ramnit | 501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52

Analysis

max time kernel
163s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-10-2022 19:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe
Size

184KB
MD5

4a8524e60d7a5b36cbef6be158f69040
SHA1

390dd8cd85b51ff4413c608e8ec650c1714bfc85
SHA256

501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52
SHA512

cd6d8163ec15190197ec326f67e46619ea41fb532c551f8be26da9e4ad8a2d10b457c0569087104d7918ec70d4a6f6c5dcad3c8518e2d7e19c2b12e864138d5b
SSDEEP

3072:UqDYSxvsfddz/lyd2KdXGTW6eto6zAOlc6Y7gN0qyLOD12oQY2:UqDYqOUd1l7d/OLLI2Y2

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Executes dropped EXE 1 IoCs

pid	Process
1352	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52Srv.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000c0000000054a8-55.dat	upx
behavioral1/files/0x000c0000000054a8-57.dat	upx
behavioral1/files/0x000c0000000054a8-59.dat	upx
behavioral1/memory/1352-60-0x0000000000400000-0x0000000000435000-memory.dmp	upx

Loads dropped DLL 1 IoCs

pid	Process
1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52Srv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px6172.tmp	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52Srv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52Srv.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe

Suspicious behavior: MapViewOfSection 22 IoCs

pid	Process
1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe
1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe
1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe
1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe
1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe
1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe
1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe
1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe
1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe
1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe
1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe
1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe
1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe
1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe
1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe
1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe
1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe
1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe
1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe
1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe
1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe
1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1028 wrote to memory of 1352	1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe	27
PID 1028 wrote to memory of 1352	1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe	27
PID 1028 wrote to memory of 1352	1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe	27
PID 1028 wrote to memory of 1352	1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe	27
PID 1028 wrote to memory of 368	1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe	24
PID 1028 wrote to memory of 368	1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe	24
PID 1028 wrote to memory of 368	1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe	24
PID 1028 wrote to memory of 368	1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe	24
PID 1028 wrote to memory of 368	1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe	24
PID 1028 wrote to memory of 368	1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe	24
PID 1028 wrote to memory of 368	1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe	24
PID 1028 wrote to memory of 376	1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe	23
PID 1028 wrote to memory of 376	1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe	23
PID 1028 wrote to memory of 376	1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe	23
PID 1028 wrote to memory of 376	1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe	23
PID 1028 wrote to memory of 376	1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe	23
PID 1028 wrote to memory of 376	1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe	23
PID 1028 wrote to memory of 376	1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe	23
PID 1028 wrote to memory of 416	1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe	22
PID 1028 wrote to memory of 416	1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe	22
PID 1028 wrote to memory of 416	1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe	22
PID 1028 wrote to memory of 416	1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe	22
PID 1028 wrote to memory of 416	1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe	22
PID 1028 wrote to memory of 416	1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe	22
PID 1028 wrote to memory of 416	1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe	22
PID 1028 wrote to memory of 460	1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe	2
PID 1028 wrote to memory of 460	1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe	2
PID 1028 wrote to memory of 460	1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe	2
PID 1028 wrote to memory of 460	1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe	2
PID 1028 wrote to memory of 460	1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe	2
PID 1028 wrote to memory of 460	1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe	2
PID 1028 wrote to memory of 460	1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe	2
PID 1028 wrote to memory of 476	1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe	1
PID 1028 wrote to memory of 476	1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe	1
PID 1028 wrote to memory of 476	1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe	1
PID 1028 wrote to memory of 476	1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe	1
PID 1028 wrote to memory of 476	1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe	1
PID 1028 wrote to memory of 476	1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe	1
PID 1028 wrote to memory of 476	1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe	1
PID 1028 wrote to memory of 484	1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe	21
PID 1028 wrote to memory of 484	1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe	21
PID 1028 wrote to memory of 484	1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe	21
PID 1028 wrote to memory of 484	1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe	21
PID 1028 wrote to memory of 484	1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe	21
PID 1028 wrote to memory of 484	1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe	21
PID 1028 wrote to memory of 484	1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe	21
PID 1028 wrote to memory of 588	1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe	20
PID 1028 wrote to memory of 588	1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe	20
PID 1028 wrote to memory of 588	1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe	20
PID 1028 wrote to memory of 588	1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe	20
PID 1028 wrote to memory of 588	1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe	20
PID 1028 wrote to memory of 588	1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe	20
PID 1028 wrote to memory of 588	1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe	20
PID 1028 wrote to memory of 668	1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe	19
PID 1028 wrote to memory of 668	1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe	19
PID 1028 wrote to memory of 668	1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe	19
PID 1028 wrote to memory of 668	1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe	19
PID 1028 wrote to memory of 668	1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe	19
PID 1028 wrote to memory of 668	1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe	19
PID 1028 wrote to memory of 668	1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe	19
PID 1028 wrote to memory of 732	1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe	18
PID 1028 wrote to memory of 732	1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe	18
PID 1028 wrote to memory of 732	1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe	18
PID 1028 wrote to memory of 732	1028	501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe	18

