ramnit | c10ba6650125d86815fb245144516f2286eeba942a34b69581156092033e3f65

Analysis

max time kernel
152s
max time network
139s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 16:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c10ba6650125d86815fb245144516f2286eeba942a34b69581156092033e3f65.dll
Size

272KB
MD5

15d184d15a7a777fe23b2f73a9c97a2c
SHA1

aae7d3db6cb0d071050e422849ebc0fbb66f2930
SHA256

c10ba6650125d86815fb245144516f2286eeba942a34b69581156092033e3f65
SHA512

bb19995b26cc78b4ec5904f96c2348e28dcb01a7e073def2b800a0c5c43ebb87ea3f26b0343d482d89b4ee90d814d178f9c0e206d060207ad52405d9aac0425d
SSDEEP

3072:V4vR1RkTcZ7fcxdl5CTxlGuo7EI4Mvu/JQtmLYPrLjoxCvC1uHxMFsk3p/g+wFaG:VolGAMsur/GpF/iYsbjA5o

Score

10^/10

ramnit banker evasion persistence spyware stealer trojan worm

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,C:\\Users\\Admin\\AppData\\Local\\kufvyfas\\sbwijijj.exe"	svchost.exe

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112

Processes:

svchost.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe
Executes dropped EXE 2 IoCs

Processes:

rundll32mgr.exekgudlkiphryietok.exe

pid process

1216 rundll32mgr.exe
624 kgudlkiphryietok.exe
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.

Query Registry
T1012

System Information Discovery
T1082

Processes:

svchost.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	svchost.exe

pid	process
1216	rundll32mgr.exe
624	kgudlkiphryietok.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svchost.exe

Drops startup file 2 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sbwijijj.exe	svchost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sbwijijj.exe	svchost.exe

Loads dropped DLL 6 IoCs

Processes:

rundll32.exerundll32mgr.exe

pid process

1360 rundll32.exe
1360 rundll32.exe
1216 rundll32mgr.exe
1216 rundll32mgr.exe
1216 rundll32mgr.exe
1216 rundll32mgr.exe

pid	process
1360	rundll32.exe
1360	rundll32.exe
1216	rundll32mgr.exe
1216	rundll32mgr.exe
1216	rundll32mgr.exe
1216	rundll32mgr.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\SbwIjijj = "C:\\Users\\Admin\\AppData\\Local\\kufvyfas\\sbwijijj.exe"	svchost.exe

Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 47 IoCs

Processes:

svchost.exe

pid	process
1368	svchost.exe
1368	svchost.exe
1368	svchost.exe
1368	svchost.exe
1368	svchost.exe
1368	svchost.exe
1368	svchost.exe
1368	svchost.exe
1368	svchost.exe
1368	svchost.exe
1368	svchost.exe
1368	svchost.exe
1368	svchost.exe
1368	svchost.exe
1368	svchost.exe
1368	svchost.exe
1368	svchost.exe
1368	svchost.exe
1368	svchost.exe
1368	svchost.exe
1368	svchost.exe
1368	svchost.exe
1368	svchost.exe
1368	svchost.exe
1368	svchost.exe
1368	svchost.exe
1368	svchost.exe
1368	svchost.exe
1368	svchost.exe
1368	svchost.exe
1368	svchost.exe
1368	svchost.exe
1368	svchost.exe
1368	svchost.exe
1368	svchost.exe
1368	svchost.exe
1368	svchost.exe
1368	svchost.exe
1368	svchost.exe
1368	svchost.exe
1368	svchost.exe
1368	svchost.exe
1368	svchost.exe
1368	svchost.exe
1368	svchost.exe
1368	svchost.exe
1368	svchost.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

460

pid	process
460

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

rundll32mgr.exesvchost.exesvchost.exekgudlkiphryietok.exe

description	pid	process
Token: SeSecurityPrivilege	1216	rundll32mgr.exe
Token: SeDebugPrivilege	1216	rundll32mgr.exe
Token: SeSecurityPrivilege	1188	svchost.exe
Token: SeSecurityPrivilege	1368	svchost.exe
Token: SeDebugPrivilege	1368	svchost.exe
Token: SeRestorePrivilege	1368	svchost.exe
Token: SeBackupPrivilege	1368	svchost.exe
Token: SeRestorePrivilege	1368	svchost.exe
Token: SeBackupPrivilege	1368	svchost.exe
Token: SeRestorePrivilege	1368	svchost.exe
Token: SeBackupPrivilege	1368	svchost.exe
Token: SeRestorePrivilege	1368	svchost.exe
Token: SeBackupPrivilege	1368	svchost.exe
Token: SeRestorePrivilege	1368	svchost.exe
Token: SeBackupPrivilege	1368	svchost.exe
Token: SeRestorePrivilege	1368	svchost.exe
Token: SeBackupPrivilege	1368	svchost.exe
Token: SeRestorePrivilege	1368	svchost.exe
Token: SeBackupPrivilege	1368	svchost.exe
Token: SeRestorePrivilege	1368	svchost.exe
Token: SeBackupPrivilege	1368	svchost.exe
Token: SeRestorePrivilege	1368	svchost.exe
Token: SeBackupPrivilege	1368	svchost.exe
Token: SeRestorePrivilege	1368	svchost.exe
Token: SeBackupPrivilege	1368	svchost.exe
Token: SeRestorePrivilege	1368	svchost.exe
Token: SeBackupPrivilege	1368	svchost.exe
Token: SeRestorePrivilege	1368	svchost.exe
Token: SeBackupPrivilege	1368	svchost.exe
Token: SeRestorePrivilege	1368	svchost.exe
Token: SeBackupPrivilege	1368	svchost.exe
Token: SeRestorePrivilege	1368	svchost.exe
Token: SeBackupPrivilege	1368	svchost.exe
Token: SeRestorePrivilege	1368	svchost.exe
Token: SeBackupPrivilege	1368	svchost.exe
Token: SeRestorePrivilege	1368	svchost.exe
Token: SeBackupPrivilege	1368	svchost.exe
Token: SeRestorePrivilege	1368	svchost.exe
Token: SeBackupPrivilege	1368	svchost.exe
Token: SeRestorePrivilege	1368	svchost.exe
Token: SeBackupPrivilege	1368	svchost.exe
Token: SeRestorePrivilege	1368	svchost.exe
Token: SeBackupPrivilege	1368	svchost.exe
Token: SeSecurityPrivilege	624	kgudlkiphryietok.exe
Token: SeLoadDriverPrivilege	624	kgudlkiphryietok.exe
Token: SeRestorePrivilege	1368	svchost.exe
Token: SeBackupPrivilege	1368	svchost.exe
Token: SeRestorePrivilege	1368	svchost.exe
Token: SeBackupPrivilege	1368	svchost.exe
Token: SeRestorePrivilege	1368	svchost.exe
Token: SeBackupPrivilege	1368	svchost.exe
Token: SeRestorePrivilege	1368	svchost.exe
Token: SeBackupPrivilege	1368	svchost.exe
Token: SeRestorePrivilege	1368	svchost.exe
Token: SeBackupPrivilege	1368	svchost.exe
Token: SeRestorePrivilege	1368	svchost.exe
Token: SeBackupPrivilege	1368	svchost.exe
Token: SeRestorePrivilege	1368	svchost.exe
Token: SeBackupPrivilege	1368	svchost.exe
Token: SeRestorePrivilege	1368	svchost.exe
Token: SeBackupPrivilege	1368	svchost.exe
Token: SeRestorePrivilege	1368	svchost.exe
Token: SeBackupPrivilege	1368	svchost.exe
Token: SeRestorePrivilege	1368	svchost.exe

Suspicious use of WriteProcessMemory 35 IoCs

Processes:

rundll32.exerundll32.exerundll32mgr.exe

description	pid	process	target process
PID 1356 wrote to memory of 1360	1356	rundll32.exe	rundll32.exe
PID 1356 wrote to memory of 1360	1356	rundll32.exe	rundll32.exe
PID 1356 wrote to memory of 1360	1356	rundll32.exe	rundll32.exe
PID 1356 wrote to memory of 1360	1356	rundll32.exe	rundll32.exe
PID 1356 wrote to memory of 1360	1356	rundll32.exe	rundll32.exe
PID 1356 wrote to memory of 1360	1356	rundll32.exe	rundll32.exe
PID 1356 wrote to memory of 1360	1356	rundll32.exe	rundll32.exe
PID 1360 wrote to memory of 1216	1360	rundll32.exe	rundll32mgr.exe
PID 1360 wrote to memory of 1216	1360	rundll32.exe	rundll32mgr.exe
PID 1360 wrote to memory of 1216	1360	rundll32.exe	rundll32mgr.exe
PID 1360 wrote to memory of 1216	1360	rundll32.exe	rundll32mgr.exe
PID 1216 wrote to memory of 1188	1216	rundll32mgr.exe	svchost.exe
PID 1216 wrote to memory of 1188	1216	rundll32mgr.exe	svchost.exe
PID 1216 wrote to memory of 1188	1216	rundll32mgr.exe	svchost.exe
PID 1216 wrote to memory of 1188	1216	rundll32mgr.exe	svchost.exe
PID 1216 wrote to memory of 1188	1216	rundll32mgr.exe	svchost.exe
PID 1216 wrote to memory of 1188	1216	rundll32mgr.exe	svchost.exe
PID 1216 wrote to memory of 1188	1216	rundll32mgr.exe	svchost.exe
PID 1216 wrote to memory of 1188	1216	rundll32mgr.exe	svchost.exe
PID 1216 wrote to memory of 1188	1216	rundll32mgr.exe	svchost.exe
PID 1216 wrote to memory of 1188	1216	rundll32mgr.exe	svchost.exe
PID 1216 wrote to memory of 1368	1216	rundll32mgr.exe	svchost.exe
PID 1216 wrote to memory of 1368	1216	rundll32mgr.exe	svchost.exe
PID 1216 wrote to memory of 1368	1216	rundll32mgr.exe	svchost.exe
PID 1216 wrote to memory of 1368	1216	rundll32mgr.exe	svchost.exe
PID 1216 wrote to memory of 1368	1216	rundll32mgr.exe	svchost.exe
PID 1216 wrote to memory of 1368	1216	rundll32mgr.exe	svchost.exe
PID 1216 wrote to memory of 1368	1216	rundll32mgr.exe	svchost.exe
PID 1216 wrote to memory of 1368	1216	rundll32mgr.exe	svchost.exe
PID 1216 wrote to memory of 1368	1216	rundll32mgr.exe	svchost.exe
PID 1216 wrote to memory of 1368	1216	rundll32mgr.exe	svchost.exe
PID 1216 wrote to memory of 624	1216	rundll32mgr.exe	kgudlkiphryietok.exe
PID 1216 wrote to memory of 624	1216	rundll32mgr.exe	kgudlkiphryietok.exe
PID 1216 wrote to memory of 624	1216	rundll32mgr.exe	kgudlkiphryietok.exe
PID 1216 wrote to memory of 624	1216	rundll32mgr.exe	kgudlkiphryietok.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c10ba6650125d86815fb245144516f2286eeba942a34b69581156092033e3f65.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1356

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c10ba6650125d86815fb245144516f2286eeba942a34b69581156092033e3f65.dll,#1
2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1360

C:\Windows\SysWOW64\rundll32mgr.exe
C:\Windows\SysWOW64\rundll32mgr.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1216

