ramnit | 8c64aa03f562565dd6d9cac1d7223870e6b0bd4814053d8f85b5d209860f8bef

Analysis

max time kernel
91s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 07:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8c64aa03f562565dd6d9cac1d7223870e6b0bd4814053d8f85b5d209860f8bef.dll
Size

502KB
MD5

2d8859eaec749d1deb324e3323613b92
SHA1

ca198d9246138f7fd94efac868977fd35d5b52f3
SHA256

8c64aa03f562565dd6d9cac1d7223870e6b0bd4814053d8f85b5d209860f8bef
SHA512

5b84a0b9778aafcbb360b71d70f0844fb822e7b6a4036b1a0a664a635c15f55373341348cb2faf8513696d2bab7208112f7ac30231562369387cd7911676166f
SSDEEP

12288:7xGCOXzURlbDC9K69u2m+SqOWcsQQKiY4leDDGoggH/VREG6j4Gm01bje4kHb16U:twXzU4kosOgHT

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Executes dropped EXE 3 IoCs

pid	Process
4208	rundll32mgr.exe
3888	rundll32mgrmgr.exe
3856	rundll32mgrmgrmgr.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4208-146-0x0000000000400000-0x0000000000474000-memory.dmp	upx
behavioral2/memory/3888-147-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral2/memory/3856-149-0x0000000000400000-0x0000000000443000-memory.dmp	upx

Loads dropped DLL 3 IoCs

pid	Process
4208	rundll32mgr.exe
3888	rundll32mgrmgr.exe
3856	rundll32mgrmgrmgr.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe
File created	C:\Windows\SysWOW64\rundll32mgrmgr.exe	rundll32mgr.exe
File created	C:\Windows\SysWOW64\rundll32mgrmgrmgr.exe	rundll32mgrmgr.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
4540	3888	WerFault.exe	81
612	3856	WerFault.exe	84
748	5056	WerFault.exe	79
3228	4208	WerFault.exe	80

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 5056	1640	rundll32.exe	79
PID 1640 wrote to memory of 5056	1640	rundll32.exe	79
PID 1640 wrote to memory of 5056	1640	rundll32.exe	79
PID 5056 wrote to memory of 4208	5056	rundll32.exe	80
PID 5056 wrote to memory of 4208	5056	rundll32.exe	80
PID 5056 wrote to memory of 4208	5056	rundll32.exe	80
PID 4208 wrote to memory of 3888	4208	rundll32mgr.exe	81
PID 4208 wrote to memory of 3888	4208	rundll32mgr.exe	81
PID 4208 wrote to memory of 3888	4208	rundll32mgr.exe	81
PID 3888 wrote to memory of 3856	3888	rundll32mgrmgr.exe	84
PID 3888 wrote to memory of 3856	3888	rundll32mgrmgr.exe	84
PID 3888 wrote to memory of 3856	3888	rundll32mgrmgr.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8c64aa03f562565dd6d9cac1d7223870e6b0bd4814053d8f85b5d209860f8bef.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8c64aa03f562565dd6d9cac1d7223870e6b0bd4814053d8f85b5d209860f8bef.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:5056
- - C:\Windows\SysWOW64\rundll32mgr.exe
    C:\Windows\SysWOW64\rundll32mgr.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:4208
  - - C:\Windows\SysWOW64\rundll32mgrmgr.exe
      C:\Windows\SysWOW64\rundll32mgrmgr.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:3888
    - - C:\Windows\SysWOW64\rundll32mgrmgrmgr.exe
        
        C:\Windows\SysWOW64\rundll32mgrmgrmgr.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3856
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3856 -s 10176
        6⤵
        Program crash
        
        PID:612
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3888 -s 10188
        5⤵
        Program crash
        
        PID:4540
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4208 -s 10184
      4⤵
      Program crash
      PID:3228
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5056 -s 628
    3⤵
    - Program crash
    PID:748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5056 -ip 5056
1⤵
PID:2240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4208 -ip 4208
1⤵
PID:4620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3888 -ip 3888
1⤵
PID:4136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3856 -ip 3856
1⤵
PID:2800

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~TM9EE4.tmp

Filesize
1.6MB

MD5
4f3387277ccbd6d1f21ac5c07fe4ca68

SHA1
e16506f662dc92023bf82def1d621497c8ab5890

SHA256
767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

SHA512
9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

Download Submit
C:\Users\Admin\AppData\Local\Temp\~TM9EE5.tmp

Filesize
1.6MB

MD5
4f3387277ccbd6d1f21ac5c07fe4ca68

SHA1
e16506f662dc92023bf82def1d621497c8ab5890

SHA256
767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

SHA512
9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

Download Submit
C:\Users\Admin\AppData\Local\Temp\~TM9EE6.tmp

Filesize
1.6MB

MD5
4f3387277ccbd6d1f21ac5c07fe4ca68

SHA1
e16506f662dc92023bf82def1d621497c8ab5890

SHA256
767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

SHA512
9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

Download Submit
C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
289KB

MD5
f3ae9533fd651e95eb9e300ac89b91c3

SHA1
610400db6f891dae9f6f26163f56c00b6b65ea67

SHA256
17f93c002b198347acd038d0e32157e04a61dbc2fed3a7696ed70d04b9954f90

SHA512
51e5ee1ce9177667feb1d2b279895755a39f694d785b6beac77f468a4ec4de1525ae14d403641fb556541f0687f7a7a5e6512aab97602a05d5f7f725c0cc24fd

Download Submit
C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
289KB

MD5
f3ae9533fd651e95eb9e300ac89b91c3

SHA1
610400db6f891dae9f6f26163f56c00b6b65ea67

SHA256
17f93c002b198347acd038d0e32157e04a61dbc2fed3a7696ed70d04b9954f90

SHA512
51e5ee1ce9177667feb1d2b279895755a39f694d785b6beac77f468a4ec4de1525ae14d403641fb556541f0687f7a7a5e6512aab97602a05d5f7f725c0cc24fd

Download Submit
C:\Windows\SysWOW64\rundll32mgrmgr.exe

Filesize
191KB

MD5
f18da83e138d9cd9b2eb6cbfbb516720

SHA1
1bca6d0f0b70bbaf536c4d4d9090cc47f200b54b

SHA256
3d15a457cc3f7d38f1a8092be7cff6a435feef279cb9ac4c1ab89a7e7e0527f4

SHA512
63fb76b5e529efb7f4c831d48654409b93e85796f83ec43a7649aa4f16b01585bc7215e301074a22a665c73216bfffebddb2e0d244f3be3f0887a2eb41ed003e

Download Submit
C:\Windows\SysWOW64\rundll32mgrmgr.exe

Filesize
191KB

MD5
f18da83e138d9cd9b2eb6cbfbb516720

SHA1
1bca6d0f0b70bbaf536c4d4d9090cc47f200b54b

SHA256
3d15a457cc3f7d38f1a8092be7cff6a435feef279cb9ac4c1ab89a7e7e0527f4

SHA512
63fb76b5e529efb7f4c831d48654409b93e85796f83ec43a7649aa4f16b01585bc7215e301074a22a665c73216bfffebddb2e0d244f3be3f0887a2eb41ed003e

Download Submit
C:\Windows\SysWOW64\rundll32mgrmgrmgr.exe

Filesize
94KB

MD5
8abf6898662a995642dd979ff1fe5eef

SHA1
08aeda19120993801a6f3a8aa2b73b559ed361ad

SHA256
8aa6d0613c1ad6326d92678bc90dd10be1fba7a5b5f9d7a4a6fac6a42baf94cb

SHA512
a1e88bde3478d8a0c74824998b13e1fdf4484eec444540352076acc43675ecd2daed86e719b3889e7e8ce2104b2b7259a237b42d474acbca8f7e7fb3f37a3313

Download Submit
C:\Windows\SysWOW64\rundll32mgrmgrmgr.exe

Filesize
94KB

MD5
8abf6898662a995642dd979ff1fe5eef

SHA1
08aeda19120993801a6f3a8aa2b73b559ed361ad

SHA256
8aa6d0613c1ad6326d92678bc90dd10be1fba7a5b5f9d7a4a6fac6a42baf94cb

SHA512
a1e88bde3478d8a0c74824998b13e1fdf4484eec444540352076acc43675ecd2daed86e719b3889e7e8ce2104b2b7259a237b42d474acbca8f7e7fb3f37a3313

Download Submit
memory/3856-149-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3856-154-0x00000000772E0000-0x0000000077483000-memory.dmp

Filesize
1.6MB

Download
memory/3856-151-0x0000000001F50000-0x0000000001F93000-memory.dmp

Filesize
268KB

Download
memory/3888-150-0x0000000001FB0000-0x000000000200C000-memory.dmp

Filesize
368KB

Download
memory/3888-147-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/3888-153-0x00000000772E0000-0x0000000077483000-memory.dmp

Filesize
1.6MB

Download
memory/4208-148-0x00000000020F0000-0x0000000002164000-memory.dmp

Filesize
464KB

Download
memory/4208-146-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/4208-152-0x00000000772E0000-0x0000000077483000-memory.dmp

Filesize
1.6MB

Download
memory/5056-133-0x0000000010000000-0x0000000010084000-memory.dmp

Filesize
528KB

Download
memory/5056-155-0x0000000010000000-0x0000000010084000-memory.dmp

Filesize
528KB

Download