ramnit | 752cddac5f9f06857dcccb28710548621e086c1a18f7321dd8560ecba4e50d46

General

Target

752cddac5f9f06857dcccb28710548621e086c1a18f7321dd8560ecba4e50d46.exe
Size

391KB
MD5

a17896b3ff7cb93f196dae908aa41e21
SHA1

911e2ed70a176912c9920116552ef910964dd17f
SHA256

752cddac5f9f06857dcccb28710548621e086c1a18f7321dd8560ecba4e50d46
SHA512

0e3e725534a5e713266e120a7e5544c7f06873d2eb9e8a7e54b003c582d3c797000b999cbfd96bbc01defc7f55ee2145959f3ac8c8a2bd58c62a3442d8914a90
SSDEEP

12288:bdd+HU/eddNkpf/t1jkv9wpizoTofAY7TNd9O:BdGU/evNkl/tpyGyoToIY7TM

Score

10^/10

ramnit banker spyware stealer trojan worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Executes dropped EXE 1 IoCs

pid	Process
1032	752cddac5f9f06857dcccb28710548621e086c1a18f7321dd8560ecba4e50d46mgr.exe

Loads dropped DLL 6 IoCs

pid	Process
1972	752cddac5f9f06857dcccb28710548621e086c1a18f7321dd8560ecba4e50d46.exe
1972	752cddac5f9f06857dcccb28710548621e086c1a18f7321dd8560ecba4e50d46.exe
1972	752cddac5f9f06857dcccb28710548621e086c1a18f7321dd8560ecba4e50d46.exe
1032	752cddac5f9f06857dcccb28710548621e086c1a18f7321dd8560ecba4e50d46mgr.exe
1972	752cddac5f9f06857dcccb28710548621e086c1a18f7321dd8560ecba4e50d46.exe
1032	752cddac5f9f06857dcccb28710548621e086c1a18f7321dd8560ecba4e50d46mgr.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1760	1972	WerFault.exe	27

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 1032	1972	752cddac5f9f06857dcccb28710548621e086c1a18f7321dd8560ecba4e50d46.exe	28
PID 1972 wrote to memory of 1032	1972	752cddac5f9f06857dcccb28710548621e086c1a18f7321dd8560ecba4e50d46.exe	28
PID 1972 wrote to memory of 1032	1972	752cddac5f9f06857dcccb28710548621e086c1a18f7321dd8560ecba4e50d46.exe	28
PID 1972 wrote to memory of 1032	1972	752cddac5f9f06857dcccb28710548621e086c1a18f7321dd8560ecba4e50d46.exe	28
PID 1972 wrote to memory of 1760	1972	752cddac5f9f06857dcccb28710548621e086c1a18f7321dd8560ecba4e50d46.exe	29
PID 1972 wrote to memory of 1760	1972	752cddac5f9f06857dcccb28710548621e086c1a18f7321dd8560ecba4e50d46.exe	29
PID 1972 wrote to memory of 1760	1972	752cddac5f9f06857dcccb28710548621e086c1a18f7321dd8560ecba4e50d46.exe	29
PID 1972 wrote to memory of 1760	1972	752cddac5f9f06857dcccb28710548621e086c1a18f7321dd8560ecba4e50d46.exe	29

C:\Users\Admin\AppData\Local\Temp\752cddac5f9f06857dcccb28710548621e086c1a18f7321dd8560ecba4e50d46.exe
"C:\Users\Admin\AppData\Local\Temp\752cddac5f9f06857dcccb28710548621e086c1a18f7321dd8560ecba4e50d46.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Users\Admin\AppData\Local\Temp\752cddac5f9f06857dcccb28710548621e086c1a18f7321dd8560ecba4e50d46mgr.exe
  C:\Users\Admin\AppData\Local\Temp\752cddac5f9f06857dcccb28710548621e086c1a18f7321dd8560ecba4e50d46mgr.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 168
  2⤵
  - Program crash
  PID:1760

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\752cddac5f9f06857dcccb28710548621e086c1a18f7321dd8560ecba4e50d46mgr.exe

Filesize
194KB

MD5
0e6b0d99b1880c3fd17121e3045ee987

SHA1
a394f7ed906853150cb931cbc61114979bb86ff2

SHA256
fa35d82bef5e0086c68b4c0237f642246ec1ce543e72cac76298f671202ff414

SHA512
387e40032dd8c12e87e38eebd59c256199b822aaf9ce71558d047431b969f7855ee74bd12a910463ca0b848f5757f3fd216f7e991f4bf7a6dc32227dae4797d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\752cddac5f9f06857dcccb28710548621e086c1a18f7321dd8560ecba4e50d46mgr.exe

