ramnit | ca8d515dbdf2dd1c4aac6a1068759f6305f78f5b48ffec9200d89b6f0c38333f

Analysis

max time kernel
144s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 13:03

Target

ca8d515dbdf2dd1c4aac6a1068759f6305f78f5b48ffec9200d89b6f0c38333f.dll
Size

280KB
MD5

07c5afde38b4670450af0410fe7168c2
SHA1

2a2c2a9a66733bd6cc62c4eccc94906d9dd2b139
SHA256

ca8d515dbdf2dd1c4aac6a1068759f6305f78f5b48ffec9200d89b6f0c38333f
SHA512

9750553366e836645ba5e69f1941919b98392e699ff3cd620ce913e2cf1d726c2b39189feb8cfecd2fb9f2bf67999a8164f9d4885718ce82ecf181d4e1fc6f06
SSDEEP

3072:ogKKuiX63bw5dNjDh8EWVgTlFIYpDS22ASP8Skbfy07l/ISlLsfAQqJb6vJo+RYT:pKZp3KNjVZvpDSPATfrzlLsoXWhopmLQ

Score

10^/10

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Executes dropped EXE 1 IoCs

pid	Process
4272	rundll32mgr.exe

Loads dropped DLL 1 IoCs

pid	Process
4272	rundll32mgr.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
692	4272	WerFault.exe	81

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 1984	1712	rundll32.exe	80
PID 1712 wrote to memory of 1984	1712	rundll32.exe	80
PID 1712 wrote to memory of 1984	1712	rundll32.exe	80
PID 1984 wrote to memory of 4272	1984	rundll32.exe	81
PID 1984 wrote to memory of 4272	1984	rundll32.exe	81
PID 1984 wrote to memory of 4272	1984	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ca8d515dbdf2dd1c4aac6a1068759f6305f78f5b48ffec9200d89b6f0c38333f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ca8d515dbdf2dd1c4aac6a1068759f6305f78f5b48ffec9200d89b6f0c38333f.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1984
- - C:\Windows\SysWOW64\rundll32mgr.exe
    C:\Windows\SysWOW64\rundll32mgr.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4272
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 372
      4⤵
      Program crash
      PID:692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4272 -ip 4272
1⤵
PID:4804

C:\Users\Admin\AppData\Local\Temp\~TMFBD9.tmp

Filesize
1.6MB

MD5
4f3387277ccbd6d1f21ac5c07fe4ca68

SHA1
e16506f662dc92023bf82def1d621497c8ab5890

SHA256
767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

SHA512
9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

Download Submit
C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
162KB

MD5
33cd65ebd943a41a3b65fa1ccfce067c

SHA1
715d78b89cadbbd517fec3a48f415e1dc00f92bb

SHA256
43c91f0a793c2776757ecec287a2d50cbf331d27f08aa559ffc160a417d3d1ae

SHA512
ea7c5b04eb5dd99ff38f7699cceef49680c094beab01751a92541e56293f7ecc3381aeca9a8863f95b75b548c0d02cf5127eaaf4cc1f784974981fade9ebeaf2

Download Submit
C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
162KB

MD5
33cd65ebd943a41a3b65fa1ccfce067c

SHA1
715d78b89cadbbd517fec3a48f415e1dc00f92bb

SHA256
43c91f0a793c2776757ecec287a2d50cbf331d27f08aa559ffc160a417d3d1ae

SHA512
ea7c5b04eb5dd99ff38f7699cceef49680c094beab01751a92541e56293f7ecc3381aeca9a8863f95b75b548c0d02cf5127eaaf4cc1f784974981fade9ebeaf2

Download Submit
memory/4272-137-0x0000000076EA0000-0x0000000077043000-memory.dmp

Filesize
1.6MB

Download
memory/4272-138-0x0000000000400000-0x0000000000489124-memory.dmp

Filesize
548KB

Download