ramnit | 068a77415bcdb732b1b5f9578c35a9363c3d58c336710a14d048961929fbc19b | Triage

Submit
Reports

Overview

overview

Static

static

068a77415b...9b.dll

windows7-x64

068a77415b...9b.dll

windows10-2004-x64

Sharing

General

Target

068a77415bcdb732b1b5f9578c35a9363c3d58c336710a14d048961929fbc19b
Size

152KB
Sample

221128-yls4jace27
MD5

aeee83311a512ec9cf9b75f275393f71
SHA1

f352dc141d7fa94f03dc2e91e61e7b504e48d7a6
SHA256

068a77415bcdb732b1b5f9578c35a9363c3d58c336710a14d048961929fbc19b
SHA512

d20a925c7ab62758ea3f33ee5f470fbccd055cf076f1b38ea6716ebbe26192ff14155fa9b783eb4de5e6829d67215e6c460b88b8df096eca2ba874530f376e27
SSDEEP

3072:a4GYFgcGF5CAZjl/KRdG0hqwLx/igQXEkG+jHpP46LyvjpLi:ahYmCAZxKRdGk/AEkG2N3Y9Li

Score

10^/10

ramnit banker evasion persistence spyware stealer trojan worm

Static task

static1

Behavioral task

behavioral1

Sample

068a77415bcdb732b1b5f9578c35a9363c3d58c336710a14d048961929fbc19b.dll

Resource

win7-20221111-en

ramnit banker evasion persistence spyware stealer trojan worm

windows7-x64

18 signatures

150 seconds

Behavioral task

behavioral2

Sample

068a77415bcdb732b1b5f9578c35a9363c3d58c336710a14d048961929fbc19b.dll

Resource

win10v2004-20220812-en

ramnit banker evasion spyware stealer trojan worm

windows10-2004-x64

18 signatures

150 seconds

Malware Config

Targets

- Target
  
  068a77415bcdb732b1b5f9578c35a9363c3d58c336710a14d048961929fbc19b
- Size
  
  152KB
- MD5
  
  aeee83311a512ec9cf9b75f275393f71
- SHA1
  
  f352dc141d7fa94f03dc2e91e61e7b504e48d7a6
- SHA256
  
  068a77415bcdb732b1b5f9578c35a9363c3d58c336710a14d048961929fbc19b
- SHA512
  
  d20a925c7ab62758ea3f33ee5f470fbccd055cf076f1b38ea6716ebbe26192ff14155fa9b783eb4de5e6829d67215e6c460b88b8df096eca2ba874530f376e27
- SSDEEP
  
  3072:a4GYFgcGF5CAZjl/KRdG0hqwLx/igQXEkG+jHpP46LyvjpLi:ahYmCAZxKRdGk/AEkG2N3Y9Li
Score

10^/10

ramnit banker evasion persistence spyware stealer trojan worm
- Modifies WinLogon for persistence
  persistence
- Modifies firewall policy service
  evasion
- Modifies security service
  evasion
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Modify Registry

Bypass User Account Control

Disabling Security Tools

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

ramnitbankerevasionpersistencespywarestealertrojanworm

behavioral2

ramnitbankerevasionspywarestealertrojanworm

© 2018-2024

Terms | Privacy