ramnit | c378cbc890fc6a622a5776cd5577438e3df8dff2a744b2d6fbe673fb032add37

General

Target

c378cbc890fc6a622a5776cd5577438e3df8dff2a744b2d6fbe673fb032add37.dll
Size

268KB
MD5

0ff3bd8fd6cea412f5369b5f6f9603b0
SHA1

9f92d416e263eefe8e55e1b7a5971db7272c6db4
SHA256

c378cbc890fc6a622a5776cd5577438e3df8dff2a744b2d6fbe673fb032add37
SHA512

0c91bfbf2cabadb0dc219bfc4a04ee74621132296045a102e43a63a796c8f9f2d309a1c03b748b4249bc8861d9714a971baa7de4bf32836f7ed2d30b549f4c35
SSDEEP

6144:6MJOWK4l0wqOVq1++gXR6wRiQLwCqRDooDS:62OWK4llcgDcCqRop

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Executes dropped EXE 1 IoCs

pid	Process
1532	rundll32mgr.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1532-138-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral2/memory/1532-139-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral2/memory/1532-140-0x0000000000400000-0x000000000041A000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

Modifies Internet Explorer settings 1 TTPs 25 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "374561808"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "37456826"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "37456826"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30995045"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{2D79C953-5E58-11ED-89AC-E62BBF623C53} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30995045"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1532	rundll32mgr.exe
1532	rundll32mgr.exe
1532	rundll32mgr.exe
1532	rundll32mgr.exe
1532	rundll32mgr.exe
1532	rundll32mgr.exe
1532	rundll32mgr.exe
1532	rundll32mgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3004	iexplore.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1532	rundll32mgr.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3004	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3004	iexplore.exe
3004	iexplore.exe
4828	IEXPLORE.EXE
4828	IEXPLORE.EXE
4828	IEXPLORE.EXE
4828	IEXPLORE.EXE

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1532	rundll32mgr.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3388 wrote to memory of 1564	3388	rundll32.exe	80
PID 3388 wrote to memory of 1564	3388	rundll32.exe	80
PID 3388 wrote to memory of 1564	3388	rundll32.exe	80
PID 1564 wrote to memory of 1532	1564	rundll32.exe	81
PID 1564 wrote to memory of 1532	1564	rundll32.exe	81
PID 1564 wrote to memory of 1532	1564	rundll32.exe	81
PID 1532 wrote to memory of 3004	1532	rundll32mgr.exe	82
PID 1532 wrote to memory of 3004	1532	rundll32mgr.exe	82
PID 3004 wrote to memory of 4828	3004	iexplore.exe	83
PID 3004 wrote to memory of 4828	3004	iexplore.exe	83
PID 3004 wrote to memory of 4828	3004	iexplore.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c378cbc890fc6a622a5776cd5577438e3df8dff2a744b2d6fbe673fb032add37.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3388
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c378cbc890fc6a622a5776cd5577438e3df8dff2a744b2d6fbe673fb032add37.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1564
- - C:\Windows\SysWOW64\rundll32mgr.exe
    C:\Windows\SysWOW64\rundll32mgr.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of UnmapMainImage
    - Suspicious use of WriteProcessMemory
    PID:1532
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      Modifies Internet Explorer settings
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3004
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3004 CREDAT:17410 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:4828

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
117KB

MD5
154e5aff25b80c5b181d1b7741d65463

SHA1
da8cc7b0591d0377be8fe057609c7072881e79f9

SHA256
bdebf8efd94bf27211e550c2f6083110b2902180ce1fa12daf559cd2fc3fdb1c

SHA512
e54f1d9beaea53bbbae1e1e22b6d62a8b8d76971fc458f7833b574e13d1733abdb9e994153debf576599587f9427fd6072382b255d064a566f4325cd9dd6d247

Download Submit
C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
117KB

MD5
154e5aff25b80c5b181d1b7741d65463

SHA1
da8cc7b0591d0377be8fe057609c7072881e79f9

SHA256
bdebf8efd94bf27211e550c2f6083110b2902180ce1fa12daf559cd2fc3fdb1c

SHA512
e54f1d9beaea53bbbae1e1e22b6d62a8b8d76971fc458f7833b574e13d1733abdb9e994153debf576599587f9427fd6072382b255d064a566f4325cd9dd6d247

Download Submit
memory/1532-138-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1532-139-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1532-140-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1564-141-0x0000000010000000-0x0000000010047000-memory.dmp

Filesize
284KB

Download

Analysis

Sharing