ramnit | cabe98852852377278d4b8cb15842c7c2be2a4475e88484a25c57a3ca452a30a

Analysis

max time kernel
136s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 20:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cabe98852852377278d4b8cb15842c7c2be2a4475e88484a25c57a3ca452a30a.exe
Size

168KB
MD5

068439c9580a9e79614a3369bc5f90b6
SHA1

a26e914e13a3b763063426dffdfca78f81d13860
SHA256

cabe98852852377278d4b8cb15842c7c2be2a4475e88484a25c57a3ca452a30a
SHA512

9d20ff0d3142eab99fe8708bc96896549c1c78df2ad2199823ec7ef895045cbe981bec83d3c94c94ba2fa5e860d7735f2de6d1ca6c58d562557dc6c094c23ae4
SSDEEP

3072:bIJUzBZnvulqw5cBPARA8+uCeQL+GrqaieHzQqr1I+qy6:bIJ4BNYFgPA2ue+Gr+OzQom+qT

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Executes dropped EXE 2 IoCs

pid	Process
1552	cabe98852852377278d4b8cb15842c7c2be2a4475e88484a25c57a3ca452a30amgr.exe
384	WaterMark.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1552-139-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1552-140-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1552-141-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/memory/1552-142-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/memory/1552-143-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/memory/1552-146-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/384-154-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/memory/384-155-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/memory/384-156-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/memory/384-157-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/memory/384-158-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/memory/384-159-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/memory/384-160-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\pxCB25.tmp	cabe98852852377278d4b8cb15842c7c2be2a4475e88484a25c57a3ca452a30amgr.exe
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	cabe98852852377278d4b8cb15842c7c2be2a4475e88484a25c57a3ca452a30amgr.exe
File opened for modification	C:\Program Files (x86)\Microsoft\WaterMark.exe	cabe98852852377278d4b8cb15842c7c2be2a4475e88484a25c57a3ca452a30amgr.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1508	4952	WerFault.exe	81

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30995044"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2407463085"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "374561615"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{B87777C9-5E57-11ED-AECB-D2A4FF929712} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2365744009"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2365744009"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30995044"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30995044"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
384	WaterMark.exe
384	WaterMark.exe
384	WaterMark.exe
384	WaterMark.exe
384	WaterMark.exe
384	WaterMark.exe
384	WaterMark.exe
384	WaterMark.exe
384	WaterMark.exe
384	WaterMark.exe
384	WaterMark.exe
384	WaterMark.exe
384	WaterMark.exe
384	WaterMark.exe
384	WaterMark.exe
384	WaterMark.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1108	iexplore.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	384	WaterMark.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1108	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1108	iexplore.exe
1108	iexplore.exe
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1552	cabe98852852377278d4b8cb15842c7c2be2a4475e88484a25c57a3ca452a30amgr.exe
384	WaterMark.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 1552	1092	cabe98852852377278d4b8cb15842c7c2be2a4475e88484a25c57a3ca452a30a.exe	79
PID 1092 wrote to memory of 1552	1092	cabe98852852377278d4b8cb15842c7c2be2a4475e88484a25c57a3ca452a30a.exe	79
PID 1092 wrote to memory of 1552	1092	cabe98852852377278d4b8cb15842c7c2be2a4475e88484a25c57a3ca452a30a.exe	79
PID 1552 wrote to memory of 384	1552	cabe98852852377278d4b8cb15842c7c2be2a4475e88484a25c57a3ca452a30amgr.exe	80
PID 1552 wrote to memory of 384	1552	cabe98852852377278d4b8cb15842c7c2be2a4475e88484a25c57a3ca452a30amgr.exe	80
PID 1552 wrote to memory of 384	1552	cabe98852852377278d4b8cb15842c7c2be2a4475e88484a25c57a3ca452a30amgr.exe	80
PID 384 wrote to memory of 4952	384	WaterMark.exe	81
PID 384 wrote to memory of 4952	384	WaterMark.exe	81
PID 384 wrote to memory of 4952	384	WaterMark.exe	81
PID 384 wrote to memory of 4952	384	WaterMark.exe	81
PID 384 wrote to memory of 4952	384	WaterMark.exe	81
PID 384 wrote to memory of 4952	384	WaterMark.exe	81
PID 384 wrote to memory of 4952	384	WaterMark.exe	81
PID 384 wrote to memory of 4952	384	WaterMark.exe	81
PID 384 wrote to memory of 4952	384	WaterMark.exe	81
PID 384 wrote to memory of 1108	384	WaterMark.exe	84
PID 384 wrote to memory of 1108	384	WaterMark.exe	84
PID 384 wrote to memory of 4804	384	WaterMark.exe	85
PID 384 wrote to memory of 4804	384	WaterMark.exe	85
PID 1108 wrote to memory of 2556	1108	iexplore.exe	87
PID 1108 wrote to memory of 2556	1108	iexplore.exe	87
PID 1108 wrote to memory of 2556	1108	iexplore.exe	87

C:\Users\Admin\AppData\Local\Temp\cabe98852852377278d4b8cb15842c7c2be2a4475e88484a25c57a3ca452a30a.exe
"C:\Users\Admin\AppData\Local\Temp\cabe98852852377278d4b8cb15842c7c2be2a4475e88484a25c57a3ca452a30a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Users\Admin\AppData\Local\Temp\cabe98852852377278d4b8cb15842c7c2be2a4475e88484a25c57a3ca452a30amgr.exe
  C:\Users\Admin\AppData\Local\Temp\cabe98852852377278d4b8cb15842c7c2be2a4475e88484a25c57a3ca452a30amgr.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:1552
- - C:\Program Files (x86)\Microsoft\WaterMark.exe
    "C:\Program Files (x86)\Microsoft\WaterMark.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of UnmapMainImage
    - Suspicious use of WriteProcessMemory
    PID:384
  - - C:\Windows\SysWOW64\svchost.exe
      C:\Windows\system32\svchost.exe
      4⤵
      PID:4952
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4952 -s 204
        5⤵
        Program crash
        
        PID:1508
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      Modifies Internet Explorer settings
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1108
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1108 CREDAT:17410 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2556
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      Modifies Internet Explorer settings
      PID:4804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4952 -ip 4952
1⤵
PID:3664

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\WaterMark.exe

Filesize
60KB

MD5
cd963c64ad0bea4ca85a4819f6eefed1

SHA1
d9cd6316cf3c6ce5ceec9694c2debc7b7981775f

SHA256
33c4b715dc8b183dff9aac65cc42c7f2c70658580b8e3d449878251482a5d906

SHA512
f7cd12c57eff3acf7c89b0e7b55dfa81623618a65d6c49b490c199cfe63ae9e858f2681c8ef1425d1e4b25f7b0bbd6d4a9d9788956c23f52fece3d5d79b5907e

Download Submit
C:\Program Files (x86)\Microsoft\WaterMark.exe

Filesize
60KB

MD5
cd963c64ad0bea4ca85a4819f6eefed1

SHA1
d9cd6316cf3c6ce5ceec9694c2debc7b7981775f

SHA256
33c4b715dc8b183dff9aac65cc42c7f2c70658580b8e3d449878251482a5d906

SHA512
f7cd12c57eff3acf7c89b0e7b55dfa81623618a65d6c49b490c199cfe63ae9e858f2681c8ef1425d1e4b25f7b0bbd6d4a9d9788956c23f52fece3d5d79b5907e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
0ef90204485649be625ea2be1b9018fb

SHA1
28fbc0852140ec51d0c097a4962a160afa4d754b

SHA256
c8028acd9a8c8c795b87cf835fc3182d003264608f161baa0ca020711b22bca0

SHA512
b8bbba0dcc6cb6f87efb47a605953c93fcf93c5a65520b822ebfee25754632d6bb66c2a946f457e1e40a92556683ddb9d14f2703782833e12d7e37bb3b7fcec5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
434B

MD5
92582183207d5e787e09587d76ae84e4

SHA1
63f06d4f1eb5511f28cd25cd7d4091cde5ea354b

SHA256
db2c2f9cc49c82632d68f7da7f331590e03dea492eae52bfbcbe7a30c2f93b97

SHA512
58c64d5cd002211bff2c0923fe6c951b450e112c3601388a81993300bc043552fb6865a55a45caba197a6d44c019218473d76b70303a840fb79df46f2205a89d

Download Submit
C:\Users\Admin\AppData\Local\Temp\cabe98852852377278d4b8cb15842c7c2be2a4475e88484a25c57a3ca452a30amgr.exe

Filesize
60KB

MD5
cd963c64ad0bea4ca85a4819f6eefed1

SHA1
d9cd6316cf3c6ce5ceec9694c2debc7b7981775f

SHA256
33c4b715dc8b183dff9aac65cc42c7f2c70658580b8e3d449878251482a5d906

SHA512
f7cd12c57eff3acf7c89b0e7b55dfa81623618a65d6c49b490c199cfe63ae9e858f2681c8ef1425d1e4b25f7b0bbd6d4a9d9788956c23f52fece3d5d79b5907e

Download Submit
C:\Users\Admin\AppData\Local\Temp\cabe98852852377278d4b8cb15842c7c2be2a4475e88484a25c57a3ca452a30amgr.exe

Filesize
60KB

MD5
cd963c64ad0bea4ca85a4819f6eefed1

SHA1
d9cd6316cf3c6ce5ceec9694c2debc7b7981775f

SHA256
33c4b715dc8b183dff9aac65cc42c7f2c70658580b8e3d449878251482a5d906

SHA512
f7cd12c57eff3acf7c89b0e7b55dfa81623618a65d6c49b490c199cfe63ae9e858f2681c8ef1425d1e4b25f7b0bbd6d4a9d9788956c23f52fece3d5d79b5907e

Download Submit
memory/384-157-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/384-160-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/384-159-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/384-158-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/384-155-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/384-156-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/384-154-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1092-132-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1092-136-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1552-140-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1552-146-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1552-143-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1552-142-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1552-141-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1552-139-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download