ramnit | 79e965deb85ecd372dbbb5fd9c77867bcb4d5ad6e0c124ccc3ee51358305214d

General

Target

79e965deb85ecd372dbbb5fd9c77867bcb4d5ad6e0c124ccc3ee51358305214d.dll
Size

1.4MB
MD5

803ff1fcf41f190b29838246f6f7615c
SHA1

3256620504b7694a98e65c8bb8bad6550035ba66
SHA256

79e965deb85ecd372dbbb5fd9c77867bcb4d5ad6e0c124ccc3ee51358305214d
SHA512

e18b8af2cc617558d248db9d33cd6f10ba27bff9a6dd3ae08acfff21e9f1e7e7966a078c56e939c13e79c7621e37ab1502a73b1292b040133008313d2e19b216

Score

10^/10

ramnit banker bootkit persistence spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Executes dropped EXE 1 IoCs

Processes:

rundll32Srv.exe

pid process

688 rundll32Srv.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Windows\SysWOW64\rundll32Srv.exe	upx
C:\Windows\SysWOW64\rundll32Srv.exe	upx
C:\WINDOWS\SYSWOW64\RUNDLL32SRV.EXE	upx
behavioral1/memory/688-61-0x0000000000400000-0x0000000000433000-memory.dmp	upx

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

1376 rundll32.exe
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

rundll32.exe

description ioc process

File opened for modification \??\PhysicalDrive0 rundll32.exe
Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File created C:\Windows\SysWOW64\rundll32Srv.exe rundll32.exe

pid	process
1376	rundll32.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	rundll32.exe

description	ioc	process
File created	C:\Windows\SysWOW64\rundll32Srv.exe	rundll32.exe

Drops file in Program Files directory 3 IoCs

Processes:

rundll32Srv.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	rundll32Srv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px47DA.tmp	rundll32Srv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	rundll32Srv.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32Srv.exe

pid process

688 rundll32Srv.exe

Suspicious behavior: MapViewOfSection 22 IoCs

Processes:

rundll32Srv.exe

pid	process
688	rundll32Srv.exe
688	rundll32Srv.exe
688	rundll32Srv.exe
688	rundll32Srv.exe
688	rundll32Srv.exe
688	rundll32Srv.exe
688	rundll32Srv.exe
688	rundll32Srv.exe
688	rundll32Srv.exe
688	rundll32Srv.exe
688	rundll32Srv.exe
688	rundll32Srv.exe
688	rundll32Srv.exe
688	rundll32Srv.exe
688	rundll32Srv.exe
688	rundll32Srv.exe
688	rundll32Srv.exe
688	rundll32Srv.exe
688	rundll32Srv.exe
688	rundll32Srv.exe
688	rundll32Srv.exe
688	rundll32Srv.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

rundll32Srv.exe

description pid process

Token: SeDebugPrivilege 688 rundll32Srv.exe

description	pid	process
Token: SeDebugPrivilege	688	rundll32Srv.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