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1188

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
4⤵
- Modifies WinLogon for persistence
- UAC bypass
- Checks BIOS information in registry
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1368

C:\Users\Admin\AppData\Local\Temp\kgudlkiphryietok.exe
"C:\Users\Admin\AppData\Local\Temp\kgudlkiphryietok.exe"
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:624

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Modify Registry

T1112

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\kgudlkiphryietok.exe
Filesize
111KB

MD5
56eddadc5887ee38e44cba3d11d4505f

SHA1
39fba3857b64a678caf9f46eb8b06fcbebd88ff6

SHA256
3af2891edb39edc91e678b6adfb81831ea8b35d6ba2e0539f15d3dc95e427f37

SHA512
9b88e710505f739ac53e64e8fbf2a964380b10fd15f2789e3b5082fbcd697cf77bc057c152331b764e2ccb62071224aff400080cf7f7c33dea9ebd98de150f4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\kgudlkiphryietok.exe
Filesize
111KB

MD5
56eddadc5887ee38e44cba3d11d4505f

SHA1
39fba3857b64a678caf9f46eb8b06fcbebd88ff6

SHA256
3af2891edb39edc91e678b6adfb81831ea8b35d6ba2e0539f15d3dc95e427f37

SHA512
9b88e710505f739ac53e64e8fbf2a964380b10fd15f2789e3b5082fbcd697cf77bc057c152331b764e2ccb62071224aff400080cf7f7c33dea9ebd98de150f4e

Download Submit
C:\Windows\SysWOW64\rundll32mgr.exe
Filesize
111KB

MD5
56eddadc5887ee38e44cba3d11d4505f

SHA1
39fba3857b64a678caf9f46eb8b06fcbebd88ff6

SHA256
3af2891edb39edc91e678b6adfb81831ea8b35d6ba2e0539f15d3dc95e427f37

SHA512
9b88e710505f739ac53e64e8fbf2a964380b10fd15f2789e3b5082fbcd697cf77bc057c152331b764e2ccb62071224aff400080cf7f7c33dea9ebd98de150f4e

Download Submit
C:\Windows\SysWOW64\rundll32mgr.exe
Filesize
111KB

MD5
56eddadc5887ee38e44cba3d11d4505f

SHA1
39fba3857b64a678caf9f46eb8b06fcbebd88ff6

SHA256
3af2891edb39edc91e678b6adfb81831ea8b35d6ba2e0539f15d3dc95e427f37

SHA512
9b88e710505f739ac53e64e8fbf2a964380b10fd15f2789e3b5082fbcd697cf77bc057c152331b764e2ccb62071224aff400080cf7f7c33dea9ebd98de150f4e

Download Submit
\Users\Admin\AppData\Local\Temp\kgudlkiphryietok.exe
Filesize
111KB

MD5
56eddadc5887ee38e44cba3d11d4505f

SHA1
39fba3857b64a678caf9f46eb8b06fcbebd88ff6

SHA256
3af2891edb39edc91e678b6adfb81831ea8b35d6ba2e0539f15d3dc95e427f37

SHA512
9b88e710505f739ac53e64e8fbf2a964380b10fd15f2789e3b5082fbcd697cf77bc057c152331b764e2ccb62071224aff400080cf7f7c33dea9ebd98de150f4e

Download Submit
\Users\Admin\AppData\Local\Temp\kgudlkiphryietok.exe
Filesize
111KB

MD5
56eddadc5887ee38e44cba3d11d4505f

SHA1
39fba3857b64a678caf9f46eb8b06fcbebd88ff6

SHA256
3af2891edb39edc91e678b6adfb81831ea8b35d6ba2e0539f15d3dc95e427f37

SHA512
9b88e710505f739ac53e64e8fbf2a964380b10fd15f2789e3b5082fbcd697cf77bc057c152331b764e2ccb62071224aff400080cf7f7c33dea9ebd98de150f4e

Download Submit
\Users\Admin\AppData\Local\Temp\kgudlkiphryietok.exe
Filesize
111KB

MD5
56eddadc5887ee38e44cba3d11d4505f

SHA1
39fba3857b64a678caf9f46eb8b06fcbebd88ff6

SHA256
3af2891edb39edc91e678b6adfb81831ea8b35d6ba2e0539f15d3dc95e427f37

SHA512
9b88e710505f739ac53e64e8fbf2a964380b10fd15f2789e3b5082fbcd697cf77bc057c152331b764e2ccb62071224aff400080cf7f7c33dea9ebd98de150f4e

Download Submit
\Users\Admin\AppData\Local\Temp\kgudlkiphryietok.exe
Filesize
111KB

MD5
56eddadc5887ee38e44cba3d11d4505f

SHA1
39fba3857b64a678caf9f46eb8b06fcbebd88ff6

SHA256
3af2891edb39edc91e678b6adfb81831ea8b35d6ba2e0539f15d3dc95e427f37

SHA512
9b88e710505f739ac53e64e8fbf2a964380b10fd15f2789e3b5082fbcd697cf77bc057c152331b764e2ccb62071224aff400080cf7f7c33dea9ebd98de150f4e

Download Submit
\Windows\SysWOW64\rundll32mgr.exe
Filesize
111KB

MD5
56eddadc5887ee38e44cba3d11d4505f

SHA1
39fba3857b64a678caf9f46eb8b06fcbebd88ff6

SHA256
3af2891edb39edc91e678b6adfb81831ea8b35d6ba2e0539f15d3dc95e427f37

SHA512
9b88e710505f739ac53e64e8fbf2a964380b10fd15f2789e3b5082fbcd697cf77bc057c152331b764e2ccb62071224aff400080cf7f7c33dea9ebd98de150f4e

Download Submit
\Windows\SysWOW64\rundll32mgr.exe
Filesize
111KB

MD5
56eddadc5887ee38e44cba3d11d4505f

SHA1
39fba3857b64a678caf9f46eb8b06fcbebd88ff6

SHA256
3af2891edb39edc91e678b6adfb81831ea8b35d6ba2e0539f15d3dc95e427f37

SHA512
9b88e710505f739ac53e64e8fbf2a964380b10fd15f2789e3b5082fbcd697cf77bc057c152331b764e2ccb62071224aff400080cf7f7c33dea9ebd98de150f4e

Download Submit
memory/624-85-0x0000000000000000-mapping.dmp

Download
memory/624-93-0x0000000000400000-0x0000000000437CD0-memory.dmp

Filesize
223KB

Download
memory/624-92-0x0000000000400000-0x0000000000437CD0-memory.dmp

Filesize
223KB

Download
memory/1188-66-0x0000000020010000-0x000000002001C000-memory.dmp

Filesize
48KB

Download
memory/1188-65-0x0000000000000000-mapping.dmp

Download
memory/1188-63-0x0000000020010000-0x000000002001C000-memory.dmp

Filesize
48KB

Download
memory/1216-89-0x0000000002690000-0x00000000026C8000-memory.dmp

Filesize
224KB

Download
memory/1216-80-0x0000000000400000-0x0000000000437CD0-memory.dmp

Filesize
223KB

Download
memory/1216-91-0x0000000002690000-0x00000000026C8000-memory.dmp

Filesize
224KB

Download
memory/1216-58-0x0000000000000000-mapping.dmp

Download
memory/1216-90-0x0000000002690000-0x00000000026C8000-memory.dmp

Filesize
224KB

Download
memory/1360-55-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/1360-54-0x0000000000000000-mapping.dmp

Download
memory/1368-74-0x0000000000000000-mapping.dmp

Download
memory/1368-72-0x0000000020010000-0x0000000020023000-memory.dmp

Filesize
76KB

Download
memory/1368-76-0x0000000020010000-0x0000000020023000-memory.dmp

Filesize
76KB

Download