ramnit | 0ff4e71aa98a2ad56e1202a59efcf05c8b5e2c0f98fced5af41cb3410bcf299e | Triage

Sharing

General

Target

0ff4e71aa98a2ad56e1202a59efcf05c8b5e2c0f98fced5af41cb3410bcf299e
Size

164KB
Sample

221123-xc5kjaef49
MD5

558b96b1644a5c38e1daa67107d06307
SHA1

e8a1324ce6b55f1e0376466c275ef75abbfb2683
SHA256

0ff4e71aa98a2ad56e1202a59efcf05c8b5e2c0f98fced5af41cb3410bcf299e
SHA512

bc3bf44aeae09e6c197f61e2c89ae3390308230ac2c74e1ba3e71bb0ac382bdd6f9724bfcc8e6b1cc077e0a01ea3783292a9ba8fd5df141641502dc1c82657b2
SSDEEP

3072:dGJ1uCEt8tOF5pU+F+X+AWVcupt3hhY1vpUZyzAmf0CSK7nEo69RLwv69dRmqe2v:QJnobn+m+1qB8A4kgqe21Vzn

Score

10^/10

ramnit banker evasion persistence spyware stealer trojan worm

Malware Config

Targets

- Target
  
  0ff4e71aa98a2ad56e1202a59efcf05c8b5e2c0f98fced5af41cb3410bcf299e
- Size
  
  164KB
- MD5
  
  558b96b1644a5c38e1daa67107d06307
- SHA1
  
  e8a1324ce6b55f1e0376466c275ef75abbfb2683
- SHA256
  
  0ff4e71aa98a2ad56e1202a59efcf05c8b5e2c0f98fced5af41cb3410bcf299e
- SHA512
  
  bc3bf44aeae09e6c197f61e2c89ae3390308230ac2c74e1ba3e71bb0ac382bdd6f9724bfcc8e6b1cc077e0a01ea3783292a9ba8fd5df141641502dc1c82657b2
- SSDEEP
  
  3072:dGJ1uCEt8tOF5pU+F+X+AWVcupt3hhY1vpUZyzAmf0CSK7nEo69RLwv69dRmqe2v:QJnobn+m+1qB8A4kgqe21Vzn
Score

10^/10

ramnit banker evasion persistence spyware stealer trojan worm
- Modifies WinLogon for persistence
  persistence
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- UAC bypass
  evasion trojan
- Executes dropped EXE
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ramnitbankerevasionpersistencespywarestealertrojanworm

behavioral2