ramnit | 030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d

General

Target

030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe
Size

852KB
MD5

4533680b5f18b53fbabefd1268e7aea0
SHA1

8e658bae62441e275a1b282eccbf4faa0e3c9586
SHA256

030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d
SHA512

1def674f675bc5d140a3b4c9b21782293601bee1d6ed0798587b5c1fbc0e8aad4fa1bea0ef3625acbe73edbe19cda0117cdb2a9ea4786b3935b7e8d9035cfcd5
SSDEEP

24576:9yiqCB6bLxIvoBWBhQUepoIqghkw4MWyBhSuClXjbkQ:9yiqCU3xz+5epoAqcWAozlXjIQ

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Executes dropped EXE 1 IoCs

Processes:

030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8dmgr.exe

pid process

620 030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8dmgr.exe

pid	process
620	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8dmgr.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1480-60-0x0000000000400000-0x000000000070D000-memory.dmp	upx
behavioral1/memory/620-64-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/memory/1480-66-0x0000000000400000-0x000000000070D000-memory.dmp	upx

Loads dropped DLL 4 IoCs

Processes:

030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8dmgr.exe

pid	process
1480	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe
1480	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe
620	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8dmgr.exe
620	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8dmgr.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe

description	ioc	process
File opened (read-only)	\??\K:	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe
File opened (read-only)	\??\A:	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe
File opened (read-only)	\??\G:	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe
File opened (read-only)	\??\I:	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe
File opened (read-only)	\??\O:	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe
File opened (read-only)	\??\Q:	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe
File opened (read-only)	\??\T:	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe
File opened (read-only)	\??\B:	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe
File opened (read-only)	\??\E:	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe
File opened (read-only)	\??\P:	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe
File opened (read-only)	\??\X:	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe
File opened (read-only)	\??\Y:	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe
File opened (read-only)	\??\Z:	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe
File opened (read-only)	\??\J:	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe
File opened (read-only)	\??\L:	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe
File opened (read-only)	\??\M:	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe
File opened (read-only)	\??\N:	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe
File opened (read-only)	\??\R:	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe
File opened (read-only)	\??\S:	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe
File opened (read-only)	\??\U:	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe
File opened (read-only)	\??\V:	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe
File opened (read-only)	\??\F:	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe
File opened (read-only)	\??\H:	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe
File opened (read-only)	\??\W:	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe

description	pid	process	target process
PID 1480 wrote to memory of 620	1480	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8dmgr.exe
PID 1480 wrote to memory of 620	1480	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8dmgr.exe
PID 1480 wrote to memory of 620	1480	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8dmgr.exe
PID 1480 wrote to memory of 620	1480	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8dmgr.exe

C:\Users\Admin\AppData\Local\Temp\030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe
"C:\Users\Admin\AppData\Local\Temp\030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:1480

C:\Users\Admin\AppData\Local\Temp\030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8dmgr.exe
C:\Users\Admin\AppData\Local\Temp\030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8dmgr.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:620

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8dmgr.exe

Filesize
94KB

MD5
1375ba09995afa93cbfa59cae04b3ab4

SHA1
0eb0934173dbf2bd10b0c2bce9fb2d414305bb19

SHA256
1a3c3ec1d2ee6bbaf9ab89b1247e9da435c729f6b539563d97eae84c8163918a

SHA512
ebea2ee04de3c5b6633891df4d734a6a6422c154bbbb43d00ce2964a6ba76b0fd58bb30b9849c3a2f1578259c5c33d39bcc013a5c9fb8e56fa13107eccd4020f

Download Submit
\Users\Admin\AppData\Local\Temp\030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8dmgr.exe

Filesize
94KB

MD5
1375ba09995afa93cbfa59cae04b3ab4

SHA1
0eb0934173dbf2bd10b0c2bce9fb2d414305bb19

SHA256
1a3c3ec1d2ee6bbaf9ab89b1247e9da435c729f6b539563d97eae84c8163918a

SHA512
ebea2ee04de3c5b6633891df4d734a6a6422c154bbbb43d00ce2964a6ba76b0fd58bb30b9849c3a2f1578259c5c33d39bcc013a5c9fb8e56fa13107eccd4020f

Download Submit
\Users\Admin\AppData\Local\Temp\030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8dmgr.exe

Filesize
94KB

MD5
1375ba09995afa93cbfa59cae04b3ab4

SHA1
0eb0934173dbf2bd10b0c2bce9fb2d414305bb19

SHA256
1a3c3ec1d2ee6bbaf9ab89b1247e9da435c729f6b539563d97eae84c8163918a

SHA512
ebea2ee04de3c5b6633891df4d734a6a6422c154bbbb43d00ce2964a6ba76b0fd58bb30b9849c3a2f1578259c5c33d39bcc013a5c9fb8e56fa13107eccd4020f

Download Submit
\Users\Admin\AppData\Local\Temp\~TM30B2.tmp

Filesize
1.2MB

MD5
d124f55b9393c976963407dff51ffa79

SHA1
2c7bbedd79791bfb866898c85b504186db610b5d

SHA256
ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef

SHA512
278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06

Download Submit
\Users\Admin\AppData\Local\Temp\~TM31CC.tmp

Filesize
1.1MB

MD5
9b98d47916ead4f69ef51b56b0c2323c

SHA1
290a80b4ded0efc0fd00816f373fcea81a521330

SHA256
96e0ae104c9662d0d20fdf59844c2d18334e5847b6c4fc7f8ce4b3b87f39887b

SHA512
68b67021f228d8d71df4deb0b6388558b2f935a6aa466a12199cd37ada47ee588ea407b278d190d3a498b0ef3f5f1a2573a469b7ea5561ab2e7055c45565fe94

Download Submit
memory/620-57-0x0000000000000000-mapping.dmp

Download
memory/620-64-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/620-63-0x00000000001B0000-0x00000000001D9000-memory.dmp

Filesize
164KB

Download
memory/620-65-0x0000000077370000-0x00000000774F0000-memory.dmp

Filesize
1.5MB

Download
memory/1480-54-0x00000000758B1000-0x00000000758B3000-memory.dmp

Filesize
8KB

Download
memory/1480-60-0x0000000000400000-0x000000000070D000-memory.dmp

Filesize
3.1MB

Download
memory/1480-66-0x0000000000400000-0x000000000070D000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads