ramnit | a08eb70a986e86ce95956c6d5a6309c373377cef988110402f504f4281fd24b3

Analysis

max time kernel
101s
max time network
146s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 09:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a08eb70a986e86ce95956c6d5a6309c373377cef988110402f504f4281fd24b3.exe
Size

607KB
MD5

589612fdc4e76a0ba365c88c05c9b384
SHA1

94258310104f59fc15ba786d52526f3f1f304c04
SHA256

a08eb70a986e86ce95956c6d5a6309c373377cef988110402f504f4281fd24b3
SHA512

54daffb7d0dd5a22b1a2fc82c2f014b682156ca80c683925a20b89678c080e8ad01fd6802f1534d1515dc8d11d10797c8bb29035cbc81673c3f2fe4cf90be032
SSDEEP

12288:9XehPUyg4bUfpGJVQEGkA31VSztRAl7eXIk6NNiDb2IpFmFtIUvSSd:h68xcUUJiOu1GAdeYkqNin2mFmFtxV

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Executes dropped EXE 1 IoCs

pid	Process
1776	a08eb70a986e86ce95956c6d5a6309c373377cef988110402f504f4281fd24b3mgr.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000a0000000134f2-58.dat	upx
behavioral1/files/0x000a0000000134f2-56.dat	upx
behavioral1/files/0x000a0000000134f2-55.dat	upx
behavioral1/memory/1632-59-0x0000000000400000-0x0000000000B3F000-memory.dmp	upx
behavioral1/memory/1776-62-0x0000000000400000-0x0000000000463000-memory.dmp	upx
behavioral1/memory/1776-63-0x0000000000400000-0x0000000000463000-memory.dmp	upx

Loads dropped DLL 2 IoCs

pid	Process
1632	a08eb70a986e86ce95956c6d5a6309c373377cef988110402f504f4281fd24b3.exe
1632	a08eb70a986e86ce95956c6d5a6309c373377cef988110402f504f4281fd24b3.exe

Modifies Internet Explorer settings 1 TTPs 54 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{391E8371-6EE3-11ED-BB5A-5A9C998014C3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376380747"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{391EAA81-6EE3-11ED-BB5A-5A9C998014C3} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
1632	a08eb70a986e86ce95956c6d5a6309c373377cef988110402f504f4281fd24b3.exe
1776	a08eb70a986e86ce95956c6d5a6309c373377cef988110402f504f4281fd24b3mgr.exe
1776	a08eb70a986e86ce95956c6d5a6309c373377cef988110402f504f4281fd24b3mgr.exe
1776	a08eb70a986e86ce95956c6d5a6309c373377cef988110402f504f4281fd24b3mgr.exe
1776	a08eb70a986e86ce95956c6d5a6309c373377cef988110402f504f4281fd24b3mgr.exe
1776	a08eb70a986e86ce95956c6d5a6309c373377cef988110402f504f4281fd24b3mgr.exe
1776	a08eb70a986e86ce95956c6d5a6309c373377cef988110402f504f4281fd24b3mgr.exe
1776	a08eb70a986e86ce95956c6d5a6309c373377cef988110402f504f4281fd24b3mgr.exe
1776	a08eb70a986e86ce95956c6d5a6309c373377cef988110402f504f4281fd24b3mgr.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1776	a08eb70a986e86ce95956c6d5a6309c373377cef988110402f504f4281fd24b3mgr.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1188	iexplore.exe
932	iexplore.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
1632	a08eb70a986e86ce95956c6d5a6309c373377cef988110402f504f4281fd24b3.exe
1632	a08eb70a986e86ce95956c6d5a6309c373377cef988110402f504f4281fd24b3.exe
932	iexplore.exe
1188	iexplore.exe
932	iexplore.exe
1188	iexplore.exe
1648	IEXPLORE.EXE
1648	IEXPLORE.EXE
300	IEXPLORE.EXE
300	IEXPLORE.EXE
300	IEXPLORE.EXE
300	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 1776	1632	a08eb70a986e86ce95956c6d5a6309c373377cef988110402f504f4281fd24b3.exe	28
PID 1632 wrote to memory of 1776	1632	a08eb70a986e86ce95956c6d5a6309c373377cef988110402f504f4281fd24b3.exe	28
PID 1632 wrote to memory of 1776	1632	a08eb70a986e86ce95956c6d5a6309c373377cef988110402f504f4281fd24b3.exe	28
PID 1632 wrote to memory of 1776	1632	a08eb70a986e86ce95956c6d5a6309c373377cef988110402f504f4281fd24b3.exe	28
PID 1776 wrote to memory of 932	1776	a08eb70a986e86ce95956c6d5a6309c373377cef988110402f504f4281fd24b3mgr.exe	29
PID 1776 wrote to memory of 932	1776	a08eb70a986e86ce95956c6d5a6309c373377cef988110402f504f4281fd24b3mgr.exe	29
PID 1776 wrote to memory of 932	1776	a08eb70a986e86ce95956c6d5a6309c373377cef988110402f504f4281fd24b3mgr.exe	29
PID 1776 wrote to memory of 932	1776	a08eb70a986e86ce95956c6d5a6309c373377cef988110402f504f4281fd24b3mgr.exe	29
PID 1776 wrote to memory of 1188	1776	a08eb70a986e86ce95956c6d5a6309c373377cef988110402f504f4281fd24b3mgr.exe	30
PID 1776 wrote to memory of 1188	1776	a08eb70a986e86ce95956c6d5a6309c373377cef988110402f504f4281fd24b3mgr.exe	30
PID 1776 wrote to memory of 1188	1776	a08eb70a986e86ce95956c6d5a6309c373377cef988110402f504f4281fd24b3mgr.exe	30
PID 1776 wrote to memory of 1188	1776	a08eb70a986e86ce95956c6d5a6309c373377cef988110402f504f4281fd24b3mgr.exe	30
PID 932 wrote to memory of 1648	932	iexplore.exe	33
PID 932 wrote to memory of 1648	932	iexplore.exe	33
PID 932 wrote to memory of 1648	932	iexplore.exe	33
PID 932 wrote to memory of 1648	932	iexplore.exe	33
PID 1188 wrote to memory of 300	1188	iexplore.exe	32
PID 1188 wrote to memory of 300	1188	iexplore.exe	32
PID 1188 wrote to memory of 300	1188	iexplore.exe	32
PID 1188 wrote to memory of 300	1188	iexplore.exe	32

C:\Users\Admin\AppData\Local\Temp\a08eb70a986e86ce95956c6d5a6309c373377cef988110402f504f4281fd24b3.exe
"C:\Users\Admin\AppData\Local\Temp\a08eb70a986e86ce95956c6d5a6309c373377cef988110402f504f4281fd24b3.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Users\Admin\AppData\Local\Temp\a08eb70a986e86ce95956c6d5a6309c373377cef988110402f504f4281fd24b3mgr.exe
  C:\Users\Admin\AppData\Local\Temp\a08eb70a986e86ce95956c6d5a6309c373377cef988110402f504f4281fd24b3mgr.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1776
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:932
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:932 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1648
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1188
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1188 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:300

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{391EAA81-6EE3-11ED-BB5A-5A9C998014C3}.dat

Filesize
3KB

MD5
1331451dfeaaf16f950a8350c7e8e684

SHA1
0dc97c285f58135464de0953b66c71855cca2a6d

SHA256
eaf4967ac94f78d86aac44eb0a796453a7f105e5997d804dcfdd7c1d9cba9f27

SHA512
be6d6d4bc17b4f025ab45006a23ddeca37f67887decf60e1861573332bac2728c57581cfdb778b5d374c54aa38e4f1a81a0d704c532a3468418ee8ee9a0f48e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\a08eb70a986e86ce95956c6d5a6309c373377cef988110402f504f4281fd24b3mgr.exe

Filesize
105KB

MD5
98a8ced05b34189b8b36760049b2ea36

SHA1
a5271250fb91d891c7df0cae7812ed68907ae076

SHA256
e50689964fa016ff34ad6517bb863e26e571f907635e719f1fe5e70a61763d95

SHA512
8548b7dc08007fe55e2b7f9bf502c7271655edff52100bb8445a321f37137139c0cd54f7f85558a2f99b38dd574c8435371adc07f8c365bf8a8561c63fe6be45

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\7OO8FANP.txt

Filesize
601B

MD5
3f3268dde30ce86a78872e9ec4ba9b36

SHA1
9862b6d46e58f976ac823fec93361e2e029b8066

SHA256
7cec4c08d8999d77598624604c9a5e73dc62627c41dc8846dc6d9c86dbf2ee3a

SHA512
fb6669039f0ac9c867fe7f101ab41013e89f4227c91c059ded93c88656939cc393f0b8a7119739bf48137b51ebb9d6a18015f02f20afdc4a9d706d4fd246c7e1

Download Submit
\Users\Admin\AppData\Local\Temp\a08eb70a986e86ce95956c6d5a6309c373377cef988110402f504f4281fd24b3mgr.exe

Filesize
105KB

MD5
98a8ced05b34189b8b36760049b2ea36

SHA1
a5271250fb91d891c7df0cae7812ed68907ae076

SHA256
e50689964fa016ff34ad6517bb863e26e571f907635e719f1fe5e70a61763d95

SHA512
8548b7dc08007fe55e2b7f9bf502c7271655edff52100bb8445a321f37137139c0cd54f7f85558a2f99b38dd574c8435371adc07f8c365bf8a8561c63fe6be45

Download Submit
\Users\Admin\AppData\Local\Temp\a08eb70a986e86ce95956c6d5a6309c373377cef988110402f504f4281fd24b3mgr.exe

Filesize
105KB

MD5
98a8ced05b34189b8b36760049b2ea36

SHA1
a5271250fb91d891c7df0cae7812ed68907ae076

SHA256
e50689964fa016ff34ad6517bb863e26e571f907635e719f1fe5e70a61763d95

SHA512
8548b7dc08007fe55e2b7f9bf502c7271655edff52100bb8445a321f37137139c0cd54f7f85558a2f99b38dd574c8435371adc07f8c365bf8a8561c63fe6be45

Download Submit
memory/1632-54-0x0000000074DA1000-0x0000000074DA3000-memory.dmp

Filesize
8KB

Download
memory/1632-59-0x0000000000400000-0x0000000000B3F000-memory.dmp

Filesize
7.2MB

Download
memory/1632-61-0x0000000000240000-0x00000000002A3000-memory.dmp

Filesize
396KB

Download
memory/1776-62-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/1776-63-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download