rundll32.exerundll32.exerundll32Srv.exe

description	pid	process	target process
PID 1664 wrote to memory of 1376	1664	rundll32.exe	rundll32.exe
PID 1664 wrote to memory of 1376	1664	rundll32.exe	rundll32.exe
PID 1664 wrote to memory of 1376	1664	rundll32.exe	rundll32.exe
PID 1664 wrote to memory of 1376	1664	rundll32.exe	rundll32.exe
PID 1664 wrote to memory of 1376	1664	rundll32.exe	rundll32.exe
PID 1664 wrote to memory of 1376	1664	rundll32.exe	rundll32.exe
PID 1664 wrote to memory of 1376	1664	rundll32.exe	rundll32.exe
PID 1376 wrote to memory of 688	1376	rundll32.exe	rundll32Srv.exe
PID 1376 wrote to memory of 688	1376	rundll32.exe	rundll32Srv.exe
PID 1376 wrote to memory of 688	1376	rundll32.exe	rundll32Srv.exe
PID 1376 wrote to memory of 688	1376	rundll32.exe	rundll32Srv.exe
PID 688 wrote to memory of 372	688	rundll32Srv.exe	wininit.exe
PID 688 wrote to memory of 372	688	rundll32Srv.exe	wininit.exe
PID 688 wrote to memory of 372	688	rundll32Srv.exe	wininit.exe
PID 688 wrote to memory of 372	688	rundll32Srv.exe	wininit.exe
PID 688 wrote to memory of 372	688	rundll32Srv.exe	wininit.exe
PID 688 wrote to memory of 372	688	rundll32Srv.exe	wininit.exe
PID 688 wrote to memory of 384	688	rundll32Srv.exe	csrss.exe
PID 688 wrote to memory of 384	688	rundll32Srv.exe	csrss.exe
PID 688 wrote to memory of 384	688	rundll32Srv.exe	csrss.exe
PID 688 wrote to memory of 384	688	rundll32Srv.exe	csrss.exe
PID 688 wrote to memory of 384	688	rundll32Srv.exe	csrss.exe
PID 688 wrote to memory of 384	688	rundll32Srv.exe	csrss.exe
PID 688 wrote to memory of 420	688	rundll32Srv.exe	winlogon.exe
PID 688 wrote to memory of 420	688	rundll32Srv.exe	winlogon.exe
PID 688 wrote to memory of 420	688	rundll32Srv.exe	winlogon.exe
PID 688 wrote to memory of 420	688	rundll32Srv.exe	winlogon.exe
PID 688 wrote to memory of 420	688	rundll32Srv.exe	winlogon.exe
PID 688 wrote to memory of 420	688	rundll32Srv.exe	winlogon.exe
PID 688 wrote to memory of 468	688	rundll32Srv.exe	services.exe
PID 688 wrote to memory of 468	688	rundll32Srv.exe	services.exe
PID 688 wrote to memory of 468	688	rundll32Srv.exe	services.exe
PID 688 wrote to memory of 468	688	rundll32Srv.exe	services.exe
PID 688 wrote to memory of 468	688	rundll32Srv.exe	services.exe
PID 688 wrote to memory of 468	688	rundll32Srv.exe	services.exe
PID 688 wrote to memory of 476	688	rundll32Srv.exe	lsass.exe
PID 688 wrote to memory of 476	688	rundll32Srv.exe	lsass.exe
PID 688 wrote to memory of 476	688	rundll32Srv.exe	lsass.exe
PID 688 wrote to memory of 476	688	rundll32Srv.exe	lsass.exe
PID 688 wrote to memory of 476	688	rundll32Srv.exe	lsass.exe
PID 688 wrote to memory of 476	688	rundll32Srv.exe	lsass.exe
PID 688 wrote to memory of 484	688	rundll32Srv.exe	lsm.exe
PID 688 wrote to memory of 484	688	rundll32Srv.exe	lsm.exe
PID 688 wrote to memory of 484	688	rundll32Srv.exe	lsm.exe
PID 688 wrote to memory of 484	688	rundll32Srv.exe	lsm.exe
PID 688 wrote to memory of 484	688	rundll32Srv.exe	lsm.exe
PID 688 wrote to memory of 484	688	rundll32Srv.exe	lsm.exe
PID 688 wrote to memory of 596	688	rundll32Srv.exe	svchost.exe
PID 688 wrote to memory of 596	688	rundll32Srv.exe	svchost.exe
PID 688 wrote to memory of 596	688	rundll32Srv.exe	svchost.exe
PID 688 wrote to memory of 596	688	rundll32Srv.exe	svchost.exe
PID 688 wrote to memory of 596	688	rundll32Srv.exe	svchost.exe
PID 688 wrote to memory of 596	688	rundll32Srv.exe	svchost.exe
PID 688 wrote to memory of 672	688	rundll32Srv.exe	svchost.exe
PID 688 wrote to memory of 672	688	rundll32Srv.exe	svchost.exe
PID 688 wrote to memory of 672	688	rundll32Srv.exe	svchost.exe
PID 688 wrote to memory of 672	688	rundll32Srv.exe	svchost.exe
PID 688 wrote to memory of 672	688	rundll32Srv.exe	svchost.exe
PID 688 wrote to memory of 672	688	rundll32Srv.exe	svchost.exe
PID 688 wrote to memory of 760	688	rundll32Srv.exe	svchost.exe
PID 688 wrote to memory of 760	688	rundll32Srv.exe	svchost.exe
PID 688 wrote to memory of 760	688	rundll32Srv.exe	svchost.exe
PID 688 wrote to memory of 760	688	rundll32Srv.exe	svchost.exe
PID 688 wrote to memory of 760	688	rundll32Srv.exe	svchost.exe

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:476

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:468

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
2⤵
PID:240

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
2⤵
PID:796

C:\Windows\system32\sppsvc.exe
C:\Windows\system32\sppsvc.exe
2⤵
PID:1308

C:\Windows\system32\taskhost.exe
"taskhost.exe"
2⤵
PID:1120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
2⤵
PID:1084

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService
2⤵
PID:296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
2⤵
PID:892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
2⤵
PID:852

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
2⤵
PID:816

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
2⤵
PID:760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS
2⤵
PID:672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
2⤵
PID:596

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
1⤵
PID:484

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
PID:1772

\\?\C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:1940

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1212

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\79e965deb85ecd372dbbb5fd9c77867bcb4d5ad6e0c124ccc3ee51358305214d.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1664

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\79e965deb85ecd372dbbb5fd9c77867bcb4d5ad6e0c124ccc3ee51358305214d.dll,#1
3⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1376

C:\Windows\SysWOW64\rundll32Srv.exe
C:\Windows\SysWOW64\rundll32Srv.exe
4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:688

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1184

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:384

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:372

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

1

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\SYSWOW64\RUNDLL32SRV.EXE
Filesize
74KB

MD5
fcaa38a6fdc673584dcbb74ef6fe70f2

SHA1
19aafcd6ea700210b973a3a6868d7e90f9cd1cf4

SHA256
fbebaa19ad2bdb019d6ab6ddabafc075b902f17462acb15011264f897e932e35

SHA512
f22c785749d705fac922bb9ac037e5955abebfbc4f3a936d4554e23e0b3ce0007597ac4d816eb81ecae5ca50c39a16e7b8d59ec1834dfdc40ebba781a9b5fae8

Download Submit
C:\Windows\SysWOW64\rundll32Srv.exe
Filesize
74KB

MD5
fcaa38a6fdc673584dcbb74ef6fe70f2

SHA1
19aafcd6ea700210b973a3a6868d7e90f9cd1cf4

SHA256
fbebaa19ad2bdb019d6ab6ddabafc075b902f17462acb15011264f897e932e35

SHA512
f22c785749d705fac922bb9ac037e5955abebfbc4f3a936d4554e23e0b3ce0007597ac4d816eb81ecae5ca50c39a16e7b8d59ec1834dfdc40ebba781a9b5fae8

Download Submit
\Windows\SysWOW64\rundll32Srv.exe
Filesize
74KB

MD5
fcaa38a6fdc673584dcbb74ef6fe70f2

SHA1
19aafcd6ea700210b973a3a6868d7e90f9cd1cf4

SHA256
fbebaa19ad2bdb019d6ab6ddabafc075b902f17462acb15011264f897e932e35

SHA512
f22c785749d705fac922bb9ac037e5955abebfbc4f3a936d4554e23e0b3ce0007597ac4d816eb81ecae5ca50c39a16e7b8d59ec1834dfdc40ebba781a9b5fae8

Download Submit
memory/688-57-0x0000000000000000-mapping.dmp

Download
memory/688-61-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1376-54-0x0000000000000000-mapping.dmp

Download
memory/1376-55-0x0000000075AE1000-0x0000000075AE3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads