ramnit | 8768224c84bc9590e215b5dfc33b59ea65f2a4f7b11a703ab7a67a496879836f

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 12:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8768224c84bc9590e215b5dfc33b59ea65f2a4f7b11a703ab7a67a496879836f.dll
Size

586KB
MD5

42b242538b8377d94f5ce29d249a0da0
SHA1

3c1cef085dace5f2944b38c88233c86df99f4012
SHA256

8768224c84bc9590e215b5dfc33b59ea65f2a4f7b11a703ab7a67a496879836f
SHA512

6074a9298c479db9058323eb7d43331fa840cefc305f0b5490bef05c5b4e276f73ea541d1d3a4680c17c0bfdf2691733521464d3c683ca678a156a971834ce41
SSDEEP

12288:7ZUl2xuSZptCuORHvl4VSX8WGrxoSlhOvF+n:7ulBSZGuORPCAXR8Od+n

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Executes dropped EXE 1 IoCs

pid	Process
2036	rundll32Srv.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000c0000000054a8-56.dat	upx
behavioral1/files/0x000c0000000054a8-58.dat	upx
behavioral1/files/0x000c0000000054a8-61.dat	upx
behavioral1/memory/2036-62-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/1948-63-0x0000000075580000-0x0000000075616000-memory.dmp	upx

Loads dropped DLL 1 IoCs

pid	Process
1948	rundll32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32Srv.exe	rundll32.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	rundll32Srv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px5043.tmp	rundll32Srv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	rundll32Srv.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
956	1948	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2036	rundll32Srv.exe

Suspicious behavior: MapViewOfSection 24 IoCs

pid	Process
2036	rundll32Srv.exe
2036	rundll32Srv.exe
2036	rundll32Srv.exe
2036	rundll32Srv.exe
2036	rundll32Srv.exe
2036	rundll32Srv.exe
2036	rundll32Srv.exe
2036	rundll32Srv.exe
2036	rundll32Srv.exe
2036	rundll32Srv.exe
2036	rundll32Srv.exe
2036	rundll32Srv.exe
2036	rundll32Srv.exe
2036	rundll32Srv.exe
2036	rundll32Srv.exe
2036	rundll32Srv.exe
2036	rundll32Srv.exe
2036	rundll32Srv.exe
2036	rundll32Srv.exe
2036	rundll32Srv.exe
2036	rundll32Srv.exe
2036	rundll32Srv.exe
2036	rundll32Srv.exe
2036	rundll32Srv.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2036	rundll32Srv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 1948	536	rundll32.exe	27
PID 536 wrote to memory of 1948	536	rundll32.exe	27
PID 536 wrote to memory of 1948	536	rundll32.exe	27
PID 536 wrote to memory of 1948	536	rundll32.exe	27
PID 536 wrote to memory of 1948	536	rundll32.exe	27
PID 536 wrote to memory of 1948	536	rundll32.exe	27
PID 536 wrote to memory of 1948	536	rundll32.exe	27
PID 1948 wrote to memory of 2036	1948	rundll32.exe	28
PID 1948 wrote to memory of 2036	1948	rundll32.exe	28
PID 1948 wrote to memory of 2036	1948	rundll32.exe	28
PID 1948 wrote to memory of 2036	1948	rundll32.exe	28
PID 1948 wrote to memory of 956	1948	rundll32.exe	29
PID 1948 wrote to memory of 956	1948	rundll32.exe	29
PID 1948 wrote to memory of 956	1948	rundll32.exe	29
PID 1948 wrote to memory of 956	1948	rundll32.exe	29
PID 2036 wrote to memory of 368	2036	rundll32Srv.exe	5
PID 2036 wrote to memory of 368	2036	rundll32Srv.exe	5
PID 2036 wrote to memory of 368	2036	rundll32Srv.exe	5
PID 2036 wrote to memory of 368	2036	rundll32Srv.exe	5
PID 2036 wrote to memory of 368	2036	rundll32Srv.exe	5
PID 2036 wrote to memory of 368	2036	rundll32Srv.exe	5
PID 2036 wrote to memory of 376	2036	rundll32Srv.exe	4
PID 2036 wrote to memory of 376	2036	rundll32Srv.exe	4
PID 2036 wrote to memory of 376	2036	rundll32Srv.exe	4
PID 2036 wrote to memory of 376	2036	rundll32Srv.exe	4
PID 2036 wrote to memory of 376	2036	rundll32Srv.exe	4
PID 2036 wrote to memory of 376	2036	rundll32Srv.exe	4
PID 2036 wrote to memory of 416	2036	rundll32Srv.exe	3
PID 2036 wrote to memory of 416	2036	rundll32Srv.exe	3
PID 2036 wrote to memory of 416	2036	rundll32Srv.exe	3
PID 2036 wrote to memory of 416	2036	rundll32Srv.exe	3
PID 2036 wrote to memory of 416	2036	rundll32Srv.exe	3
PID 2036 wrote to memory of 416	2036	rundll32Srv.exe	3
PID 2036 wrote to memory of 460	2036	rundll32Srv.exe	2
PID 2036 wrote to memory of 460	2036	rundll32Srv.exe	2
PID 2036 wrote to memory of 460	2036	rundll32Srv.exe	2
PID 2036 wrote to memory of 460	2036	rundll32Srv.exe	2
PID 2036 wrote to memory of 460	2036	rundll32Srv.exe	2
PID 2036 wrote to memory of 460	2036	rundll32Srv.exe	2
PID 2036 wrote to memory of 476	2036	rundll32Srv.exe	1
PID 2036 wrote to memory of 476	2036	rundll32Srv.exe	1
PID 2036 wrote to memory of 476	2036	rundll32Srv.exe	1
PID 2036 wrote to memory of 476	2036	rundll32Srv.exe	1
PID 2036 wrote to memory of 476	2036	rundll32Srv.exe	1
PID 2036 wrote to memory of 476	2036	rundll32Srv.exe	1
PID 2036 wrote to memory of 484	2036	rundll32Srv.exe	25
PID 2036 wrote to memory of 484	2036	rundll32Srv.exe	25
PID 2036 wrote to memory of 484	2036	rundll32Srv.exe	25
PID 2036 wrote to memory of 484	2036	rundll32Srv.exe	25
PID 2036 wrote to memory of 484	2036	rundll32Srv.exe	25
PID 2036 wrote to memory of 484	2036	rundll32Srv.exe	25
PID 2036 wrote to memory of 600	2036	rundll32Srv.exe	24
PID 2036 wrote to memory of 600	2036	rundll32Srv.exe	24
PID 2036 wrote to memory of 600	2036	rundll32Srv.exe	24
PID 2036 wrote to memory of 600	2036	rundll32Srv.exe	24
PID 2036 wrote to memory of 600	2036	rundll32Srv.exe	24
PID 2036 wrote to memory of 600	2036	rundll32Srv.exe	24
PID 2036 wrote to memory of 676	2036	rundll32Srv.exe	23
PID 2036 wrote to memory of 676	2036	rundll32Srv.exe	23
PID 2036 wrote to memory of 676	2036	rundll32Srv.exe	23
PID 2036 wrote to memory of 676	2036	rundll32Srv.exe	23
PID 2036 wrote to memory of 676	2036	rundll32Srv.exe	23
PID 2036 wrote to memory of 676	2036	rundll32Srv.exe	23
PID 2036 wrote to memory of 756	2036	rundll32Srv.exe	22

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:476

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:460
- C:\Windows\system32\sppsvc.exe
  C:\Windows\system32\sppsvc.exe
  2⤵
  PID:1680
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
  2⤵
  PID:1644
- C:\Windows\system32\taskhost.exe
  "taskhost.exe"
  2⤵
  PID:1224
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  2⤵
  PID:1052
- C:\Windows\System32\spoolsv.exe
  C:\Windows\System32\spoolsv.exe
  2⤵
  PID:452
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k NetworkService
  2⤵
  PID:336
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  PID:888
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalService
  2⤵
  PID:844
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  2⤵
  PID:816
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:756
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:676
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  PID:600

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:416

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:376

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:368
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:484

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1340

\\?\C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:1136

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1396
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8768224c84bc9590e215b5dfc33b59ea65f2a4f7b11a703ab7a67a496879836f.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:536
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\8768224c84bc9590e215b5dfc33b59ea65f2a4f7b11a703ab7a67a496879836f.dll,#1
    3⤵
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:1948
  - - C:\Windows\SysWOW64\rundll32Srv.exe
      C:\Windows\SysWOW64\rundll32Srv.exe
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2036
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 240
      4⤵
      Program crash
      PID:956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\SYSWOW64\RUNDLL32SRV.EXE

Filesize
74KB

MD5
4833e415f5c05304094915bb97ca1803

SHA1
1c039ccf970460b9da694040f8756570703e5bf8

SHA256
b0a5b297db3caa6695b89cb6bc659c40d04eddcd0af5c681428ba5af92915798

SHA512
f3e3d40051f18ab5aec43050a98e1ddad500f7f3b083ddfd6628dfa47779a81141286e9195cc0310f410fc4c077c4857437a3b9f97e5362eb5b11bd18724ff12

Download Submit
C:\Windows\SysWOW64\rundll32Srv.exe

Filesize
74KB

MD5
4833e415f5c05304094915bb97ca1803

SHA1
1c039ccf970460b9da694040f8756570703e5bf8

SHA256
b0a5b297db3caa6695b89cb6bc659c40d04eddcd0af5c681428ba5af92915798

SHA512
f3e3d40051f18ab5aec43050a98e1ddad500f7f3b083ddfd6628dfa47779a81141286e9195cc0310f410fc4c077c4857437a3b9f97e5362eb5b11bd18724ff12

Download Submit
\Windows\SysWOW64\rundll32Srv.exe

Filesize
74KB

MD5
4833e415f5c05304094915bb97ca1803

SHA1
1c039ccf970460b9da694040f8756570703e5bf8

SHA256
b0a5b297db3caa6695b89cb6bc659c40d04eddcd0af5c681428ba5af92915798

SHA512
f3e3d40051f18ab5aec43050a98e1ddad500f7f3b083ddfd6628dfa47779a81141286e9195cc0310f410fc4c077c4857437a3b9f97e5362eb5b11bd18724ff12

Download Submit
memory/956-65-0x000000007EFA0000-0x000000007EFA9000-memory.dmp

Filesize
36KB

Download
memory/1948-64-0x00000000753F0000-0x0000000075486000-memory.dmp

Filesize
600KB

Download
memory/1948-63-0x0000000075580000-0x0000000075616000-memory.dmp

Filesize
600KB

Download
memory/1948-55-0x0000000076871000-0x0000000076873000-memory.dmp

Filesize
8KB

Download
memory/1948-66-0x0000000075580000-0x0000000075616000-memory.dmp

Filesize
600KB

Download
memory/1948-67-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2036-62-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download