Filesize
194KB

MD5
0e6b0d99b1880c3fd17121e3045ee987

SHA1
a394f7ed906853150cb931cbc61114979bb86ff2

SHA256
fa35d82bef5e0086c68b4c0237f642246ec1ce543e72cac76298f671202ff414

SHA512
387e40032dd8c12e87e38eebd59c256199b822aaf9ce71558d047431b969f7855ee74bd12a910463ca0b848f5757f3fd216f7e991f4bf7a6dc32227dae4797d2

Download Submit
\Users\Admin\AppData\Local\Temp\752cddac5f9f06857dcccb28710548621e086c1a18f7321dd8560ecba4e50d46mgr.exe

Filesize
194KB

MD5
0e6b0d99b1880c3fd17121e3045ee987

SHA1
a394f7ed906853150cb931cbc61114979bb86ff2

SHA256
fa35d82bef5e0086c68b4c0237f642246ec1ce543e72cac76298f671202ff414

SHA512
387e40032dd8c12e87e38eebd59c256199b822aaf9ce71558d047431b969f7855ee74bd12a910463ca0b848f5757f3fd216f7e991f4bf7a6dc32227dae4797d2

Download Submit
\Users\Admin\AppData\Local\Temp\752cddac5f9f06857dcccb28710548621e086c1a18f7321dd8560ecba4e50d46mgr.exe

Filesize
194KB

MD5
0e6b0d99b1880c3fd17121e3045ee987

SHA1
a394f7ed906853150cb931cbc61114979bb86ff2

SHA256
fa35d82bef5e0086c68b4c0237f642246ec1ce543e72cac76298f671202ff414

SHA512
387e40032dd8c12e87e38eebd59c256199b822aaf9ce71558d047431b969f7855ee74bd12a910463ca0b848f5757f3fd216f7e991f4bf7a6dc32227dae4797d2

Download Submit
\Users\Admin\AppData\Local\Temp\~TMEFAD.tmp

Filesize
1.2MB

MD5
d124f55b9393c976963407dff51ffa79

SHA1
2c7bbedd79791bfb866898c85b504186db610b5d

SHA256
ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef

SHA512
278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06

Download Submit
\Users\Admin\AppData\Local\Temp\~TMEFBC.tmp

Filesize
1.2MB

MD5
d124f55b9393c976963407dff51ffa79

SHA1
2c7bbedd79791bfb866898c85b504186db610b5d

SHA256
ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef

SHA512
278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06

Download Submit
\Users\Admin\AppData\Local\Temp\~TMF079.tmp

Filesize
1.1MB

MD5
9b98d47916ead4f69ef51b56b0c2323c

SHA1
290a80b4ded0efc0fd00816f373fcea81a521330

SHA256
96e0ae104c9662d0d20fdf59844c2d18334e5847b6c4fc7f8ce4b3b87f39887b

SHA512
68b67021f228d8d71df4deb0b6388558b2f935a6aa466a12199cd37ada47ee588ea407b278d190d3a498b0ef3f5f1a2573a469b7ea5561ab2e7055c45565fe94

Download Submit
\Users\Admin\AppData\Local\Temp\~TMF088.tmp

Filesize
1.1MB

MD5
9b98d47916ead4f69ef51b56b0c2323c

SHA1
290a80b4ded0efc0fd00816f373fcea81a521330

SHA256
96e0ae104c9662d0d20fdf59844c2d18334e5847b6c4fc7f8ce4b3b87f39887b

SHA512
68b67021f228d8d71df4deb0b6388558b2f935a6aa466a12199cd37ada47ee588ea407b278d190d3a498b0ef3f5f1a2573a469b7ea5561ab2e7055c45565fe94

Download Submit
memory/1032-65-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/1032-66-0x0000000077680000-0x0000000077800000-memory.dmp

Filesize
1.5MB

Download
memory/1972-59-0x0000000075501000-0x0000000075503000-memory.dmp

Filesize
8KB

Download
memory/1972-67-0x0000000000400000-0x00000000004C8000-memory.dmp

Filesize
800KB

Download
memory/1972-68-0x0000000000220000-0x00000000002B6000-memory.dmp

Filesize
600KB

Download
memory/1972-69-0x0000000077680000-0x0000000077800000-memory.dmp

Filesize
1.5MB

Download
memory/1972-71-0x0000000077680000-0x0000000077800000-memory.dmp

Filesize
1.5MB

Download
memory/1972-72-0x0000000000220000-0x00000000002B6000-memory.dmp

Filesize
600KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads