ramnit | f158a9650580dcf9a875b153192a86e20798c7f01b4a458b668704661e2cc89c | Triage

Analysis

max time kernel
122s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20220310-en
submitted
11-03-2022 21:18

Sharing

Report Analysis Logs

General

Target

微信对话自编自导.exe
Size

592KB
MD5

db1f34dd728b1591a00e658aceb6ef87
SHA1

9833364a4baa83822af091f75f2583a04c18144c
SHA256

f158a9650580dcf9a875b153192a86e20798c7f01b4a458b668704661e2cc89c
SHA512

968628f216694a74863ea5f509b0b238a54b29e9c18d3bc47b91519fd08e2d00004374a77f9f20bfc68260ce9ec944ad001feb338a1db6d7a2d78572a98eb113

Score

10^/10

ramnit banker spyware stealer trojan worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

微信对话自编自导.exe

pid process

2952 微信对话自编自导.exe
2952 微信对话自编自导.exe
2952 微信对话自编自导.exe
2952 微信对话自编自导.exe

C:\Users\Admin\AppData\Local\Temp\微信对话自编自导.exe
"C:\Users\Admin\AppData\Local\Temp\微信对话自编自导.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2952

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:3508

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...