ramnit | 9bac8e1e755f20031d9b19e24f6c76eb50aaf8978fefa06713849b76c9217a06

Analysis

max time kernel
47s
max time network
53s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06/11/2022, 20:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9bac8e1e755f20031d9b19e24f6c76eb50aaf8978fefa06713849b76c9217a06.exe
Size

289KB
MD5

0d1bd79f464e59961c35f6d7088c8436
SHA1

d23248d708ae44c91002572f090108e3c66e7487
SHA256

9bac8e1e755f20031d9b19e24f6c76eb50aaf8978fefa06713849b76c9217a06
SHA512

0dcf6d1dd2363c34aea81cd556ed63065aad982c9a27ff9983c277cbffc547900fb4127c4c436b70197d26b745528b9afbea7ee3b3179d9d65988a6cd0007eb2
SSDEEP

6144:5Ga2IKa1hZPTJ0rLTvBKVKZ3QrLA5Qan8:4i1z2rLbBhQfMf8

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Executes dropped EXE 2 IoCs

pid	Process
1356	9bac8e1e755f20031d9b19e24f6c76eb50aaf8978fefa06713849b76c9217a06mgr.exe
1168	9bac8e1e755f20031d9b19e24f6c76eb50aaf8978fefa06713849b76c9217a06mgrmgr.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1376-67-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral1/memory/1168-76-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/1356-78-0x0000000000400000-0x000000000045B000-memory.dmp	upx

Loads dropped DLL 10 IoCs

pid	Process
1376	9bac8e1e755f20031d9b19e24f6c76eb50aaf8978fefa06713849b76c9217a06.exe
1376	9bac8e1e755f20031d9b19e24f6c76eb50aaf8978fefa06713849b76c9217a06.exe
1376	9bac8e1e755f20031d9b19e24f6c76eb50aaf8978fefa06713849b76c9217a06.exe
1356	9bac8e1e755f20031d9b19e24f6c76eb50aaf8978fefa06713849b76c9217a06mgr.exe
1356	9bac8e1e755f20031d9b19e24f6c76eb50aaf8978fefa06713849b76c9217a06mgr.exe
1376	9bac8e1e755f20031d9b19e24f6c76eb50aaf8978fefa06713849b76c9217a06.exe
1356	9bac8e1e755f20031d9b19e24f6c76eb50aaf8978fefa06713849b76c9217a06mgr.exe
1168	9bac8e1e755f20031d9b19e24f6c76eb50aaf8978fefa06713849b76c9217a06mgrmgr.exe
1356	9bac8e1e755f20031d9b19e24f6c76eb50aaf8978fefa06713849b76c9217a06mgr.exe
1168	9bac8e1e755f20031d9b19e24f6c76eb50aaf8978fefa06713849b76c9217a06mgrmgr.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 1356	1376	9bac8e1e755f20031d9b19e24f6c76eb50aaf8978fefa06713849b76c9217a06.exe	26
PID 1376 wrote to memory of 1356	1376	9bac8e1e755f20031d9b19e24f6c76eb50aaf8978fefa06713849b76c9217a06.exe	26
PID 1376 wrote to memory of 1356	1376	9bac8e1e755f20031d9b19e24f6c76eb50aaf8978fefa06713849b76c9217a06.exe	26
PID 1376 wrote to memory of 1356	1376	9bac8e1e755f20031d9b19e24f6c76eb50aaf8978fefa06713849b76c9217a06.exe	26
PID 1356 wrote to memory of 1168	1356	9bac8e1e755f20031d9b19e24f6c76eb50aaf8978fefa06713849b76c9217a06mgr.exe	27
PID 1356 wrote to memory of 1168	1356	9bac8e1e755f20031d9b19e24f6c76eb50aaf8978fefa06713849b76c9217a06mgr.exe	27
PID 1356 wrote to memory of 1168	1356	9bac8e1e755f20031d9b19e24f6c76eb50aaf8978fefa06713849b76c9217a06mgr.exe	27
PID 1356 wrote to memory of 1168	1356	9bac8e1e755f20031d9b19e24f6c76eb50aaf8978fefa06713849b76c9217a06mgr.exe	27

C:\Users\Admin\AppData\Local\Temp\9bac8e1e755f20031d9b19e24f6c76eb50aaf8978fefa06713849b76c9217a06.exe
"C:\Users\Admin\AppData\Local\Temp\9bac8e1e755f20031d9b19e24f6c76eb50aaf8978fefa06713849b76c9217a06.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Users\Admin\AppData\Local\Temp\9bac8e1e755f20031d9b19e24f6c76eb50aaf8978fefa06713849b76c9217a06mgr.exe
  C:\Users\Admin\AppData\Local\Temp\9bac8e1e755f20031d9b19e24f6c76eb50aaf8978fefa06713849b76c9217a06mgr.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1356
- - C:\Users\Admin\AppData\Local\Temp\9bac8e1e755f20031d9b19e24f6c76eb50aaf8978fefa06713849b76c9217a06mgrmgr.exe
    C:\Users\Admin\AppData\Local\Temp\9bac8e1e755f20031d9b19e24f6c76eb50aaf8978fefa06713849b76c9217a06mgrmgr.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1168

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\9bac8e1e755f20031d9b19e24f6c76eb50aaf8978fefa06713849b76c9217a06mgr.exe

Filesize
191KB

MD5
f4380f6318e71d4596657ce83daf0014

SHA1
c07fc57d337936faa228c7c44029e6086d466b07

SHA256
152285357d6f7e14f4367fa2b295fabe5cd337215ef13fa3eb5cb0ad583e73fd

SHA512
20c0bd8c84dbacf3f30e5f32dd39b39da6d4fa1ac3059ffcf3ae971384a1b1489ad3853ab1e1f46f93da0d11d9d0990e41983371f08af8de14940a922db3df0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\9bac8e1e755f20031d9b19e24f6c76eb50aaf8978fefa06713849b76c9217a06mgrmgr.exe

Filesize
94KB

MD5
5c8b2f1499f748bc9175df521ccfb94d

SHA1
1586cdfdf987d3d10cd85b142f7020f8e656b693

SHA256
1a37e324b3de62bf0fdd1209f5cc286b399f22b5ed4cecc19a59183ba626d9b0

SHA512
c72561bd4b22f8f36c9aa0df33f1d8c4f9197f80fe8a4c1566d9a62409dc415492d689d6628fb50d96d94652b4ae6295c2314924ce04de8cbb0c433fc7797d9b

Download Submit
\Users\Admin\AppData\Local\Temp\9bac8e1e755f20031d9b19e24f6c76eb50aaf8978fefa06713849b76c9217a06mgr.exe

Filesize
191KB

MD5
f4380f6318e71d4596657ce83daf0014

SHA1
c07fc57d337936faa228c7c44029e6086d466b07

SHA256
152285357d6f7e14f4367fa2b295fabe5cd337215ef13fa3eb5cb0ad583e73fd

SHA512
20c0bd8c84dbacf3f30e5f32dd39b39da6d4fa1ac3059ffcf3ae971384a1b1489ad3853ab1e1f46f93da0d11d9d0990e41983371f08af8de14940a922db3df0f

Download Submit
\Users\Admin\AppData\Local\Temp\9bac8e1e755f20031d9b19e24f6c76eb50aaf8978fefa06713849b76c9217a06mgr.exe

Filesize
191KB

MD5
f4380f6318e71d4596657ce83daf0014

SHA1
c07fc57d337936faa228c7c44029e6086d466b07

SHA256
152285357d6f7e14f4367fa2b295fabe5cd337215ef13fa3eb5cb0ad583e73fd

SHA512
20c0bd8c84dbacf3f30e5f32dd39b39da6d4fa1ac3059ffcf3ae971384a1b1489ad3853ab1e1f46f93da0d11d9d0990e41983371f08af8de14940a922db3df0f

Download Submit
\Users\Admin\AppData\Local\Temp\9bac8e1e755f20031d9b19e24f6c76eb50aaf8978fefa06713849b76c9217a06mgrmgr.exe

Filesize
94KB

MD5
5c8b2f1499f748bc9175df521ccfb94d

SHA1
1586cdfdf987d3d10cd85b142f7020f8e656b693

SHA256
1a37e324b3de62bf0fdd1209f5cc286b399f22b5ed4cecc19a59183ba626d9b0

SHA512
c72561bd4b22f8f36c9aa0df33f1d8c4f9197f80fe8a4c1566d9a62409dc415492d689d6628fb50d96d94652b4ae6295c2314924ce04de8cbb0c433fc7797d9b

Download Submit
\Users\Admin\AppData\Local\Temp\9bac8e1e755f20031d9b19e24f6c76eb50aaf8978fefa06713849b76c9217a06mgrmgr.exe

Filesize
94KB

MD5
5c8b2f1499f748bc9175df521ccfb94d

SHA1
1586cdfdf987d3d10cd85b142f7020f8e656b693

SHA256
1a37e324b3de62bf0fdd1209f5cc286b399f22b5ed4cecc19a59183ba626d9b0

SHA512
c72561bd4b22f8f36c9aa0df33f1d8c4f9197f80fe8a4c1566d9a62409dc415492d689d6628fb50d96d94652b4ae6295c2314924ce04de8cbb0c433fc7797d9b

Download Submit
\Users\Admin\AppData\Local\Temp\~TM345A.tmp

Filesize
1.2MB

MD5
d124f55b9393c976963407dff51ffa79

SHA1
2c7bbedd79791bfb866898c85b504186db610b5d

SHA256
ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef

SHA512
278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06

Download Submit
\Users\Admin\AppData\Local\Temp\~TM34C8.tmp

Filesize
1.1MB

MD5
9b98d47916ead4f69ef51b56b0c2323c

SHA1
290a80b4ded0efc0fd00816f373fcea81a521330

SHA256
96e0ae104c9662d0d20fdf59844c2d18334e5847b6c4fc7f8ce4b3b87f39887b

SHA512
68b67021f228d8d71df4deb0b6388558b2f935a6aa466a12199cd37ada47ee588ea407b278d190d3a498b0ef3f5f1a2573a469b7ea5561ab2e7055c45565fe94

Download Submit
\Users\Admin\AppData\Local\Temp\~TM3544.tmp

Filesize
1.2MB

MD5
d124f55b9393c976963407dff51ffa79

SHA1
2c7bbedd79791bfb866898c85b504186db610b5d

SHA256
ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef

SHA512
278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06

Download Submit
\Users\Admin\AppData\Local\Temp\~TM3563.tmp

Filesize
1.2MB

MD5
d124f55b9393c976963407dff51ffa79

SHA1
2c7bbedd79791bfb866898c85b504186db610b5d

SHA256
ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef

SHA512
278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06

Download Submit
\Users\Admin\AppData\Local\Temp\~TM362F.tmp

Filesize
1.1MB

MD5
9b98d47916ead4f69ef51b56b0c2323c

SHA1
290a80b4ded0efc0fd00816f373fcea81a521330

SHA256
96e0ae104c9662d0d20fdf59844c2d18334e5847b6c4fc7f8ce4b3b87f39887b

SHA512
68b67021f228d8d71df4deb0b6388558b2f935a6aa466a12199cd37ada47ee588ea407b278d190d3a498b0ef3f5f1a2573a469b7ea5561ab2e7055c45565fe94

Download Submit
\Users\Admin\AppData\Local\Temp\~TM365E.tmp

Filesize
1.1MB

MD5
9b98d47916ead4f69ef51b56b0c2323c

SHA1
290a80b4ded0efc0fd00816f373fcea81a521330

SHA256
96e0ae104c9662d0d20fdf59844c2d18334e5847b6c4fc7f8ce4b3b87f39887b

SHA512
68b67021f228d8d71df4deb0b6388558b2f935a6aa466a12199cd37ada47ee588ea407b278d190d3a498b0ef3f5f1a2573a469b7ea5561ab2e7055c45565fe94

Download Submit
memory/1168-75-0x0000000077550000-0x00000000776D0000-memory.dmp

Filesize
1.5MB

Download
memory/1168-76-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1168-77-0x0000000000340000-0x0000000000382000-memory.dmp

Filesize
264KB

Download
memory/1356-74-0x0000000077550000-0x00000000776D0000-memory.dmp

Filesize
1.5MB

Download
memory/1356-81-0x0000000001C30000-0x0000000001C72000-memory.dmp

Filesize
264KB

Download
memory/1356-80-0x0000000077550000-0x00000000776D0000-memory.dmp

Filesize
1.5MB

Download
memory/1356-79-0x0000000077550000-0x00000000776D0000-memory.dmp

Filesize
1.5MB

Download
memory/1356-78-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1376-54-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/1376-69-0x0000000077550000-0x00000000776D0000-memory.dmp

Filesize
1.5MB

Download
memory/1376-67-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/1376-68-0x00000000002C0000-0x0000000000333000-memory.dmp

Filesize
460KB

Download