Overview

overview

10

Static

static

d726fa34b9...42.dll

windows7_x64

10

d726fa34b9...42.dll

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d726fa34b9566f787811bca1a63b05632b5777caab5243b680d55bda9d656b42

  • Size

    208KB

  • Sample

    220131-wr6kpsaggl

  • MD5

    d60bd169ba03ae718e48029f268d5101

  • SHA1

    a11e38cb3dcb575f7949094656c292ac85e73319

  • SHA256

    d726fa34b9566f787811bca1a63b05632b5777caab5243b680d55bda9d656b42

  • SHA512

    4a0cc0afb0ef0e010f14c8fe35a97e10511842bc5ab11484fb51f3d2a55d450939cb9910588bc4b01a81fe9325fb9c6d02d40d49adca49b3b189959df1cc7ebd

Score
10/10
ramnitbankerpersistencespywarestealertrojanupxworm

Malware Config

Targets

    • Target

      d726fa34b9566f787811bca1a63b05632b5777caab5243b680d55bda9d656b42

    • Size

      208KB

    • MD5

      d60bd169ba03ae718e48029f268d5101

    • SHA1

      a11e38cb3dcb575f7949094656c292ac85e73319

    • SHA256

      d726fa34b9566f787811bca1a63b05632b5777caab5243b680d55bda9d656b42

    • SHA512

      4a0cc0afb0ef0e010f14c8fe35a97e10511842bc5ab11484fb51f3d2a55d450939cb9910588bc4b01a81fe9325fb9c6d02d40d49adca49b3b189959df1cc7ebd

    Score
    10/10
    ramnitbankerspywarestealertrojanupxwormpersistence

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

      trojanspywarestealerwormbankerramnit

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Executes dropped EXE

    • Sets service image path in registry

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks