ramnit | 3536198df2a492cc873ea37fbe37f487d012ea4c5850e6dc9023113c71eb7436

General

Target

3536198df2a492cc873ea37fbe37f487d012ea4c5850e6dc9023113c71eb7436.exe
Size

184KB
MD5

511d9653a39a34b1f6463c9270591ef0
SHA1

34f2f685603e75d34edbd40632403c0bf6f94dc0
SHA256

3536198df2a492cc873ea37fbe37f487d012ea4c5850e6dc9023113c71eb7436
SHA512

01d6b0e41db20cb77d413a8bc775e0a92756befea139d90cb809f8428110952b3c299b44913cb7a4ac4a8a7af58934fcf398b6fc6962b28eb4e48925c551e564
SSDEEP

1536:UsFkAwGhzZh2UXYmvdRmSZad2jN0RAD3csVO9/w8gN5aXZ7TyizULeCTL3L7:TkAwuzhjdRmSZiAna/w8gCXZHnCTLL7

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Executes dropped EXE 1 IoCs

Processes:

3536198df2a492cc873ea37fbe37f487d012ea4c5850e6dc9023113c71eb7436mgr.exe

pid process

2520 3536198df2a492cc873ea37fbe37f487d012ea4c5850e6dc9023113c71eb7436mgr.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2520-140-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral2/memory/2520-143-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral2/memory/2520-144-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/428-145-0x0000000000400000-0x0000000000439000-memory.dmp	upx
behavioral2/memory/2520-146-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/428-147-0x0000000000400000-0x0000000000439000-memory.dmp	upx
behavioral2/memory/2520-149-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral2/memory/2520-148-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/428-150-0x0000000000400000-0x0000000000439000-memory.dmp	upx
behavioral2/memory/2520-151-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXEiexplore.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30998389"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3382293081"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3516356762"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{F499EFF9-6B68-11ED-AECB-E62D9FD3CB0B} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30998389"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30998389"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "375998392"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3382293081"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

3536198df2a492cc873ea37fbe37f487d012ea4c5850e6dc9023113c71eb7436mgr.exe3536198df2a492cc873ea37fbe37f487d012ea4c5850e6dc9023113c71eb7436.exe

pid	process
2520	3536198df2a492cc873ea37fbe37f487d012ea4c5850e6dc9023113c71eb7436mgr.exe
2520	3536198df2a492cc873ea37fbe37f487d012ea4c5850e6dc9023113c71eb7436mgr.exe
428	3536198df2a492cc873ea37fbe37f487d012ea4c5850e6dc9023113c71eb7436.exe
428	3536198df2a492cc873ea37fbe37f487d012ea4c5850e6dc9023113c71eb7436.exe
428	3536198df2a492cc873ea37fbe37f487d012ea4c5850e6dc9023113c71eb7436.exe
428	3536198df2a492cc873ea37fbe37f487d012ea4c5850e6dc9023113c71eb7436.exe
2520	3536198df2a492cc873ea37fbe37f487d012ea4c5850e6dc9023113c71eb7436mgr.exe
2520	3536198df2a492cc873ea37fbe37f487d012ea4c5850e6dc9023113c71eb7436mgr.exe
2520	3536198df2a492cc873ea37fbe37f487d012ea4c5850e6dc9023113c71eb7436mgr.exe
2520	3536198df2a492cc873ea37fbe37f487d012ea4c5850e6dc9023113c71eb7436mgr.exe
2520	3536198df2a492cc873ea37fbe37f487d012ea4c5850e6dc9023113c71eb7436mgr.exe
2520	3536198df2a492cc873ea37fbe37f487d012ea4c5850e6dc9023113c71eb7436mgr.exe
428	3536198df2a492cc873ea37fbe37f487d012ea4c5850e6dc9023113c71eb7436.exe
428	3536198df2a492cc873ea37fbe37f487d012ea4c5850e6dc9023113c71eb7436.exe
428	3536198df2a492cc873ea37fbe37f487d012ea4c5850e6dc9023113c71eb7436.exe
428	3536198df2a492cc873ea37fbe37f487d012ea4c5850e6dc9023113c71eb7436.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

5076 iexplore.exe

pid	process
5076	iexplore.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

3536198df2a492cc873ea37fbe37f487d012ea4c5850e6dc9023113c71eb7436mgr.exe3536198df2a492cc873ea37fbe37f487d012ea4c5850e6dc9023113c71eb7436.exe

description	pid	process
Token: SeDebugPrivilege	2520	3536198df2a492cc873ea37fbe37f487d012ea4c5850e6dc9023113c71eb7436mgr.exe
Token: SeDebugPrivilege	428	3536198df2a492cc873ea37fbe37f487d012ea4c5850e6dc9023113c71eb7436.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

5076 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

5076 iexplore.exe
5076 iexplore.exe
2292 IEXPLORE.EXE
2292 IEXPLORE.EXE
2292 IEXPLORE.EXE
2292 IEXPLORE.EXE

pid	process
5076	iexplore.exe

pid	process
5076	iexplore.exe
5076	iexplore.exe
2292	IEXPLORE.EXE
2292	IEXPLORE.EXE
2292	IEXPLORE.EXE
2292	IEXPLORE.EXE

Suspicious use of UnmapMainImage 2 IoCs

Processes:

3536198df2a492cc873ea37fbe37f487d012ea4c5850e6dc9023113c71eb7436.exe3536198df2a492cc873ea37fbe37f487d012ea4c5850e6dc9023113c71eb7436mgr.exe

pid	process
428	3536198df2a492cc873ea37fbe37f487d012ea4c5850e6dc9023113c71eb7436.exe
2520	3536198df2a492cc873ea37fbe37f487d012ea4c5850e6dc9023113c71eb7436mgr.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

3536198df2a492cc873ea37fbe37f487d012ea4c5850e6dc9023113c71eb7436.exe3536198df2a492cc873ea37fbe37f487d012ea4c5850e6dc9023113c71eb7436mgr.exeiexplore.exe

description	pid	process	target process
PID 428 wrote to memory of 2520	428	3536198df2a492cc873ea37fbe37f487d012ea4c5850e6dc9023113c71eb7436.exe	3536198df2a492cc873ea37fbe37f487d012ea4c5850e6dc9023113c71eb7436mgr.exe
PID 428 wrote to memory of 2520	428	3536198df2a492cc873ea37fbe37f487d012ea4c5850e6dc9023113c71eb7436.exe	3536198df2a492cc873ea37fbe37f487d012ea4c5850e6dc9023113c71eb7436mgr.exe
PID 428 wrote to memory of 2520	428	3536198df2a492cc873ea37fbe37f487d012ea4c5850e6dc9023113c71eb7436.exe	3536198df2a492cc873ea37fbe37f487d012ea4c5850e6dc9023113c71eb7436mgr.exe
PID 2520 wrote to memory of 4336	2520	3536198df2a492cc873ea37fbe37f487d012ea4c5850e6dc9023113c71eb7436mgr.exe	iexplore.exe
PID 2520 wrote to memory of 4336	2520	3536198df2a492cc873ea37fbe37f487d012ea4c5850e6dc9023113c71eb7436mgr.exe	iexplore.exe
PID 428 wrote to memory of 5076	428	3536198df2a492cc873ea37fbe37f487d012ea4c5850e6dc9023113c71eb7436.exe	iexplore.exe
PID 428 wrote to memory of 5076	428	3536198df2a492cc873ea37fbe37f487d012ea4c5850e6dc9023113c71eb7436.exe	iexplore.exe
PID 5076 wrote to memory of 2292	5076	iexplore.exe	IEXPLORE.EXE
PID 5076 wrote to memory of 2292	5076	iexplore.exe	IEXPLORE.EXE
PID 5076 wrote to memory of 2292	5076	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\3536198df2a492cc873ea37fbe37f487d012ea4c5850e6dc9023113c71eb7436.exe
"C:\Users\Admin\AppData\Local\Temp\3536198df2a492cc873ea37fbe37f487d012ea4c5850e6dc9023113c71eb7436.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:428

C:\Users\Admin\AppData\Local\Temp\3536198df2a492cc873ea37fbe37f487d012ea4c5850e6dc9023113c71eb7436mgr.exe
C:\Users\Admin\AppData\Local\Temp\3536198df2a492cc873ea37fbe37f487d012ea4c5850e6dc9023113c71eb7436mgr.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2520

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
- Modifies Internet Explorer settings
PID:4336

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
2⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5076

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5076 CREDAT:17410 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2292

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
471B

MD5
e32d02ce684c01ef3af05fae9066160e

SHA1
29c7a6e8ed553ac2765634265d1db041d6d422ec

SHA256
b00322d178a6cfc206458c26b26d6c80596073bb3283dcc3fc4e33a4b5f29d71

SHA512
e4e3175fb131095e4681ecb76d14dc74d059c0beafb6340965516c6d3d0538deb314b36a3f09df03b491edac84d5c0580e764fed1d8bca9abd4e65cb56167148

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
434B

MD5
b0805f4e7a0e1097f06666c2c7fb6258

SHA1
aed1cd5a47c14337a2f466017b14d8d1d3957528

SHA256
8e89555ec29e872a1438260acf5cc27360c247af708330a337bde5f7cffd3843

SHA512
0ad13cbce2b872e7573623358cc57127ecc81e019d09738e30a425fcd41dd040e4b57368bfc7277dc8f5bcae8416c4486267ad97e3fdcee2794720df9f5c9a0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\3536198df2a492cc873ea37fbe37f487d012ea4c5850e6dc9023113c71eb7436mgr.exe
Filesize
91KB

MD5
551161ba25d6c58cf6a4afe7587f7dcb

SHA1
3f36d947c0d082433bb121a9914b4841ffbfb5af

SHA256
f676ab20252c6ff437c7e3db1a8a3875715bf1a5a59812439f296cb5cd724b58

SHA512
f68a52bcfafccaf9b4390f7cdd9a57544d82a1f41656aeaf98f46ddc0198e636a790088cf8b734244cc5144a00704a8430e469c46284387d04c5a38cba17b00e

Download Submit
C:\Users\Admin\AppData\Local\Temp\3536198df2a492cc873ea37fbe37f487d012ea4c5850e6dc9023113c71eb7436mgr.exe
Filesize
91KB

MD5
551161ba25d6c58cf6a4afe7587f7dcb

SHA1
3f36d947c0d082433bb121a9914b4841ffbfb5af

SHA256
f676ab20252c6ff437c7e3db1a8a3875715bf1a5a59812439f296cb5cd724b58

SHA512
f68a52bcfafccaf9b4390f7cdd9a57544d82a1f41656aeaf98f46ddc0198e636a790088cf8b734244cc5144a00704a8430e469c46284387d04c5a38cba17b00e

Download Submit
memory/428-147-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/428-132-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/428-150-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/428-145-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2520-140-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2520-146-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2520-149-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2520-148-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2520-144-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2520-151-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2520-143-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2520-133-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads