ramnit | 7744f61231cb7e5ac3093cfe009560211c016e471f3e859126add008f8680f82

Analysis

max time kernel
39s
max time network
75s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28/10/2022, 20:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7744f61231cb7e5ac3093cfe009560211c016e471f3e859126add008f8680f82.exe
Size

248KB
MD5

0ab84866d2dba35371a0bbd2a55b4094
SHA1

299f98a9a0877415835a57f078ca0a8139207d88
SHA256

7744f61231cb7e5ac3093cfe009560211c016e471f3e859126add008f8680f82
SHA512

8a384d551b85284f77ef87490db078127a32157f7e7a31f0522927db4fed78a37215eabd13999c9e0d516517affe905ffde067892af10dfe6a653a88a5a786e1
SSDEEP

3072:IJLrp0cQ7QAINqPDHQnc9ZoFHjc2Ngw2ShHUM5TQQcgLT3COGGy75qOgdebNlCBT:ILO7QAIS9eDcOXTQjgLT6DqTJehkZn

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Executes dropped EXE 1 IoCs

pid	Process
1548	7744f61231cb7e5ac3093cfe009560211c016e471f3e859126add008f8680f82mgr.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1548-68-0x0000000000400000-0x000000000046B000-memory.dmp	upx

Loads dropped DLL 7 IoCs

pid	Process
1004	7744f61231cb7e5ac3093cfe009560211c016e471f3e859126add008f8680f82.exe
1004	7744f61231cb7e5ac3093cfe009560211c016e471f3e859126add008f8680f82.exe
1548	7744f61231cb7e5ac3093cfe009560211c016e471f3e859126add008f8680f82mgr.exe
1548	7744f61231cb7e5ac3093cfe009560211c016e471f3e859126add008f8680f82mgr.exe
1548	7744f61231cb7e5ac3093cfe009560211c016e471f3e859126add008f8680f82mgr.exe
1548	7744f61231cb7e5ac3093cfe009560211c016e471f3e859126add008f8680f82mgr.exe
1548	7744f61231cb7e5ac3093cfe009560211c016e471f3e859126add008f8680f82mgr.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1004 wrote to memory of 1548	1004	7744f61231cb7e5ac3093cfe009560211c016e471f3e859126add008f8680f82.exe	20
PID 1004 wrote to memory of 1548	1004	7744f61231cb7e5ac3093cfe009560211c016e471f3e859126add008f8680f82.exe	20
PID 1004 wrote to memory of 1548	1004	7744f61231cb7e5ac3093cfe009560211c016e471f3e859126add008f8680f82.exe	20
PID 1004 wrote to memory of 1548	1004	7744f61231cb7e5ac3093cfe009560211c016e471f3e859126add008f8680f82.exe	20
PID 1004 wrote to memory of 1548	1004	7744f61231cb7e5ac3093cfe009560211c016e471f3e859126add008f8680f82.exe	20
PID 1004 wrote to memory of 1548	1004	7744f61231cb7e5ac3093cfe009560211c016e471f3e859126add008f8680f82.exe	20
PID 1004 wrote to memory of 1548	1004	7744f61231cb7e5ac3093cfe009560211c016e471f3e859126add008f8680f82.exe	20

C:\Users\Admin\AppData\Local\Temp\7744f61231cb7e5ac3093cfe009560211c016e471f3e859126add008f8680f82.exe
"C:\Users\Admin\AppData\Local\Temp\7744f61231cb7e5ac3093cfe009560211c016e471f3e859126add008f8680f82.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1004
- C:\Users\Admin\AppData\Local\Temp\7744f61231cb7e5ac3093cfe009560211c016e471f3e859126add008f8680f82mgr.exe
  C:\Users\Admin\AppData\Local\Temp\7744f61231cb7e5ac3093cfe009560211c016e471f3e859126add008f8680f82mgr.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1548

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7744f61231cb7e5ac3093cfe009560211c016e471f3e859126add008f8680f82mgr.exe

Filesize
169KB

MD5
335f0aeb047ac7782090828b5d4fa10e

SHA1
73355b1c843bec7be94b0a39efb5ff3b1b4ee547

SHA256
6df4c841c30d414cfee93573963036abfd669627081705c6a0d9e65fd6846f53

SHA512
635d1e473a0f2cebad020f80e211b55bcb12742ddde1e65db182b077c8873f639b491ab8d11a6781095cf16729e03f93696514de72b58efad8157fad3ff399f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\7744f61231cb7e5ac3093cfe009560211c016e471f3e859126add008f8680f82mgr.exe

Filesize
169KB

MD5
335f0aeb047ac7782090828b5d4fa10e

SHA1
73355b1c843bec7be94b0a39efb5ff3b1b4ee547

SHA256
6df4c841c30d414cfee93573963036abfd669627081705c6a0d9e65fd6846f53

SHA512
635d1e473a0f2cebad020f80e211b55bcb12742ddde1e65db182b077c8873f639b491ab8d11a6781095cf16729e03f93696514de72b58efad8157fad3ff399f1

Download Submit
\Users\Admin\AppData\Local\Temp\7744f61231cb7e5ac3093cfe009560211c016e471f3e859126add008f8680f82mgr.exe

Filesize
169KB

MD5
335f0aeb047ac7782090828b5d4fa10e

SHA1
73355b1c843bec7be94b0a39efb5ff3b1b4ee547

SHA256
6df4c841c30d414cfee93573963036abfd669627081705c6a0d9e65fd6846f53

SHA512
635d1e473a0f2cebad020f80e211b55bcb12742ddde1e65db182b077c8873f639b491ab8d11a6781095cf16729e03f93696514de72b58efad8157fad3ff399f1

Download Submit
\Users\Admin\AppData\Local\Temp\7744f61231cb7e5ac3093cfe009560211c016e471f3e859126add008f8680f82mgr.exe

Filesize
169KB

MD5
335f0aeb047ac7782090828b5d4fa10e

SHA1
73355b1c843bec7be94b0a39efb5ff3b1b4ee547

SHA256
6df4c841c30d414cfee93573963036abfd669627081705c6a0d9e65fd6846f53

SHA512
635d1e473a0f2cebad020f80e211b55bcb12742ddde1e65db182b077c8873f639b491ab8d11a6781095cf16729e03f93696514de72b58efad8157fad3ff399f1

Download Submit
\Users\Admin\AppData\Local\Temp\7744f61231cb7e5ac3093cfe009560211c016e471f3e859126add008f8680f82mgr.exe

Filesize
169KB

MD5
335f0aeb047ac7782090828b5d4fa10e

SHA1
73355b1c843bec7be94b0a39efb5ff3b1b4ee547

SHA256
6df4c841c30d414cfee93573963036abfd669627081705c6a0d9e65fd6846f53

SHA512
635d1e473a0f2cebad020f80e211b55bcb12742ddde1e65db182b077c8873f639b491ab8d11a6781095cf16729e03f93696514de72b58efad8157fad3ff399f1

Download Submit
\Users\Admin\AppData\Local\Temp\7744f61231cb7e5ac3093cfe009560211c016e471f3e859126add008f8680f82mgr.exe

Filesize
169KB

MD5
335f0aeb047ac7782090828b5d4fa10e

SHA1
73355b1c843bec7be94b0a39efb5ff3b1b4ee547

SHA256
6df4c841c30d414cfee93573963036abfd669627081705c6a0d9e65fd6846f53

SHA512
635d1e473a0f2cebad020f80e211b55bcb12742ddde1e65db182b077c8873f639b491ab8d11a6781095cf16729e03f93696514de72b58efad8157fad3ff399f1

Download Submit
\Users\Admin\AppData\Local\Temp\7744f61231cb7e5ac3093cfe009560211c016e471f3e859126add008f8680f82mgr.exe

Filesize
169KB

MD5
335f0aeb047ac7782090828b5d4fa10e

SHA1
73355b1c843bec7be94b0a39efb5ff3b1b4ee547

SHA256
6df4c841c30d414cfee93573963036abfd669627081705c6a0d9e65fd6846f53

SHA512
635d1e473a0f2cebad020f80e211b55bcb12742ddde1e65db182b077c8873f639b491ab8d11a6781095cf16729e03f93696514de72b58efad8157fad3ff399f1

Download Submit
\Users\Admin\AppData\Local\Temp\~TMFD72.tmp

Filesize
1.2MB

MD5
9363a58dd4bc8ece9b165e421f9845c9

SHA1
f7b0942f303fd0208395b79b9e95566f196269bc

SHA256
3491ceaf8bbe3cafa9d3b9939ff9204b40f0f9f561f6be1546e71665693d33d3

SHA512
c5a95466413369018719216301162920ba5c61eab75846819aff297d240c400ccc995f4fb3c83d39bfcfd8857ad71a06e63de91bc5c0c4ef5ed373c9b8687b25

Download Submit
\Users\Admin\AppData\Local\Temp\~TMFD93.tmp

Filesize
1.1MB

MD5
9b98d47916ead4f69ef51b56b0c2323c

SHA1
290a80b4ded0efc0fd00816f373fcea81a521330

SHA256
96e0ae104c9662d0d20fdf59844c2d18334e5847b6c4fc7f8ce4b3b87f39887b

SHA512
68b67021f228d8d71df4deb0b6388558b2f935a6aa466a12199cd37ada47ee588ea407b278d190d3a498b0ef3f5f1a2573a469b7ea5561ab2e7055c45565fe94

Download Submit
memory/1004-54-0x0000000075211000-0x0000000075213000-memory.dmp

Filesize
8KB

Download
memory/1004-60-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1548-67-0x0000000000280000-0x00000000002EB000-memory.dmp

Filesize
428KB

Download
memory/1548-69-0x0000000077610000-0x0000000077790000-memory.dmp

Filesize
1.5MB

Download
memory/1548-68-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download