ramnit | c10ba6650125d86815fb245144516f2286eeba942a34b69581156092033e3f65 | Triage

Sharing

General

Target

c10ba6650125d86815fb245144516f2286eeba942a34b69581156092033e3f65
Size

272KB
Sample

221123-vg7jksha65
MD5

15d184d15a7a777fe23b2f73a9c97a2c
SHA1

aae7d3db6cb0d071050e422849ebc0fbb66f2930
SHA256

c10ba6650125d86815fb245144516f2286eeba942a34b69581156092033e3f65
SHA512

bb19995b26cc78b4ec5904f96c2348e28dcb01a7e073def2b800a0c5c43ebb87ea3f26b0343d482d89b4ee90d814d178f9c0e206d060207ad52405d9aac0425d
SSDEEP

3072:V4vR1RkTcZ7fcxdl5CTxlGuo7EI4Mvu/JQtmLYPrLjoxCvC1uHxMFsk3p/g+wFaG:VolGAMsur/GpF/iYsbjA5o

Score

10^/10

ramnit banker evasion persistence spyware stealer trojan worm

Malware Config

Targets

- Target
  
  c10ba6650125d86815fb245144516f2286eeba942a34b69581156092033e3f65
- Size
  
  272KB
- MD5
  
  15d184d15a7a777fe23b2f73a9c97a2c
- SHA1
  
  aae7d3db6cb0d071050e422849ebc0fbb66f2930
- SHA256
  
  c10ba6650125d86815fb245144516f2286eeba942a34b69581156092033e3f65
- SHA512
  
  bb19995b26cc78b4ec5904f96c2348e28dcb01a7e073def2b800a0c5c43ebb87ea3f26b0343d482d89b4ee90d814d178f9c0e206d060207ad52405d9aac0425d
- SSDEEP
  
  3072:V4vR1RkTcZ7fcxdl5CTxlGuo7EI4Mvu/JQtmLYPrLjoxCvC1uHxMFsk3p/g+wFaG:VolGAMsur/GpF/iYsbjA5o
Score

10^/10

ramnit banker evasion persistence spyware stealer trojan worm
- Modifies WinLogon for persistence
  persistence
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- UAC bypass
  evasion trojan
- Executes dropped EXE
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ramnitbankerevasionpersistencespywarestealertrojanworm

behavioral2