ramnit | 030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d

General

Target

030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe
Size

852KB
MD5

4533680b5f18b53fbabefd1268e7aea0
SHA1

8e658bae62441e275a1b282eccbf4faa0e3c9586
SHA256

030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d
SHA512

1def674f675bc5d140a3b4c9b21782293601bee1d6ed0798587b5c1fbc0e8aad4fa1bea0ef3625acbe73edbe19cda0117cdb2a9ea4786b3935b7e8d9035cfcd5
SSDEEP

24576:9yiqCB6bLxIvoBWBhQUepoIqghkw4MWyBhSuClXjbkQ:9yiqCU3xz+5epoAqcWAozlXjIQ

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Executes dropped EXE 1 IoCs

Processes:

030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8dmgr.exe

pid process

4248 030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8dmgr.exe

pid	process
4248	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8dmgr.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3528-132-0x0000000000400000-0x000000000070D000-memory.dmp	upx
behavioral2/memory/4248-138-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral2/memory/3528-140-0x0000000000400000-0x000000000070D000-memory.dmp	upx

Loads dropped DLL 1 IoCs

Processes:

030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8dmgr.exe

pid process

4248 030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8dmgr.exe

pid	process
4248	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8dmgr.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe

description	ioc	process
File opened (read-only)	\??\P:	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe
File opened (read-only)	\??\V:	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe
File opened (read-only)	\??\E:	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe
File opened (read-only)	\??\H:	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe
File opened (read-only)	\??\M:	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe
File opened (read-only)	\??\R:	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe
File opened (read-only)	\??\S:	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe
File opened (read-only)	\??\T:	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe
File opened (read-only)	\??\B:	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe
File opened (read-only)	\??\F:	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe
File opened (read-only)	\??\G:	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe
File opened (read-only)	\??\I:	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe
File opened (read-only)	\??\J:	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe
File opened (read-only)	\??\L:	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe
File opened (read-only)	\??\N:	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe
File opened (read-only)	\??\Q:	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe
File opened (read-only)	\??\A:	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe
File opened (read-only)	\??\W:	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe
File opened (read-only)	\??\Y:	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe
File opened (read-only)	\??\Z:	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe
File opened (read-only)	\??\U:	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe
File opened (read-only)	\??\O:	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe
File opened (read-only)	\??\X:	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe
File opened (read-only)	\??\K:	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

456 4248 WerFault.exe 030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8dmgr.exe

pid	pid_target	process	target process
456	4248	WerFault.exe	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8dmgr.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe

description	pid	process	target process
PID 3528 wrote to memory of 4248	3528	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8dmgr.exe
PID 3528 wrote to memory of 4248	3528	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8dmgr.exe
PID 3528 wrote to memory of 4248	3528	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe	030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8dmgr.exe

C:\Users\Admin\AppData\Local\Temp\030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe
"C:\Users\Admin\AppData\Local\Temp\030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8d.exe"
1⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:3528

C:\Users\Admin\AppData\Local\Temp\030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8dmgr.exe
C:\Users\Admin\AppData\Local\Temp\030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8dmgr.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4248 -s 10176
3⤵
- Program crash
PID:456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4248 -ip 4248
1⤵
PID:3276

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8dmgr.exe

Filesize
94KB

MD5
1375ba09995afa93cbfa59cae04b3ab4

SHA1
0eb0934173dbf2bd10b0c2bce9fb2d414305bb19

SHA256
1a3c3ec1d2ee6bbaf9ab89b1247e9da435c729f6b539563d97eae84c8163918a

SHA512
ebea2ee04de3c5b6633891df4d734a6a6422c154bbbb43d00ce2964a6ba76b0fd58bb30b9849c3a2f1578259c5c33d39bcc013a5c9fb8e56fa13107eccd4020f

Download Submit
C:\Users\Admin\AppData\Local\Temp\030ea997d9fef59cc2b2effd4f9dc7989bbb02ab3c44631f2b6048df9e5d8a8dmgr.exe

Filesize
94KB

MD5
1375ba09995afa93cbfa59cae04b3ab4

SHA1
0eb0934173dbf2bd10b0c2bce9fb2d414305bb19

SHA256
1a3c3ec1d2ee6bbaf9ab89b1247e9da435c729f6b539563d97eae84c8163918a

SHA512
ebea2ee04de3c5b6633891df4d734a6a6422c154bbbb43d00ce2964a6ba76b0fd58bb30b9849c3a2f1578259c5c33d39bcc013a5c9fb8e56fa13107eccd4020f

Download Submit
C:\Users\Admin\AppData\Local\Temp\~TMC161.tmp

Filesize
1.6MB

MD5
4f3387277ccbd6d1f21ac5c07fe4ca68

SHA1
e16506f662dc92023bf82def1d621497c8ab5890

SHA256
767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

SHA512
9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

Download Submit
memory/3528-132-0x0000000000400000-0x000000000070D000-memory.dmp

Filesize
3.1MB

Download
memory/3528-140-0x0000000000400000-0x000000000070D000-memory.dmp

Filesize
3.1MB

Download
memory/4248-133-0x0000000000000000-mapping.dmp

Download
memory/4248-137-0x0000000000570000-0x0000000000599000-memory.dmp

Filesize
164KB

Download
memory/4248-138-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4248-139-0x0000000077A70000-0x0000000077C13000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads