ramnit | caaf7a0ba0be857a3b9ffadb1721a2f8e1ce053de3e54c58971c24235acb8952

Analysis

max time kernel
44s
max time network
50s
platform
windows7_x64
resource
win7-20220414-en
submitted
20-05-2022 04:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

snxdx/CrackCaptchaAPI.dll
Size

1.4MB
MD5

803ff1fcf41f190b29838246f6f7615c
SHA1

3256620504b7694a98e65c8bb8bad6550035ba66
SHA256

79e965deb85ecd372dbbb5fd9c77867bcb4d5ad6e0c124ccc3ee51358305214d
SHA512

e18b8af2cc617558d248db9d33cd6f10ba27bff9a6dd3ae08acfff21e9f1e7e7966a078c56e939c13e79c7621e37ab1502a73b1292b040133008313d2e19b216

Score

10^/10

ramnit banker bootkit persistence spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Executes dropped EXE 1 IoCs

Processes:

rundll32Srv.exe

pid process

1988 rundll32Srv.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Windows\SysWOW64\rundll32Srv.exe	upx
C:\Windows\SysWOW64\rundll32Srv.exe	upx
C:\WINDOWS\SYSWOW64\RUNDLL32SRV.EXE	upx
behavioral7/memory/1988-61-0x0000000000400000-0x0000000000433000-memory.dmp	upx

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

1528 rundll32.exe
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

rundll32.exe

description ioc process

File opened for modification \??\PhysicalDrive0 rundll32.exe
Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File created C:\Windows\SysWOW64\rundll32Srv.exe rundll32.exe

pid	process
1528	rundll32.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	rundll32.exe

description	ioc	process
File created	C:\Windows\SysWOW64\rundll32Srv.exe	rundll32.exe

Drops file in Program Files directory 3 IoCs

Processes:

rundll32Srv.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	rundll32Srv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	rundll32Srv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px3257.tmp	rundll32Srv.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32Srv.exe

pid process

1988 rundll32Srv.exe

Suspicious behavior: MapViewOfSection 21 IoCs

Processes:

rundll32Srv.exe

pid	process
1988	rundll32Srv.exe
1988	rundll32Srv.exe
1988	rundll32Srv.exe
1988	rundll32Srv.exe
1988	rundll32Srv.exe
1988	rundll32Srv.exe
1988	rundll32Srv.exe
1988	rundll32Srv.exe
1988	rundll32Srv.exe
1988	rundll32Srv.exe
1988	rundll32Srv.exe
1988	rundll32Srv.exe
1988	rundll32Srv.exe
1988	rundll32Srv.exe
1988	rundll32Srv.exe
1988	rundll32Srv.exe
1988	rundll32Srv.exe
1988	rundll32Srv.exe
1988	rundll32Srv.exe
1988	rundll32Srv.exe
1988	rundll32Srv.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

rundll32Srv.exe

description pid process

Token: SeDebugPrivilege 1988 rundll32Srv.exe

description	pid	process
Token: SeDebugPrivilege	1988	rundll32Srv.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

