ramnit | ef712a3bc4d407164b90e871a13fb8162c6649b8ae2cb9ab0f1ad1becb49decc

Analysis

max time kernel
151s
max time network
129s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 15:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ef712a3bc4d407164b90e871a13fb8162c6649b8ae2cb9ab0f1ad1becb49decc.exe
Size

123KB
MD5

82a10854ec4367256e19e8387a39af90
SHA1

e1398773ca84efd6cda8accd1d37590b292b4eee
SHA256

ef712a3bc4d407164b90e871a13fb8162c6649b8ae2cb9ab0f1ad1becb49decc
SHA512

e6f63ecf235f6e89dc2028e32586bc3e853680efb54e147a56006754e79b6ab825ea543bffb73e2138e536d33877caa3ab139af8c0e681136d108b4191305aab
SSDEEP

1536:zZnxm6MG9xgfrvEaoiT/GyphjXDYjKwttoswRmhApEC2v7i55XrUN:NnxwgxgfR/DVG7wBpEC2v7E7U

Score

10^/10

ramnit banker persistence spyware stealer trojan upx worm

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe"	svchost.exe

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Executes dropped EXE 1 IoCs

pid	Process
1756	WaterMark.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1356-56-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1356-57-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1356-62-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1756-68-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/memory/1756-70-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/memory/1756-190-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Loads dropped DLL 2 IoCs

pid	Process
1356	ef712a3bc4d407164b90e871a13fb8162c6649b8ae2cb9ab0f1ad1becb49decc.exe
1356	ef712a3bc4d407164b90e871a13fb8162c6649b8ae2cb9ab0f1ad1becb49decc.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\dmlconf.dat	svchost.exe
File created	C:\Windows\SysWOW64\dmlconf.dat	svchost.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\WaterMark.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.dll	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7z.dll	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxE293.tmp	ef712a3bc4d407164b90e871a13fb8162c6649b8ae2cb9ab0f1ad1becb49decc.exe
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	ef712a3bc4d407164b90e871a13fb8162c6649b8ae2cb9ab0f1ad1becb49decc.exe
File opened for modification	C:\Program Files (x86)\Microsoft\WaterMark.exe	ef712a3bc4d407164b90e871a13fb8162c6649b8ae2cb9ab0f1ad1becb49decc.exe
File opened for modification	C:\Program Files\7-Zip\7-zip32.dll	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	svchost.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
1756	WaterMark.exe
1756	WaterMark.exe
1756	WaterMark.exe
1756	WaterMark.exe
1756	WaterMark.exe
1756	WaterMark.exe
1756	WaterMark.exe
1756	WaterMark.exe
1264	svchost.exe
1264	svchost.exe
1264	svchost.exe
1264	svchost.exe
1264	svchost.exe
1264	svchost.exe
1264	svchost.exe
1264	svchost.exe
1264	svchost.exe
1264	svchost.exe
1264	svchost.exe
1264	svchost.exe
1264	svchost.exe
1264	svchost.exe
1264	svchost.exe
1264	svchost.exe
1264	svchost.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1756	WaterMark.exe
Token: SeDebugPrivilege	1264	svchost.exe
Token: SeDebugPrivilege	1756	WaterMark.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1356	ef712a3bc4d407164b90e871a13fb8162c6649b8ae2cb9ab0f1ad1becb49decc.exe
1756	WaterMark.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1356 wrote to memory of 1756	1356	ef712a3bc4d407164b90e871a13fb8162c6649b8ae2cb9ab0f1ad1becb49decc.exe	28
PID 1356 wrote to memory of 1756	1356	ef712a3bc4d407164b90e871a13fb8162c6649b8ae2cb9ab0f1ad1becb49decc.exe	28
PID 1356 wrote to memory of 1756	1356	ef712a3bc4d407164b90e871a13fb8162c6649b8ae2cb9ab0f1ad1becb49decc.exe	28
PID 1356 wrote to memory of 1756	1356	ef712a3bc4d407164b90e871a13fb8162c6649b8ae2cb9ab0f1ad1becb49decc.exe	28
PID 1756 wrote to memory of 1748	1756	WaterMark.exe	29
PID 1756 wrote to memory of 1748	1756	WaterMark.exe	29
PID 1756 wrote to memory of 1748	1756	WaterMark.exe	29
PID 1756 wrote to memory of 1748	1756	WaterMark.exe	29
PID 1756 wrote to memory of 1748	1756	WaterMark.exe	29
PID 1756 wrote to memory of 1748	1756	WaterMark.exe	29
PID 1756 wrote to memory of 1748	1756	WaterMark.exe	29
PID 1756 wrote to memory of 1748	1756	WaterMark.exe	29
PID 1756 wrote to memory of 1748	1756	WaterMark.exe	29
PID 1756 wrote to memory of 1748	1756	WaterMark.exe	29
PID 1756 wrote to memory of 1264	1756	WaterMark.exe	30
PID 1756 wrote to memory of 1264	1756	WaterMark.exe	30
PID 1756 wrote to memory of 1264	1756	WaterMark.exe	30
PID 1756 wrote to memory of 1264	1756	WaterMark.exe	30
PID 1756 wrote to memory of 1264	1756	WaterMark.exe	30
PID 1756 wrote to memory of 1264	1756	WaterMark.exe	30
PID 1756 wrote to memory of 1264	1756	WaterMark.exe	30
PID 1756 wrote to memory of 1264	1756	WaterMark.exe	30
PID 1756 wrote to memory of 1264	1756	WaterMark.exe	30
PID 1756 wrote to memory of 1264	1756	WaterMark.exe	30
PID 1264 wrote to memory of 260	1264	svchost.exe	27
PID 1264 wrote to memory of 260	1264	svchost.exe	27
PID 1264 wrote to memory of 260	1264	svchost.exe	27
PID 1264 wrote to memory of 260	1264	svchost.exe	27
PID 1264 wrote to memory of 260	1264	svchost.exe	27
PID 1264 wrote to memory of 332	1264	svchost.exe	6
PID 1264 wrote to memory of 332	1264	svchost.exe	6
PID 1264 wrote to memory of 332	1264	svchost.exe	6
PID 1264 wrote to memory of 332	1264	svchost.exe	6
PID 1264 wrote to memory of 332	1264	svchost.exe	6
PID 1264 wrote to memory of 368	1264	svchost.exe	5
PID 1264 wrote to memory of 368	1264	svchost.exe	5
PID 1264 wrote to memory of 368	1264	svchost.exe	5
PID 1264 wrote to memory of 368	1264	svchost.exe	5
PID 1264 wrote to memory of 368	1264	svchost.exe	5
PID 1264 wrote to memory of 380	1264	svchost.exe	4
PID 1264 wrote to memory of 380	1264	svchost.exe	4
PID 1264 wrote to memory of 380	1264	svchost.exe	4
PID 1264 wrote to memory of 380	1264	svchost.exe	4
PID 1264 wrote to memory of 380	1264	svchost.exe	4
PID 1264 wrote to memory of 416	1264	svchost.exe	3
PID 1264 wrote to memory of 416	1264	svchost.exe	3
PID 1264 wrote to memory of 416	1264	svchost.exe	3
PID 1264 wrote to memory of 416	1264	svchost.exe	3
PID 1264 wrote to memory of 416	1264	svchost.exe	3
PID 1264 wrote to memory of 460	1264	svchost.exe	2
PID 1264 wrote to memory of 460	1264	svchost.exe	2
PID 1264 wrote to memory of 460	1264	svchost.exe	2
PID 1264 wrote to memory of 460	1264	svchost.exe	2
PID 1264 wrote to memory of 460	1264	svchost.exe	2
PID 1264 wrote to memory of 476	1264	svchost.exe	1
PID 1264 wrote to memory of 476	1264	svchost.exe	1
PID 1264 wrote to memory of 476	1264	svchost.exe	1
PID 1264 wrote to memory of 476	1264	svchost.exe	1
PID 1264 wrote to memory of 476	1264	svchost.exe	1
PID 1264 wrote to memory of 484	1264	svchost.exe	26
PID 1264 wrote to memory of 484	1264	svchost.exe	26
PID 1264 wrote to memory of 484	1264	svchost.exe	26
PID 1264 wrote to memory of 484	1264	svchost.exe	26
PID 1264 wrote to memory of 484	1264	svchost.exe	26

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:476

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:460
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:752
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
  2⤵
  PID:1040
- C:\Windows\system32\sppsvc.exe
  C:\Windows\system32\sppsvc.exe
  2⤵
  PID:1636
- C:\Windows\system32\taskhost.exe
  "taskhost.exe"
  2⤵
  PID:1120
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  2⤵
  PID:1084
- C:\Windows\System32\spoolsv.exe
  C:\Windows\System32\spoolsv.exe
  2⤵
  PID:1016
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k NetworkService
  2⤵
  PID:284
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  PID:876
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalService
  2⤵
  PID:848
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  2⤵
  PID:808
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:668
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  PID:588

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:416

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:380

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:368
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:484

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:332

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
PID:1788

\\?\C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:2024

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1204
- C:\Users\Admin\AppData\Local\Temp\ef712a3bc4d407164b90e871a13fb8162c6649b8ae2cb9ab0f1ad1becb49decc.exe
  "C:\Users\Admin\AppData\Local\Temp\ef712a3bc4d407164b90e871a13fb8162c6649b8ae2cb9ab0f1ad1becb49decc.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:1356
- - C:\Program Files (x86)\Microsoft\WaterMark.exe
    "C:\Program Files (x86)\Microsoft\WaterMark.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of UnmapMainImage
    - Suspicious use of WriteProcessMemory
    PID:1756
  - - C:\Windows\SysWOW64\svchost.exe
      C:\Windows\system32\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Drops file in System32 directory
      Drops file in Program Files directory
      PID:1748
  - - C:\Windows\SysWOW64\svchost.exe
      C:\Windows\system32\svchost.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1264

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1176

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe
1⤵
PID:260

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\WaterMark.exe

Filesize
123KB

MD5
82a10854ec4367256e19e8387a39af90

SHA1
e1398773ca84efd6cda8accd1d37590b292b4eee

SHA256
ef712a3bc4d407164b90e871a13fb8162c6649b8ae2cb9ab0f1ad1becb49decc

SHA512
e6f63ecf235f6e89dc2028e32586bc3e853680efb54e147a56006754e79b6ab825ea543bffb73e2138e536d33877caa3ab139af8c0e681136d108b4191305aab

Download Submit
C:\Program Files (x86)\Microsoft\WaterMark.exe

Filesize
123KB

MD5
82a10854ec4367256e19e8387a39af90

SHA1
e1398773ca84efd6cda8accd1d37590b292b4eee

SHA256
ef712a3bc4d407164b90e871a13fb8162c6649b8ae2cb9ab0f1ad1becb49decc

SHA512
e6f63ecf235f6e89dc2028e32586bc3e853680efb54e147a56006754e79b6ab825ea543bffb73e2138e536d33877caa3ab139af8c0e681136d108b4191305aab

Download Submit
\Program Files (x86)\Microsoft\WaterMark.exe

Filesize
123KB

MD5
82a10854ec4367256e19e8387a39af90

SHA1
e1398773ca84efd6cda8accd1d37590b292b4eee

SHA256
ef712a3bc4d407164b90e871a13fb8162c6649b8ae2cb9ab0f1ad1becb49decc

SHA512
e6f63ecf235f6e89dc2028e32586bc3e853680efb54e147a56006754e79b6ab825ea543bffb73e2138e536d33877caa3ab139af8c0e681136d108b4191305aab

Download Submit
\Program Files (x86)\Microsoft\WaterMark.exe

Filesize
123KB

MD5
82a10854ec4367256e19e8387a39af90

SHA1
e1398773ca84efd6cda8accd1d37590b292b4eee

SHA256
ef712a3bc4d407164b90e871a13fb8162c6649b8ae2cb9ab0f1ad1becb49decc

SHA512
e6f63ecf235f6e89dc2028e32586bc3e853680efb54e147a56006754e79b6ab825ea543bffb73e2138e536d33877caa3ab139af8c0e681136d108b4191305aab

Download Submit
memory/1264-84-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/1264-81-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/1356-57-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1356-62-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1356-56-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1748-191-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/1748-74-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

Filesize
8KB

Download
memory/1748-75-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/1748-79-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/1748-71-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/1756-70-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1756-190-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1756-68-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download