1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	svchost.exe
PID 1096 wrote to memory of 656	1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	svchost.exe
PID 1096 wrote to memory of 656	1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	svchost.exe
PID 1096 wrote to memory of 720	1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	svchost.exe
PID 1096 wrote to memory of 720	1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	svchost.exe
PID 1096 wrote to memory of 720	1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	svchost.exe
PID 1096 wrote to memory of 720	1096	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	svchost.exe

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:380

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:372

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
2⤵
PID:476

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
2⤵
PID:468

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
3⤵
PID:720

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
3⤵
PID:792

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
4⤵
PID:1176

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
3⤵
PID:820

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
3⤵
PID:856

C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
4⤵
PID:1896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService
3⤵
PID:240

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS
3⤵
PID:656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
3⤵
PID:580

C:\Windows\system32\taskhost.exe
"taskhost.exe"
3⤵
PID:1116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
3⤵
PID:1040

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
3⤵
PID:328

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
2⤵
PID:484

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420

C:\Users\Admin\AppData\Local\Temp\061422427\zmstage.exe
C:\Users\Admin\AppData\Local\Temp\061422427\zmstage.exe
1⤵
PID:1736

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1248

C:\Users\Admin\AppData\Local\Temp\337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
"C:\Users\Admin\AppData\Local\Temp\337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1096

C:\Users\Admin\AppData\Local\Temp\337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341Srv.exe
C:\Users\Admin\AppData\Local\Temp\337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341Srv.exe
3⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1644

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\USERS\ADMIN\APPDATA\LOCAL\TEMP\337DE1739B18E91DE064E9F50FA0EB5552AFE069012812B6CE29BE3B96DCD341SRV.EXE
MD5
d8ce8e59dc1b438493939ab9753807d0

SHA1
fa3ec7549a6f496749762cbed1038a2cb1951dca

SHA256
61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24

SHA512
7ff83c93e3b9f17a2fae2a14a5a0ddfc498cc3d7cec5dffda45936383b3c2c2ee2aa62719b2165d74b1bf676a71b55191e45702b576cc059fa6af24ba74ae954

Download Submit
C:\Users\Admin\AppData\Local\Temp\337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341Srv.exe
MD5
d8ce8e59dc1b438493939ab9753807d0

SHA1
fa3ec7549a6f496749762cbed1038a2cb1951dca

SHA256
61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24

SHA512
7ff83c93e3b9f17a2fae2a14a5a0ddfc498cc3d7cec5dffda45936383b3c2c2ee2aa62719b2165d74b1bf676a71b55191e45702b576cc059fa6af24ba74ae954

Download Submit
\Users\Admin\AppData\Local\Temp\337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341Srv.exe
MD5
d8ce8e59dc1b438493939ab9753807d0

SHA1
fa3ec7549a6f496749762cbed1038a2cb1951dca

SHA256
61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24

SHA512
7ff83c93e3b9f17a2fae2a14a5a0ddfc498cc3d7cec5dffda45936383b3c2c2ee2aa62719b2165d74b1bf676a71b55191e45702b576cc059fa6af24ba74ae954

Download Submit
memory/1096-68-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/1644-61-0x0000000000000000-mapping.dmp

Download
memory/1644-63-0x0000000075281000-0x0000000075283000-memory.dmp

Filesize
8KB

Download
memory/1644-66-0x0000000000230000-0x000000000023F000-memory.dmp

Filesize
60KB

Download
memory/1644-67-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1644-65-0x000000007EFA0000-0x000000007EFAC000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads