ramnit | 756ab510af20dfccf570f69c512c47c0d7a1ea7bd80e3000a677d67fc2cda7a9

Analysis

max time kernel
138s
max time network
142s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06-11-2022 12:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

756ab510af20dfccf570f69c512c47c0d7a1ea7bd80e3000a677d67fc2cda7a9.dll
Size

591KB
MD5

0dd46fd92d967946d1386cdae042122f
SHA1

5d8fb167da54d1acd431dae10f6f82b7bab1c997
SHA256

756ab510af20dfccf570f69c512c47c0d7a1ea7bd80e3000a677d67fc2cda7a9
SHA512

2ed32f3c4929eee36c3061e2ece9b0d2c8bd1a02a12513dd30ce173b7d9899f98f7c62e29d0ab83e322e5cba1db2731d8772d8af9800ab97f24c06326994c8eb
SSDEEP

12288:NJfSgmM68GLj6kGnl17CLmxUuB+rmq+0PtPj4L7domwyuQbl2T5SC:NhSl3j6kJmxVO+0lPY7domx6QC

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Executes dropped EXE 1 IoCs

pid	Process
2036	rundll32mgr.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0008000000005c51-56.dat	upx
behavioral1/files/0x0008000000005c51-59.dat	upx
behavioral1/files/0x0008000000005c51-57.dat	upx
behavioral1/memory/2036-63-0x0000000000400000-0x0000000000489000-memory.dmp	upx
behavioral1/memory/2036-66-0x0000000000400000-0x0000000000489000-memory.dmp	upx
behavioral1/memory/2036-68-0x0000000000400000-0x0000000000489000-memory.dmp	upx

Loads dropped DLL 2 IoCs

pid	Process
2008	rundll32.exe
2008	rundll32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1304	2008	WerFault.exe	27

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "374510989"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DA5A4071-5DE1-11ED-9FD0-D6EA6736E294} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff5600000000000000dc04000065020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff6f00000019000000f50400007e020000	iexplore.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2036	rundll32mgr.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
568	iexplore.exe
568	iexplore.exe
568	iexplore.exe
568	iexplore.exe

Suspicious use of SetWindowsHookEx 22 IoCs

pid	Process
568	iexplore.exe
568	iexplore.exe
1552	IEXPLORE.EXE
1552	IEXPLORE.EXE
1552	IEXPLORE.EXE
1552	IEXPLORE.EXE
568	iexplore.exe
568	iexplore.exe
1348	IEXPLORE.EXE
1348	IEXPLORE.EXE
1348	IEXPLORE.EXE
1348	IEXPLORE.EXE
568	iexplore.exe
568	iexplore.exe
568	iexplore.exe
568	iexplore.exe
1076	IEXPLORE.EXE
1076	IEXPLORE.EXE
1104	IEXPLORE.EXE
1104	IEXPLORE.EXE
1076	IEXPLORE.EXE
1076	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 2008	900	rundll32.exe	27
PID 900 wrote to memory of 2008	900	rundll32.exe	27
PID 900 wrote to memory of 2008	900	rundll32.exe	27
PID 900 wrote to memory of 2008	900	rundll32.exe	27
PID 900 wrote to memory of 2008	900	rundll32.exe	27
PID 900 wrote to memory of 2008	900	rundll32.exe	27
PID 900 wrote to memory of 2008	900	rundll32.exe	27
PID 2008 wrote to memory of 2036	2008	rundll32.exe	28
PID 2008 wrote to memory of 2036	2008	rundll32.exe	28
PID 2008 wrote to memory of 2036	2008	rundll32.exe	28
PID 2008 wrote to memory of 2036	2008	rundll32.exe	28
PID 2008 wrote to memory of 1304	2008	rundll32.exe	29
PID 2008 wrote to memory of 1304	2008	rundll32.exe	29
PID 2008 wrote to memory of 1304	2008	rundll32.exe	29
PID 2008 wrote to memory of 1304	2008	rundll32.exe	29
PID 2036 wrote to memory of 568	2036	rundll32mgr.exe	30
PID 2036 wrote to memory of 568	2036	rundll32mgr.exe	30
PID 2036 wrote to memory of 568	2036	rundll32mgr.exe	30
PID 2036 wrote to memory of 568	2036	rundll32mgr.exe	30
PID 568 wrote to memory of 1552	568	iexplore.exe	32
PID 568 wrote to memory of 1552	568	iexplore.exe	32
PID 568 wrote to memory of 1552	568	iexplore.exe	32
PID 568 wrote to memory of 1552	568	iexplore.exe	32
PID 2036 wrote to memory of 968	2036	rundll32mgr.exe	33
PID 2036 wrote to memory of 968	2036	rundll32mgr.exe	33
PID 2036 wrote to memory of 968	2036	rundll32mgr.exe	33
PID 2036 wrote to memory of 968	2036	rundll32mgr.exe	33
PID 568 wrote to memory of 1348	568	iexplore.exe	34
PID 568 wrote to memory of 1348	568	iexplore.exe	34
PID 568 wrote to memory of 1348	568	iexplore.exe	34
PID 568 wrote to memory of 1348	568	iexplore.exe	34
PID 2036 wrote to memory of 1700	2036	rundll32mgr.exe	36
PID 2036 wrote to memory of 1700	2036	rundll32mgr.exe	36
PID 2036 wrote to memory of 1700	2036	rundll32mgr.exe	36
PID 2036 wrote to memory of 1700	2036	rundll32mgr.exe	36
PID 2036 wrote to memory of 1564	2036	rundll32mgr.exe	37
PID 2036 wrote to memory of 1564	2036	rundll32mgr.exe	37
PID 2036 wrote to memory of 1564	2036	rundll32mgr.exe	37
PID 2036 wrote to memory of 1564	2036	rundll32mgr.exe	37
PID 568 wrote to memory of 1104	568	iexplore.exe	38
PID 568 wrote to memory of 1104	568	iexplore.exe	38
PID 568 wrote to memory of 1104	568	iexplore.exe	38
PID 568 wrote to memory of 1104	568	iexplore.exe	38
PID 568 wrote to memory of 1076	568	iexplore.exe	39
PID 568 wrote to memory of 1076	568	iexplore.exe	39
PID 568 wrote to memory of 1076	568	iexplore.exe	39
PID 568 wrote to memory of 1076	568	iexplore.exe	39

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\756ab510af20dfccf570f69c512c47c0d7a1ea7bd80e3000a677d67fc2cda7a9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\756ab510af20dfccf570f69c512c47c0d7a1ea7bd80e3000a677d67fc2cda7a9.dll,#1
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2008
- - C:\Windows\SysWOW64\rundll32mgr.exe
    C:\Windows\SysWOW64\rundll32mgr.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2036
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:568
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:568 CREDAT:275457 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1552
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:568 CREDAT:209934 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1348
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:568 CREDAT:603145 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1104
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:568 CREDAT:799753 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1076
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      PID:968
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      PID:1700
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      PID:1564
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 240
    3⤵
    - Program crash
    PID:1304

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\WYMEG11W.txt

Filesize
608B

MD5
b6256f855ba780ea98800ed5a08fa67b

SHA1
6bfc7d790831f33f38eaf0d6ec12019543cb24f9

SHA256
17ccf124c9651c263bb157d6f49149987f6b17e47525afab502e794cddbf127d

SHA512
23c2bb4391bbffe5bfab4d89176dc4acc46ccecda98f089b3dc129795cb55e1b4619baf911253954b48c3ad7674e1118cdb8c709b3bd75756f1f7aaf1e46603e

Download Submit
C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
204KB

MD5
053349d7ad422a413294766d79fc0b14

SHA1
b3bd239f6d8de5d82945d4063161b06ff932ac67

SHA256
2aae02cbc873fd41602e7f69427602d3c7062ad62bf0cdb64df3502cc372905c

SHA512
3f6ae5958dff78194f1a730db94603bd0d88aa9a33c8ffb62dbe3a1b583b86b638bc017b9cb2a2f368815e00750e12d80be287ac77f4a15afbb7603fee1c154e

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
204KB

MD5
053349d7ad422a413294766d79fc0b14

SHA1
b3bd239f6d8de5d82945d4063161b06ff932ac67

SHA256
2aae02cbc873fd41602e7f69427602d3c7062ad62bf0cdb64df3502cc372905c

SHA512
3f6ae5958dff78194f1a730db94603bd0d88aa9a33c8ffb62dbe3a1b583b86b638bc017b9cb2a2f368815e00750e12d80be287ac77f4a15afbb7603fee1c154e

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
204KB

MD5
053349d7ad422a413294766d79fc0b14

SHA1
b3bd239f6d8de5d82945d4063161b06ff932ac67

SHA256
2aae02cbc873fd41602e7f69427602d3c7062ad62bf0cdb64df3502cc372905c

SHA512
3f6ae5958dff78194f1a730db94603bd0d88aa9a33c8ffb62dbe3a1b583b86b638bc017b9cb2a2f368815e00750e12d80be287ac77f4a15afbb7603fee1c154e

Download Submit
memory/1304-60-0x0000000000000000-mapping.dmp

Download
memory/2008-55-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

Filesize
8KB

Download
memory/2008-54-0x0000000000000000-mapping.dmp

Download
memory/2008-61-0x0000000010000000-0x000000001018E000-memory.dmp

Filesize
1.6MB

Download
memory/2008-62-0x0000000000430000-0x00000000004B9000-memory.dmp

Filesize
548KB

Download
memory/2036-58-0x0000000000000000-mapping.dmp

Download
memory/2036-64-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download
memory/2036-66-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/2036-63-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/2036-68-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download