ramnit | 4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd

General

Target

4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe
Size

74KB
MD5

f116cedde9163897dc12ad927c24b393
SHA1

ed1d329cf0ccdbfc8f63d6b91f2c22fb223dec7c
SHA256

4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd
SHA512

4cedd4f90835c127f5525461ce7a47990da59af8bcb7910814457e228edf53090773ad2c2bc4ae4ab46b23db407461663dca481c2ceeba70e0c14dfb8c583c95
SSDEEP

1536:2+hzRsibKplyXTq8OGRnsPFG+RODTb7MXL5uXZnzEwBdKCEp:lROzoTq0+RO7IwnYwB/6

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2028-55-0x0000000000400000-0x0000000000433000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

Processes:

4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px2A7B.tmp	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe

pid process

2028 4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe

Suspicious behavior: MapViewOfSection 22 IoCs

Processes:

4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe

pid	process
2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe
2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe
2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe
2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe
2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe
2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe
2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe
2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe
2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe
2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe
2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe
2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe
2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe
2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe
2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe
2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe
2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe
2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe
2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe
2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe
2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe
2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe

description pid process

Token: SeDebugPrivilege 2028 4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe

description	pid	process
Token: SeDebugPrivilege	2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe

description	pid	process	target process
PID 2028 wrote to memory of 372	2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe	wininit.exe
PID 2028 wrote to memory of 372	2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe	wininit.exe
PID 2028 wrote to memory of 372	2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe	wininit.exe
PID 2028 wrote to memory of 372	2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe	wininit.exe
PID 2028 wrote to memory of 372	2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe	wininit.exe
PID 2028 wrote to memory of 372	2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe	wininit.exe
PID 2028 wrote to memory of 388	2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe	csrss.exe
PID 2028 wrote to memory of 388	2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe	csrss.exe
PID 2028 wrote to memory of 388	2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe	csrss.exe
PID 2028 wrote to memory of 388	2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe	csrss.exe
PID 2028 wrote to memory of 388	2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe	csrss.exe
PID 2028 wrote to memory of 388	2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe	csrss.exe
PID 2028 wrote to memory of 424	2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe	winlogon.exe
PID 2028 wrote to memory of 424	2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe	winlogon.exe
PID 2028 wrote to memory of 424	2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe	winlogon.exe
PID 2028 wrote to memory of 424	2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe	winlogon.exe
PID 2028 wrote to memory of 424	2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe	winlogon.exe
PID 2028 wrote to memory of 424	2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe	winlogon.exe
PID 2028 wrote to memory of 468	2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe	services.exe
PID 2028 wrote to memory of 468	2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe	services.exe
PID 2028 wrote to memory of 468	2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe	services.exe
PID 2028 wrote to memory of 468	2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe	services.exe
PID 2028 wrote to memory of 468	2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe	services.exe
PID 2028 wrote to memory of 468	2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe	services.exe
PID 2028 wrote to memory of 484	2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe	lsass.exe
PID 2028 wrote to memory of 484	2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe	lsass.exe
PID 2028 wrote to memory of 484	2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe	lsass.exe
PID 2028 wrote to memory of 484	2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe	lsass.exe
PID 2028 wrote to memory of 484	2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe	lsass.exe
PID 2028 wrote to memory of 484	2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe	lsass.exe
PID 2028 wrote to memory of 492	2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe	lsm.exe
PID 2028 wrote to memory of 492	2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe	lsm.exe
PID 2028 wrote to memory of 492	2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe	lsm.exe
PID 2028 wrote to memory of 492	2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe	lsm.exe
PID 2028 wrote to memory of 492	2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe	lsm.exe
PID 2028 wrote to memory of 492	2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe	lsm.exe
PID 2028 wrote to memory of 592	2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe	svchost.exe
PID 2028 wrote to memory of 592	2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe	svchost.exe
PID 2028 wrote to memory of 592	2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe	svchost.exe
PID 2028 wrote to memory of 592	2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe	svchost.exe
PID 2028 wrote to memory of 592	2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe	svchost.exe
PID 2028 wrote to memory of 592	2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe	svchost.exe
PID 2028 wrote to memory of 668	2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe	svchost.exe
PID 2028 wrote to memory of 668	2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe	svchost.exe
PID 2028 wrote to memory of 668	2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe	svchost.exe
PID 2028 wrote to memory of 668	2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe	svchost.exe
PID 2028 wrote to memory of 668	2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe	svchost.exe
PID 2028 wrote to memory of 668	2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe	svchost.exe
PID 2028 wrote to memory of 752	2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe	svchost.exe
PID 2028 wrote to memory of 752	2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe	svchost.exe
PID 2028 wrote to memory of 752	2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe	svchost.exe
PID 2028 wrote to memory of 752	2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe	svchost.exe
PID 2028 wrote to memory of 752	2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe	svchost.exe
PID 2028 wrote to memory of 752	2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe	svchost.exe
PID 2028 wrote to memory of 804	2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe	svchost.exe
PID 2028 wrote to memory of 804	2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe	svchost.exe
PID 2028 wrote to memory of 804	2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe	svchost.exe
PID 2028 wrote to memory of 804	2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe	svchost.exe
PID 2028 wrote to memory of 804	2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe	svchost.exe
PID 2028 wrote to memory of 804	2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe	svchost.exe
PID 2028 wrote to memory of 840	2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe	svchost.exe
PID 2028 wrote to memory of 840	2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe	svchost.exe
PID 2028 wrote to memory of 840	2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe	svchost.exe
PID 2028 wrote to memory of 840	2028	4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe	svchost.exe

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:484

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:468

C:\Windows\system32\sppsvc.exe
C:\Windows\system32\sppsvc.exe
2⤵
PID:548

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
2⤵
PID:272

C:\Windows\system32\taskhost.exe
"taskhost.exe"
2⤵
PID:1132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
2⤵
PID:1040

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
2⤵
PID:328

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService
2⤵
PID:280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
2⤵
PID:872

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
2⤵
PID:840

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
2⤵
PID:804

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
2⤵
PID:752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS
2⤵
PID:668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
2⤵
PID:592

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:424

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
PID:1968

\\?\C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:1828

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1276

C:\Users\Admin\AppData\Local\Temp\4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe
"C:\Users\Admin\AppData\Local\Temp\4d4756ecb5a682ca454921995cb87db64566416d61bc8c56461c7d145c96e9fd.exe"
2⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2028

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1236

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
1⤵
PID:492

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:388

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:372

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2028-54-0x00000000767B1000-0x00000000767B3000-memory.dmp

Filesize
8KB

Download
memory/2028-55-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads