ramnit | fb23a49817bffc0851ef3a1186414a5434e0fce90788be1bfba0fde8969f833b

Analysis

max time kernel
150s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 07:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fb23a49817bffc0851ef3a1186414a5434e0fce90788be1bfba0fde8969f833b.dll
Size

321KB
MD5

09b0f54b3f2c2674ce9f2adfedd166b0
SHA1

8f0e7f2287f39382bb5aea88f6ff3fbb0bae3fa0
SHA256

fb23a49817bffc0851ef3a1186414a5434e0fce90788be1bfba0fde8969f833b
SHA512

188428f80f4fbeb9aec130d8d9f6a4a9d5d276a4bbeb3963a2a03c8fb7df62b8847844f1e495b70577794d756e381f85095b1b9a7a2cba8074faadcef8e8926a
SSDEEP

6144:1is9PaG1wvxJaNxqcucvCN6RMYRBKgrFZpXBzXpEeq:Ys9SG16xJavqhcvCNYMYRBTF/hmeq

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Executes dropped EXE 1 IoCs

pid	Process
1336	rundll32mgr.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1336-67-0x0000000000400000-0x0000000000476000-memory.dmp	upx

Loads dropped DLL 4 IoCs

pid	Process
1360	rundll32.exe
1360	rundll32.exe
1336	rundll32mgr.exe
1336	rundll32mgr.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1508	1360	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1336	rundll32mgr.exe

Suspicious behavior: MapViewOfSection 25 IoCs

pid	Process
1336	rundll32mgr.exe
1336	rundll32mgr.exe
1336	rundll32mgr.exe
1336	rundll32mgr.exe
1336	rundll32mgr.exe
1336	rundll32mgr.exe
1336	rundll32mgr.exe
1336	rundll32mgr.exe
1336	rundll32mgr.exe
1336	rundll32mgr.exe
1336	rundll32mgr.exe
1336	rundll32mgr.exe
1336	rundll32mgr.exe
1336	rundll32mgr.exe
1336	rundll32mgr.exe
1336	rundll32mgr.exe
1336	rundll32mgr.exe
1336	rundll32mgr.exe
1336	rundll32mgr.exe
1336	rundll32mgr.exe
1336	rundll32mgr.exe
1336	rundll32mgr.exe
1336	rundll32mgr.exe
1336	rundll32mgr.exe
1336	rundll32mgr.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1336	rundll32mgr.exe
Token: SeDebugPrivilege	1336	rundll32mgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1356 wrote to memory of 1360	1356	rundll32.exe	28
PID 1356 wrote to memory of 1360	1356	rundll32.exe	28
PID 1356 wrote to memory of 1360	1356	rundll32.exe	28
PID 1356 wrote to memory of 1360	1356	rundll32.exe	28
PID 1356 wrote to memory of 1360	1356	rundll32.exe	28
PID 1356 wrote to memory of 1360	1356	rundll32.exe	28
PID 1356 wrote to memory of 1360	1356	rundll32.exe	28
PID 1360 wrote to memory of 1336	1360	rundll32.exe	29
PID 1360 wrote to memory of 1336	1360	rundll32.exe	29
PID 1360 wrote to memory of 1336	1360	rundll32.exe	29
PID 1360 wrote to memory of 1336	1360	rundll32.exe	29
PID 1360 wrote to memory of 1508	1360	rundll32.exe	30
PID 1360 wrote to memory of 1508	1360	rundll32.exe	30
PID 1360 wrote to memory of 1508	1360	rundll32.exe	30
PID 1360 wrote to memory of 1508	1360	rundll32.exe	30
PID 1336 wrote to memory of 368	1336	rundll32mgr.exe	5
PID 1336 wrote to memory of 368	1336	rundll32mgr.exe	5
PID 1336 wrote to memory of 368	1336	rundll32mgr.exe	5
PID 1336 wrote to memory of 368	1336	rundll32mgr.exe	5
PID 1336 wrote to memory of 368	1336	rundll32mgr.exe	5
PID 1336 wrote to memory of 368	1336	rundll32mgr.exe	5
PID 1336 wrote to memory of 368	1336	rundll32mgr.exe	5
PID 1336 wrote to memory of 376	1336	rundll32mgr.exe	4
PID 1336 wrote to memory of 376	1336	rundll32mgr.exe	4
PID 1336 wrote to memory of 376	1336	rundll32mgr.exe	4
PID 1336 wrote to memory of 376	1336	rundll32mgr.exe	4
PID 1336 wrote to memory of 376	1336	rundll32mgr.exe	4
PID 1336 wrote to memory of 376	1336	rundll32mgr.exe	4
PID 1336 wrote to memory of 376	1336	rundll32mgr.exe	4
PID 1336 wrote to memory of 416	1336	rundll32mgr.exe	3
PID 1336 wrote to memory of 416	1336	rundll32mgr.exe	3
PID 1336 wrote to memory of 416	1336	rundll32mgr.exe	3
PID 1336 wrote to memory of 416	1336	rundll32mgr.exe	3
PID 1336 wrote to memory of 416	1336	rundll32mgr.exe	3
PID 1336 wrote to memory of 416	1336	rundll32mgr.exe	3
PID 1336 wrote to memory of 416	1336	rundll32mgr.exe	3
PID 1336 wrote to memory of 460	1336	rundll32mgr.exe	2
PID 1336 wrote to memory of 460	1336	rundll32mgr.exe	2
PID 1336 wrote to memory of 460	1336	rundll32mgr.exe	2
PID 1336 wrote to memory of 460	1336	rundll32mgr.exe	2
PID 1336 wrote to memory of 460	1336	rundll32mgr.exe	2
PID 1336 wrote to memory of 460	1336	rundll32mgr.exe	2
PID 1336 wrote to memory of 460	1336	rundll32mgr.exe	2
PID 1336 wrote to memory of 476	1336	rundll32mgr.exe	1
PID 1336 wrote to memory of 476	1336	rundll32mgr.exe	1
PID 1336 wrote to memory of 476	1336	rundll32mgr.exe	1
PID 1336 wrote to memory of 476	1336	rundll32mgr.exe	1
PID 1336 wrote to memory of 476	1336	rundll32mgr.exe	1
PID 1336 wrote to memory of 476	1336	rundll32mgr.exe	1
PID 1336 wrote to memory of 476	1336	rundll32mgr.exe	1
PID 1336 wrote to memory of 484	1336	rundll32mgr.exe	27
PID 1336 wrote to memory of 484	1336	rundll32mgr.exe	27
PID 1336 wrote to memory of 484	1336	rundll32mgr.exe	27
PID 1336 wrote to memory of 484	1336	rundll32mgr.exe	27
PID 1336 wrote to memory of 484	1336	rundll32mgr.exe	27
PID 1336 wrote to memory of 484	1336	rundll32mgr.exe	27
PID 1336 wrote to memory of 484	1336	rundll32mgr.exe	27
PID 1336 wrote to memory of 596	1336	rundll32mgr.exe	26
PID 1336 wrote to memory of 596	1336	rundll32mgr.exe	26
PID 1336 wrote to memory of 596	1336	rundll32mgr.exe	26
PID 1336 wrote to memory of 596	1336	rundll32mgr.exe	26
PID 1336 wrote to memory of 596	1336	rundll32mgr.exe	26
PID 1336 wrote to memory of 596	1336	rundll32mgr.exe	26
PID 1336 wrote to memory of 596	1336	rundll32mgr.exe	26

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:476

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:460
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:756
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:672
- C:\Windows\system32\taskhost.exe
  "taskhost.exe"
  2⤵
  PID:1148
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
  2⤵
  PID:1112
- C:\Windows\system32\sppsvc.exe
  C:\Windows\system32\sppsvc.exe
  2⤵
  PID:1668
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  2⤵
  PID:1060
- C:\Windows\System32\spoolsv.exe
  C:\Windows\System32\spoolsv.exe
  2⤵
  PID:1028
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k NetworkService
  2⤵
  PID:272
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  PID:876
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalService
  2⤵
  PID:848
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  2⤵
  PID:808
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  PID:596

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:416

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:376
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:484

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:368

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
PID:1932

\\?\C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:2012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1272
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb23a49817bffc0851ef3a1186414a5434e0fce90788be1bfba0fde8969f833b.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1356
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb23a49817bffc0851ef3a1186414a5434e0fce90788be1bfba0fde8969f833b.dll,#1
    3⤵
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:1360
  - - C:\Windows\SysWOW64\rundll32mgr.exe
      C:\Windows\SysWOW64\rundll32mgr.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1336
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1360 -s 228
      4⤵
      Program crash
      PID:1508

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1236

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
212KB

MD5
d143b49e7630a2ed55839138b611896b

SHA1
93a28da6fbfc26cac63d1b89c116289f189b9ce3

SHA256
784b3b57be846dcd9d3b28cc783bd722b7a87d56a02555379f366e4a88c48e0e

SHA512
2aae97e3f92bfbc3636072d4577d030a006297f4893d080a312868dc3bcc3c86cd485b8d2d912ac245502df8a8ab893f28988c2c4be7c1d5a20b2522c2cfec5a

Download Submit
\Users\Admin\AppData\Local\Temp\~TM58FA.tmp

Filesize
1.2MB

MD5
d124f55b9393c976963407dff51ffa79

SHA1
2c7bbedd79791bfb866898c85b504186db610b5d

SHA256
ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef

SHA512
278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06

Download Submit
\Users\Admin\AppData\Local\Temp\~TM5968.tmp

Filesize
1.1MB

MD5
9b98d47916ead4f69ef51b56b0c2323c

SHA1
290a80b4ded0efc0fd00816f373fcea81a521330

SHA256
96e0ae104c9662d0d20fdf59844c2d18334e5847b6c4fc7f8ce4b3b87f39887b

SHA512
68b67021f228d8d71df4deb0b6388558b2f935a6aa466a12199cd37ada47ee588ea407b278d190d3a498b0ef3f5f1a2573a469b7ea5561ab2e7055c45565fe94

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
212KB

MD5
d143b49e7630a2ed55839138b611896b

SHA1
93a28da6fbfc26cac63d1b89c116289f189b9ce3

SHA256
784b3b57be846dcd9d3b28cc783bd722b7a87d56a02555379f366e4a88c48e0e

SHA512
2aae97e3f92bfbc3636072d4577d030a006297f4893d080a312868dc3bcc3c86cd485b8d2d912ac245502df8a8ab893f28988c2c4be7c1d5a20b2522c2cfec5a

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
212KB

MD5
d143b49e7630a2ed55839138b611896b

SHA1
93a28da6fbfc26cac63d1b89c116289f189b9ce3

SHA256
784b3b57be846dcd9d3b28cc783bd722b7a87d56a02555379f366e4a88c48e0e

SHA512
2aae97e3f92bfbc3636072d4577d030a006297f4893d080a312868dc3bcc3c86cd485b8d2d912ac245502df8a8ab893f28988c2c4be7c1d5a20b2522c2cfec5a

Download Submit
memory/1336-67-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/1336-68-0x0000000000270000-0x00000000002E6000-memory.dmp

Filesize
472KB

Download
memory/1336-60-0x0000000000000000-mapping.dmp

Download
memory/1336-62-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/1336-69-0x0000000077320000-0x00000000774A0000-memory.dmp

Filesize
1.5MB

Download
memory/1360-70-0x000000007EFA0000-0x000000007EFAC000-memory.dmp

Filesize
48KB

Download
memory/1360-55-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/1360-54-0x0000000000000000-mapping.dmp

Download
memory/1360-56-0x0000000010000000-0x0000000010056000-memory.dmp

Filesize
344KB

Download
memory/1360-58-0x00000000001C0000-0x0000000000236000-memory.dmp

Filesize
472KB

Download
memory/1360-71-0x00000000001C0000-0x0000000000236000-memory.dmp

Filesize
472KB

Download
memory/1360-72-0x000000007EFA0000-0x000000007EFAC000-memory.dmp

Filesize
48KB

Download
memory/1360-73-0x0000000010000000-0x0000000010056000-memory.dmp

Filesize
344KB

Download
memory/1508-64-0x0000000000000000-mapping.dmp

Download