ramnit | 45b4558bd8bccb4bd55dafc0c073e607f02d5c9ffd5d345e5e9ba37e1eb24cf3

Analysis

max time kernel
138s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 21:17

Target

45b4558bd8bccb4bd55dafc0c073e607f02d5c9ffd5d345e5e9ba37e1eb24cf3.dll
Size

815KB
MD5

0fe77eefea1c8429a003bdba47e4acd0
SHA1

1910da0778bc2cdbedc6867ea0bb5756d3e48046
SHA256

45b4558bd8bccb4bd55dafc0c073e607f02d5c9ffd5d345e5e9ba37e1eb24cf3
SHA512

f4cd6043bc3e7c6d1786641fd365592b240ab599189c1101df395d3083fe38d9fa1e1a36b6ea5abf98720a701752fc01eef3a672f09a94b07b351ba7752e0b1e
SSDEEP

12288:vNIyZN4+Wv4PLq6Okrh9ZN/hs9Dsdk1zZBUnQCEEhdjv7T6:v9TPmirh9Zdh6T1ChdL7u

Score

10^/10

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Executes dropped EXE 1 IoCs

pid	Process
3068	rundll32mgr.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3068-138-0x0000000000400000-0x0000000000481000-memory.dmp	upx

Loads dropped DLL 1 IoCs

pid	Process
3068	rundll32mgr.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
392	3068	WerFault.exe	82
4160	676	WerFault.exe	81

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 676	5048	rundll32.exe	81
PID 5048 wrote to memory of 676	5048	rundll32.exe	81
PID 5048 wrote to memory of 676	5048	rundll32.exe	81
PID 676 wrote to memory of 3068	676	rundll32.exe	82
PID 676 wrote to memory of 3068	676	rundll32.exe	82
PID 676 wrote to memory of 3068	676	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\45b4558bd8bccb4bd55dafc0c073e607f02d5c9ffd5d345e5e9ba37e1eb24cf3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\45b4558bd8bccb4bd55dafc0c073e607f02d5c9ffd5d345e5e9ba37e1eb24cf3.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:676
- - C:\Windows\SysWOW64\rundll32mgr.exe
    C:\Windows\SysWOW64\rundll32mgr.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3068
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 10176
      4⤵
      Program crash
      PID:392
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 676 -s 608
    3⤵
    - Program crash
    PID:4160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 676 -ip 676
1⤵
PID:3900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3068 -ip 3068
1⤵
PID:4272

C:\Users\Admin\AppData\Local\Temp\~TM7DDF.tmp

Filesize
1.6MB

MD5
4f3387277ccbd6d1f21ac5c07fe4ca68

SHA1
e16506f662dc92023bf82def1d621497c8ab5890

SHA256
767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

SHA512
9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

Download Submit
C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
230KB

MD5
b42f5caf5d8471c34605faac7f278571

SHA1
8baf865dee9f3011fb467afe0f22cfd5bb5c5d47

SHA256
38d89c5a881ec75d8f08139f374c8f7aa1aa22d0df211f31a82f9ef6fcb25d8c

SHA512
2ce01499790db18f53043638cca357363cf993cefbd050e32a7c2f802f5bd0c58bef62da35050b6faef713cc030277bdc90a44922618808dd1573ca35f0fcb44

Download Submit
C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
230KB

MD5
b42f5caf5d8471c34605faac7f278571

SHA1
8baf865dee9f3011fb467afe0f22cfd5bb5c5d47

SHA256
38d89c5a881ec75d8f08139f374c8f7aa1aa22d0df211f31a82f9ef6fcb25d8c

SHA512
2ce01499790db18f53043638cca357363cf993cefbd050e32a7c2f802f5bd0c58bef62da35050b6faef713cc030277bdc90a44922618808dd1573ca35f0fcb44

Download Submit
memory/676-137-0x0000000010000000-0x00000000100D2000-memory.dmp

Filesize
840KB

Download
memory/3068-138-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/3068-139-0x0000000002210000-0x0000000002291000-memory.dmp

Filesize
516KB

Download
memory/3068-140-0x0000000076EA0000-0x0000000077043000-memory.dmp

Filesize
1.6MB

Download