rundll32.exerundll32.exerundll32Srv.exe

description	pid	process	target process
PID 1296 wrote to memory of 1528	1296	rundll32.exe	rundll32.exe
PID 1296 wrote to memory of 1528	1296	rundll32.exe	rundll32.exe
PID 1296 wrote to memory of 1528	1296	rundll32.exe	rundll32.exe
PID 1296 wrote to memory of 1528	1296	rundll32.exe	rundll32.exe
PID 1296 wrote to memory of 1528	1296	rundll32.exe	rundll32.exe
PID 1296 wrote to memory of 1528	1296	rundll32.exe	rundll32.exe
PID 1296 wrote to memory of 1528	1296	rundll32.exe	rundll32.exe
PID 1528 wrote to memory of 1988	1528	rundll32.exe	rundll32Srv.exe
PID 1528 wrote to memory of 1988	1528	rundll32.exe	rundll32Srv.exe
PID 1528 wrote to memory of 1988	1528	rundll32.exe	rundll32Srv.exe
PID 1528 wrote to memory of 1988	1528	rundll32.exe	rundll32Srv.exe
PID 1988 wrote to memory of 368	1988	rundll32Srv.exe	wininit.exe
PID 1988 wrote to memory of 368	1988	rundll32Srv.exe	wininit.exe
PID 1988 wrote to memory of 368	1988	rundll32Srv.exe	wininit.exe
PID 1988 wrote to memory of 368	1988	rundll32Srv.exe	wininit.exe
PID 1988 wrote to memory of 368	1988	rundll32Srv.exe	wininit.exe
PID 1988 wrote to memory of 368	1988	rundll32Srv.exe	wininit.exe
PID 1988 wrote to memory of 376	1988	rundll32Srv.exe	csrss.exe
PID 1988 wrote to memory of 376	1988	rundll32Srv.exe	csrss.exe
PID 1988 wrote to memory of 376	1988	rundll32Srv.exe	csrss.exe
PID 1988 wrote to memory of 376	1988	rundll32Srv.exe	csrss.exe
PID 1988 wrote to memory of 376	1988	rundll32Srv.exe	csrss.exe
PID 1988 wrote to memory of 376	1988	rundll32Srv.exe	csrss.exe
PID 1988 wrote to memory of 416	1988	rundll32Srv.exe	winlogon.exe
PID 1988 wrote to memory of 416	1988	rundll32Srv.exe	winlogon.exe
PID 1988 wrote to memory of 416	1988	rundll32Srv.exe	winlogon.exe
PID 1988 wrote to memory of 416	1988	rundll32Srv.exe	winlogon.exe
PID 1988 wrote to memory of 416	1988	rundll32Srv.exe	winlogon.exe
PID 1988 wrote to memory of 416	1988	rundll32Srv.exe	winlogon.exe
PID 1988 wrote to memory of 460	1988	rundll32Srv.exe	services.exe
PID 1988 wrote to memory of 460	1988	rundll32Srv.exe	services.exe
PID 1988 wrote to memory of 460	1988	rundll32Srv.exe	services.exe
PID 1988 wrote to memory of 460	1988	rundll32Srv.exe	services.exe
PID 1988 wrote to memory of 460	1988	rundll32Srv.exe	services.exe
PID 1988 wrote to memory of 460	1988	rundll32Srv.exe	services.exe
PID 1988 wrote to memory of 476	1988	rundll32Srv.exe	lsass.exe
PID 1988 wrote to memory of 476	1988	rundll32Srv.exe	lsass.exe
PID 1988 wrote to memory of 476	1988	rundll32Srv.exe	lsass.exe
PID 1988 wrote to memory of 476	1988	rundll32Srv.exe	lsass.exe
PID 1988 wrote to memory of 476	1988	rundll32Srv.exe	lsass.exe
PID 1988 wrote to memory of 476	1988	rundll32Srv.exe	lsass.exe
PID 1988 wrote to memory of 484	1988	rundll32Srv.exe	lsm.exe
PID 1988 wrote to memory of 484	1988	rundll32Srv.exe	lsm.exe
PID 1988 wrote to memory of 484	1988	rundll32Srv.exe	lsm.exe
PID 1988 wrote to memory of 484	1988	rundll32Srv.exe	lsm.exe
PID 1988 wrote to memory of 484	1988	rundll32Srv.exe	lsm.exe
PID 1988 wrote to memory of 484	1988	rundll32Srv.exe	lsm.exe
PID 1988 wrote to memory of 580	1988	rundll32Srv.exe	svchost.exe
PID 1988 wrote to memory of 580	1988	rundll32Srv.exe	svchost.exe
PID 1988 wrote to memory of 580	1988	rundll32Srv.exe	svchost.exe
PID 1988 wrote to memory of 580	1988	rundll32Srv.exe	svchost.exe
PID 1988 wrote to memory of 580	1988	rundll32Srv.exe	svchost.exe
PID 1988 wrote to memory of 580	1988	rundll32Srv.exe	svchost.exe
PID 1988 wrote to memory of 660	1988	rundll32Srv.exe	svchost.exe
PID 1988 wrote to memory of 660	1988	rundll32Srv.exe	svchost.exe
PID 1988 wrote to memory of 660	1988	rundll32Srv.exe	svchost.exe
PID 1988 wrote to memory of 660	1988	rundll32Srv.exe	svchost.exe
PID 1988 wrote to memory of 660	1988	rundll32Srv.exe	svchost.exe
PID 1988 wrote to memory of 660	1988	rundll32Srv.exe	svchost.exe
PID 1988 wrote to memory of 740	1988	rundll32Srv.exe	svchost.exe
PID 1988 wrote to memory of 740	1988	rundll32Srv.exe	svchost.exe
PID 1988 wrote to memory of 740	1988	rundll32Srv.exe	svchost.exe
PID 1988 wrote to memory of 740	1988	rundll32Srv.exe	svchost.exe
PID 1988 wrote to memory of 740	1988	rundll32Srv.exe	svchost.exe

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:476

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
2⤵
PID:580

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
3⤵
PID:652

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
2⤵
PID:796

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
3⤵
PID:1324

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
2⤵
PID:740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService
2⤵
PID:300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
2⤵
PID:380

C:\Windows\system32\taskhost.exe
"taskhost.exe"
2⤵
PID:1232

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
2⤵
PID:996

C:\Windows\system32\sppsvc.exe
C:\Windows\system32\sppsvc.exe
2⤵
PID:2000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
2⤵
PID:1648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
2⤵
PID:864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
2⤵
PID:832

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS
2⤵
PID:660

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:416

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:376

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:368

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
2⤵
PID:484

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1376

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\snxdx\CrackCaptchaAPI.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1296

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\snxdx\CrackCaptchaAPI.dll,#1
3⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1528

C:\Windows\SysWOW64\rundll32Srv.exe
C:\Windows\SysWOW64\rundll32Srv.exe
4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1988

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\SYSWOW64\RUNDLL32SRV.EXE
Filesize
74KB

MD5
fcaa38a6fdc673584dcbb74ef6fe70f2

SHA1
19aafcd6ea700210b973a3a6868d7e90f9cd1cf4

SHA256
fbebaa19ad2bdb019d6ab6ddabafc075b902f17462acb15011264f897e932e35

SHA512
f22c785749d705fac922bb9ac037e5955abebfbc4f3a936d4554e23e0b3ce0007597ac4d816eb81ecae5ca50c39a16e7b8d59ec1834dfdc40ebba781a9b5fae8

Download Submit
C:\Windows\SysWOW64\rundll32Srv.exe
Filesize
74KB

MD5
fcaa38a6fdc673584dcbb74ef6fe70f2

SHA1
19aafcd6ea700210b973a3a6868d7e90f9cd1cf4

SHA256
fbebaa19ad2bdb019d6ab6ddabafc075b902f17462acb15011264f897e932e35

SHA512
f22c785749d705fac922bb9ac037e5955abebfbc4f3a936d4554e23e0b3ce0007597ac4d816eb81ecae5ca50c39a16e7b8d59ec1834dfdc40ebba781a9b5fae8

Download Submit
\Windows\SysWOW64\rundll32Srv.exe
Filesize
74KB

MD5
fcaa38a6fdc673584dcbb74ef6fe70f2

SHA1
19aafcd6ea700210b973a3a6868d7e90f9cd1cf4

SHA256
fbebaa19ad2bdb019d6ab6ddabafc075b902f17462acb15011264f897e932e35

SHA512
f22c785749d705fac922bb9ac037e5955abebfbc4f3a936d4554e23e0b3ce0007597ac4d816eb81ecae5ca50c39a16e7b8d59ec1834dfdc40ebba781a9b5fae8

Download Submit
memory/1528-54-0x0000000000000000-mapping.dmp

Download
memory/1528-55-0x0000000075741000-0x0000000075743000-memory.dmp

Filesize
8KB

Download
memory/1988-57-0x0000000000000000-mapping.dmp

Download
memory/1988-61-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads