ramnit | 76870fd9910067e9938152dd5071d70346466f62228f0458122f55918dbe0726

Analysis

max time kernel
136s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 17:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

76870fd9910067e9938152dd5071d70346466f62228f0458122f55918dbe0726.dll
Size

216KB
MD5

0e35d3cef9a0eb713973219c47e64ac1
SHA1

1c88f8a4513420659d3df10db6eb0369235f8ce3
SHA256

76870fd9910067e9938152dd5071d70346466f62228f0458122f55918dbe0726
SHA512

c8c124645563ad1c641b8a0808bce5c2ab55773ccc5e30e81aa20f2d6e6db5a7bd2f385ab16d043a6ad92807bafd841b369e7f0644a6d0638b7131622b556296
SSDEEP

3072:un4cV8gf2u41Z5tKlwF+yooPdW3WGaJxK:84y8gOl2aq3dqs

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Executes dropped EXE 2 IoCs

pid	Process
1120	rundll32mgr.exe
2020	WaterMark.exe

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1120-140-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1120-141-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1120-149-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/2020-152-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral2/memory/2020-153-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral2/memory/2020-154-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral2/memory/2020-155-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral2/memory/2020-156-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral2/memory/2020-157-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral2/memory/2020-158-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral2/memory/2020-159-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	rundll32mgr.exe
File opened for modification	C:\Program Files (x86)\Microsoft\WaterMark.exe	rundll32mgr.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px4CF7.tmp	rundll32mgr.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2900	2396	WerFault.exe	85

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30995297"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "374670432"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3875687591"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30995297"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3875687591"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30995297"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{1114263B-5F55-11ED-AECB-D2D0017C8629} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3949751628"	IEXPLORE.EXE

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2020	WaterMark.exe
2020	WaterMark.exe
2020	WaterMark.exe
2020	WaterMark.exe
2020	WaterMark.exe
2020	WaterMark.exe
2020	WaterMark.exe
2020	WaterMark.exe
2020	WaterMark.exe
2020	WaterMark.exe
2020	WaterMark.exe
2020	WaterMark.exe
2020	WaterMark.exe
2020	WaterMark.exe
2020	WaterMark.exe
2020	WaterMark.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
212	iexplore.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2020	WaterMark.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
212	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
212	iexplore.exe
212	iexplore.exe
3872	IEXPLORE.EXE
3872	IEXPLORE.EXE
3872	IEXPLORE.EXE
3872	IEXPLORE.EXE

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1120	rundll32mgr.exe
2020	WaterMark.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 1728	4804	rundll32.exe	82
PID 4804 wrote to memory of 1728	4804	rundll32.exe	82
PID 4804 wrote to memory of 1728	4804	rundll32.exe	82
PID 1728 wrote to memory of 1120	1728	rundll32.exe	83
PID 1728 wrote to memory of 1120	1728	rundll32.exe	83
PID 1728 wrote to memory of 1120	1728	rundll32.exe	83
PID 1120 wrote to memory of 2020	1120	rundll32mgr.exe	84
PID 1120 wrote to memory of 2020	1120	rundll32mgr.exe	84
PID 1120 wrote to memory of 2020	1120	rundll32mgr.exe	84
PID 2020 wrote to memory of 2396	2020	WaterMark.exe	85
PID 2020 wrote to memory of 2396	2020	WaterMark.exe	85
PID 2020 wrote to memory of 2396	2020	WaterMark.exe	85
PID 2020 wrote to memory of 2396	2020	WaterMark.exe	85
PID 2020 wrote to memory of 2396	2020	WaterMark.exe	85
PID 2020 wrote to memory of 2396	2020	WaterMark.exe	85
PID 2020 wrote to memory of 2396	2020	WaterMark.exe	85
PID 2020 wrote to memory of 2396	2020	WaterMark.exe	85
PID 2020 wrote to memory of 2396	2020	WaterMark.exe	85
PID 2020 wrote to memory of 336	2020	WaterMark.exe	88
PID 2020 wrote to memory of 336	2020	WaterMark.exe	88
PID 2020 wrote to memory of 212	2020	WaterMark.exe	89
PID 2020 wrote to memory of 212	2020	WaterMark.exe	89
PID 212 wrote to memory of 3872	212	iexplore.exe	90
PID 212 wrote to memory of 3872	212	iexplore.exe	90
PID 212 wrote to memory of 3872	212	iexplore.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\76870fd9910067e9938152dd5071d70346466f62228f0458122f55918dbe0726.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\76870fd9910067e9938152dd5071d70346466f62228f0458122f55918dbe0726.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1728
- - C:\Windows\SysWOW64\rundll32mgr.exe
    C:\Windows\SysWOW64\rundll32mgr.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious use of UnmapMainImage
    - Suspicious use of WriteProcessMemory
    PID:1120
  - - C:\Program Files (x86)\Microsoft\WaterMark.exe
      "C:\Program Files (x86)\Microsoft\WaterMark.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of UnmapMainImage
      Suspicious use of WriteProcessMemory
      PID:2020
    - - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        5⤵
        
        PID:2396
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 212
        6⤵
        Program crash
        
        PID:2900
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        Modifies Internet Explorer settings
        
        PID:336
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        Modifies Internet Explorer settings
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:212
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:212 CREDAT:17410 /prefetch:2
        6⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:3872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2396 -ip 2396
1⤵
PID:2992

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\WaterMark.exe

Filesize
123KB

MD5
41cdf1d40aff3f71114ea210307b6a1c

SHA1
8d5237ed7a29003af5b857edd85f7f54a91f600c

SHA256
00ba79fa51af9b735ebbded72313232d83956c922e206362f9b71411772162b7

SHA512
fdcba01191a345416f17fb4024255f97af135824f1ce57bb8456d74fbfd0e37f89500aeb92c19c4add62e6cb416c57cd06b2aee310fabb91e468852ca062ff0e

Download Submit
C:\Program Files (x86)\Microsoft\WaterMark.exe

Filesize
123KB

MD5
41cdf1d40aff3f71114ea210307b6a1c

SHA1
8d5237ed7a29003af5b857edd85f7f54a91f600c

SHA256
00ba79fa51af9b735ebbded72313232d83956c922e206362f9b71411772162b7

SHA512
fdcba01191a345416f17fb4024255f97af135824f1ce57bb8456d74fbfd0e37f89500aeb92c19c4add62e6cb416c57cd06b2aee310fabb91e468852ca062ff0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
5f49b65bdc1713b58ed97d0e9625a968

SHA1
84b74e55478c9abb163aa6629e3fd3b91bed4806

SHA256
a681ab9abc281fd12a7bd06f56e36a21e8ee28b5294815c5e07b781e324a32f9

SHA512
4b502288bef324db8ad33e63c7b6f242ef7954a6fbec3ed012530044c82fee3ad1158febe088bc0deea67ac35646a0a1bd6d961c0f67b11fee584e4f1abd753a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
434B

MD5
e0abf3aa66a174ba0a6336e26abb3e4a

SHA1
cd1fd1b83151ab8df6865f6e8b5541b0340412b6

SHA256
b0f4dda6f37d977901614ef3299206d3bc421d07e687df656d810d8502a04859

SHA512
7d96a81ccf3e1343d70e6c00f3dac242fa2521e7fb31ec0d4fd73635fad8214f8974ded9cc3a8f5472424da544625445eb7247923906fbf7fa10eca8bd32d0e2

Download Submit
C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
123KB

MD5
41cdf1d40aff3f71114ea210307b6a1c

SHA1
8d5237ed7a29003af5b857edd85f7f54a91f600c

SHA256
00ba79fa51af9b735ebbded72313232d83956c922e206362f9b71411772162b7

SHA512
fdcba01191a345416f17fb4024255f97af135824f1ce57bb8456d74fbfd0e37f89500aeb92c19c4add62e6cb416c57cd06b2aee310fabb91e468852ca062ff0e

Download Submit
C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
123KB

MD5
41cdf1d40aff3f71114ea210307b6a1c

SHA1
8d5237ed7a29003af5b857edd85f7f54a91f600c

SHA256
00ba79fa51af9b735ebbded72313232d83956c922e206362f9b71411772162b7

SHA512
fdcba01191a345416f17fb4024255f97af135824f1ce57bb8456d74fbfd0e37f89500aeb92c19c4add62e6cb416c57cd06b2aee310fabb91e468852ca062ff0e

Download Submit
memory/1120-140-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1120-141-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1120-137-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1120-149-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1728-136-0x0000000010000000-0x0000000010037000-memory.dmp

Filesize
220KB

Download
memory/2020-153-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2020-152-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2020-154-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2020-155-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2020-156-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2020-157-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2020-158-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2020-159-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download