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:476

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:460
- C:\Windows\system32\taskhost.exe
  "taskhost.exe"
  2⤵
  PID:1116
- C:\Windows\system32\sppsvc.exe
  C:\Windows\system32\sppsvc.exe
  2⤵
  PID:1720
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
  2⤵
  PID:964
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  2⤵
  PID:1076
- C:\Windows\System32\spoolsv.exe
  C:\Windows\System32\spoolsv.exe
  2⤵
  PID:748
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k NetworkService
  2⤵
  PID:324
- - C:\Windows\system32\wininit.exe
    wininit.exe
    3⤵
    PID:368
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  PID:888
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalService
  2⤵
  PID:848
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  2⤵
  PID:808
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:732
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:668
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  PID:588

\\?\C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:1596

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1268
- C:\Users\Admin\AppData\Local\Temp\501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe
  "C:\Users\Admin\AppData\Local\Temp\501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1028
- - C:\Users\Admin\AppData\Local\Temp\501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52Srv.exe
    C:\Users\Admin\AppData\Local\Temp\501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52Srv.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:1352

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1180

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
1⤵
PID:484

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:416

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:376

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\USERS\ADMIN\APPDATA\LOCAL\TEMP\501E223BB7727320A25236B2668F981EA7EFDBFA14BAB4D20BFFE36A5871AD52SRV.EXE

Filesize
84KB

MD5
05c98876d9dafcbc4dd3964a85cdd810

SHA1
94a13dc14daccdd701aeb6145bd67ce394d59407

SHA256
a00b8214c77002cb8385a08b2e70825c4ce24fc59a2d2b442d9b37bb8172b47e

SHA512
75ce593cdbc4881af3aec0896e052cef6553b589226a9099443b961939e7b5470abcf6bc6bea612a5f324b39dfb145583f28be9db075e5d9fa2692f06edaf875

Download Submit
C:\Users\Admin\AppData\Local\Temp\501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52Srv.exe

Filesize
84KB

MD5
05c98876d9dafcbc4dd3964a85cdd810

SHA1
94a13dc14daccdd701aeb6145bd67ce394d59407

SHA256
a00b8214c77002cb8385a08b2e70825c4ce24fc59a2d2b442d9b37bb8172b47e

SHA512
75ce593cdbc4881af3aec0896e052cef6553b589226a9099443b961939e7b5470abcf6bc6bea612a5f324b39dfb145583f28be9db075e5d9fa2692f06edaf875

Download Submit
\Users\Admin\AppData\Local\Temp\501e223bb7727320a25236b2668f981ea7efdbfa14bab4d20bffe36a5871ad52Srv.exe

Filesize
84KB

MD5
05c98876d9dafcbc4dd3964a85cdd810

SHA1
94a13dc14daccdd701aeb6145bd67ce394d59407

SHA256
a00b8214c77002cb8385a08b2e70825c4ce24fc59a2d2b442d9b37bb8172b47e

SHA512
75ce593cdbc4881af3aec0896e052cef6553b589226a9099443b961939e7b5470abcf6bc6bea612a5f324b39dfb145583f28be9db075e5d9fa2692f06edaf875

Download Submit
memory/1028-54-0x0000000075071000-0x0000000075073000-memory.dmp

Filesize
8KB

Download
memory/1028-62-0x0000000001000000-0x000000000102F000-memory.dmp

Filesize
188KB

Download
memory/1028-63-0x00000000001E0000-0x0000000000215000-memory.dmp

Filesize
212KB

Download
memory/1028-64-0x0000000001000000-0x000000000102F000-memory.dmp

Filesize
188KB

Download
memory/1352-56-0x0000000000000000-mapping.dmp

Download
memory/1352-60-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1352-61-0x000000007EFA0000-0x000000007EFAC000-memory.dmp

Filesize
48KB

Download