ramnit | b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c

Analysis

max time kernel
38s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/10/2022, 21:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe
Size

74KB
MD5

755f8ae85a8b06ad8ce9c25c0670b730
SHA1

1c55251caa7b4779d1fdb55871b676c20f01787d
SHA256

b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c
SHA512

b759f16070f961f783cf5b17d5e45c7020ccb00f8c4de125fb95575b8fd604683e59d39f75abcbef9b790c3c5708023e5d2e80f379a1bd920bbd69002a8f0d7a
SSDEEP

1536:4+hzRsibKplyXTq8OGRnsPFG+RODTb7MXL5uXZnzE+x3PcIM:TROzoTq0+RO7IwnYj

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1568-55-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/1568-56-0x0000000000400000-0x0000000000433000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\px85C4.tmp	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe

Suspicious behavior: MapViewOfSection 22 IoCs

pid	Process
1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe
1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe
1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe
1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe
1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe
1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe
1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe
1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe
1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe
1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe
1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe
1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe
1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe
1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe
1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe
1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe
1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe
1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe
1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe
1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe
1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe
1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1568 wrote to memory of 372	1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe	5
PID 1568 wrote to memory of 372	1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe	5
PID 1568 wrote to memory of 372	1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe	5
PID 1568 wrote to memory of 372	1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe	5
PID 1568 wrote to memory of 372	1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe	5
PID 1568 wrote to memory of 372	1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe	5
PID 1568 wrote to memory of 380	1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe	4
PID 1568 wrote to memory of 380	1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe	4
PID 1568 wrote to memory of 380	1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe	4
PID 1568 wrote to memory of 380	1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe	4
PID 1568 wrote to memory of 380	1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe	4
PID 1568 wrote to memory of 380	1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe	4
PID 1568 wrote to memory of 420	1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe	3
PID 1568 wrote to memory of 420	1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe	3
PID 1568 wrote to memory of 420	1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe	3
PID 1568 wrote to memory of 420	1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe	3
PID 1568 wrote to memory of 420	1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe	3
PID 1568 wrote to memory of 420	1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe	3
PID 1568 wrote to memory of 468	1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe	2
PID 1568 wrote to memory of 468	1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe	2
PID 1568 wrote to memory of 468	1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe	2
PID 1568 wrote to memory of 468	1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe	2
PID 1568 wrote to memory of 468	1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe	2
PID 1568 wrote to memory of 468	1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe	2
PID 1568 wrote to memory of 476	1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe	1
PID 1568 wrote to memory of 476	1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe	1
PID 1568 wrote to memory of 476	1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe	1
PID 1568 wrote to memory of 476	1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe	1
PID 1568 wrote to memory of 476	1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe	1
PID 1568 wrote to memory of 476	1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe	1
PID 1568 wrote to memory of 484	1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe	8
PID 1568 wrote to memory of 484	1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe	8
PID 1568 wrote to memory of 484	1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe	8
PID 1568 wrote to memory of 484	1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe	8
PID 1568 wrote to memory of 484	1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe	8
PID 1568 wrote to memory of 484	1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe	8
PID 1568 wrote to memory of 600	1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe	27
PID 1568 wrote to memory of 600	1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe	27
PID 1568 wrote to memory of 600	1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe	27
PID 1568 wrote to memory of 600	1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe	27
PID 1568 wrote to memory of 600	1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe	27
PID 1568 wrote to memory of 600	1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe	27
PID 1568 wrote to memory of 680	1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe	26
PID 1568 wrote to memory of 680	1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe	26
PID 1568 wrote to memory of 680	1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe	26
PID 1568 wrote to memory of 680	1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe	26
PID 1568 wrote to memory of 680	1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe	26
PID 1568 wrote to memory of 680	1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe	26
PID 1568 wrote to memory of 764	1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe	25
PID 1568 wrote to memory of 764	1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe	25
PID 1568 wrote to memory of 764	1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe	25
PID 1568 wrote to memory of 764	1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe	25
PID 1568 wrote to memory of 764	1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe	25
PID 1568 wrote to memory of 764	1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe	25
PID 1568 wrote to memory of 816	1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe	24
PID 1568 wrote to memory of 816	1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe	24
PID 1568 wrote to memory of 816	1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe	24
PID 1568 wrote to memory of 816	1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe	24
PID 1568 wrote to memory of 816	1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe	24
PID 1568 wrote to memory of 816	1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe	24
PID 1568 wrote to memory of 840	1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe	23
PID 1568 wrote to memory of 840	1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe	23
PID 1568 wrote to memory of 840	1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe	23
PID 1568 wrote to memory of 840	1568	b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe	23

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:476

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:468
- C:\Windows\system32\sppsvc.exe
  C:\Windows\system32\sppsvc.exe
  2⤵
  PID:1108
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
  2⤵
  PID:1648
- C:\Windows\system32\taskhost.exe
  "taskhost.exe"
  2⤵
  PID:1140
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  2⤵
  PID:1064
- C:\Windows\System32\spoolsv.exe
  C:\Windows\System32\spoolsv.exe
  2⤵
  PID:1028
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k NetworkService
  2⤵
  PID:324
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  PID:884
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalService
  2⤵
  PID:840
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  2⤵
  PID:816
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:764
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:680
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  PID:600

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:380

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:372
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:484

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
PID:864

\\?\C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:2016

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1284
- C:\Users\Admin\AppData\Local\Temp\b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe
  "C:\Users\Admin\AppData\Local\Temp\b36c7c3bcc8890cd8d8e0f8eca3fd8ce79d1638831e90a9d4c9e9ee016f41b1c.exe"
  2⤵
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1568

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1228

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1568-54-0x0000000076031000-0x0000000076033000-memory.dmp

Filesize
8KB

Download
memory/1568-55-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1568-56-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download