ramnit | 79e965deb85ecd372dbbb5fd9c77867bcb4d5ad6e0c124ccc3ee51358305214d

General

Target

79e965deb85ecd372dbbb5fd9c77867bcb4d5ad6e0c124ccc3ee51358305214d.dll
Size

1.4MB
MD5

803ff1fcf41f190b29838246f6f7615c
SHA1

3256620504b7694a98e65c8bb8bad6550035ba66
SHA256

79e965deb85ecd372dbbb5fd9c77867bcb4d5ad6e0c124ccc3ee51358305214d
SHA512

e18b8af2cc617558d248db9d33cd6f10ba27bff9a6dd3ae08acfff21e9f1e7e7966a078c56e939c13e79c7621e37ab1502a73b1292b040133008313d2e19b216

Score

10^/10

ramnit banker bootkit persistence spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Executes dropped EXE 1 IoCs

Processes:

rundll32Srv.exe

pid process

4752 rundll32Srv.exe

pid	process
4752	rundll32Srv.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Windows\SysWOW64\rundll32Srv.exe	upx

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

rundll32.exe

description ioc process

File opened for modification \??\PhysicalDrive0 rundll32.exe
Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File created C:\Windows\SysWOW64\rundll32Srv.exe rundll32.exe
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

4592 4752 WerFault.exe rundll32Srv.exe
3352 2008 WerFault.exe rundll32.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	rundll32.exe

description	ioc	process
File created	C:\Windows\SysWOW64\rundll32Srv.exe	rundll32.exe

pid	pid_target	process	target process
4592	4752	WerFault.exe	rundll32Srv.exe
3352	2008	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 5012 wrote to memory of 2008	5012	rundll32.exe	rundll32.exe
PID 5012 wrote to memory of 2008	5012	rundll32.exe	rundll32.exe
PID 5012 wrote to memory of 2008	5012	rundll32.exe	rundll32.exe
PID 2008 wrote to memory of 4752	2008	rundll32.exe	rundll32Srv.exe
PID 2008 wrote to memory of 4752	2008	rundll32.exe	rundll32Srv.exe
PID 2008 wrote to memory of 4752	2008	rundll32.exe	rundll32Srv.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\79e965deb85ecd372dbbb5fd9c77867bcb4d5ad6e0c124ccc3ee51358305214d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5012

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\79e965deb85ecd372dbbb5fd9c77867bcb4d5ad6e0c124ccc3ee51358305214d.dll,#1
2⤵
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2008

C:\Windows\SysWOW64\rundll32Srv.exe
C:\Windows\SysWOW64\rundll32Srv.exe
3⤵
- Executes dropped EXE
PID:4752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 280
4⤵
- Program crash
PID:4592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 652
3⤵
- Program crash
PID:3352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4752 -ip 4752
1⤵
PID:1636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2008 -ip 2008
1⤵
PID:3968

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

1

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\rundll32Srv.exe
Filesize
74KB

MD5
fcaa38a6fdc673584dcbb74ef6fe70f2

SHA1
19aafcd6ea700210b973a3a6868d7e90f9cd1cf4

SHA256
fbebaa19ad2bdb019d6ab6ddabafc075b902f17462acb15011264f897e932e35

SHA512
f22c785749d705fac922bb9ac037e5955abebfbc4f3a936d4554e23e0b3ce0007597ac4d816eb81ecae5ca50c39a16e7b8d59ec1834dfdc40ebba781a9b5fae8

Download Submit
memory/2008-130-0x0000000000000000-mapping.dmp

Download
memory/4752-131-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing