ramnit | 7dd9897371ea0d03433b2d215a89bc0f8affff4046460b0dd2d018a7aa882151

Analysis

max time kernel
6s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 07:51 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7dd9897371ea0d03433b2d215a89bc0f8affff4046460b0dd2d018a7aa882151.exe
Size

1.4MB
MD5

0969930d57822b02b0e111dce78a4aa0
SHA1

23552b51f246cbf54cd7c176587fca38e8955338
SHA256

7dd9897371ea0d03433b2d215a89bc0f8affff4046460b0dd2d018a7aa882151
SHA512

9f037e50fa1ad5ded35beda6f14ecb08cc38fb4fa4c7b5fcf6d685b15fc995f7cf4fd16d3f6177862e418f8433713ff4c40012a4554c38fc98b184018446f94d
SSDEEP

12288:JqOPajQUXXP8QvLWFx6Mo5rippDC7ee1hpls4Ey+uDWACBCEqc2UP7ChBFIjqLE:JnajQEPnvg6PhWDC750mWAMCEJ3qLE

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Executes dropped EXE 3 IoCs

pid	Process
1872	7dd9897371ea0d03433b2d215a89bc0f8affff4046460b0dd2d018a7aa882151mgr.exe
1328	7dd9897371ea0d03433b2d215a89bc0f8affff4046460b0dd2d018a7aa882151mgrmgr.exe
1316	7dd9897371ea0d03433b2d215a89bc0f8affff4046460b0dd2d018a7aa882151mgrmgrmgr.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1316-76-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/1872-81-0x0000000000400000-0x0000000000474000-memory.dmp	upx
behavioral1/memory/1328-75-0x0000000000400000-0x000000000045C000-memory.dmp	upx

Loads dropped DLL 12 IoCs

pid	Process
1388	7dd9897371ea0d03433b2d215a89bc0f8affff4046460b0dd2d018a7aa882151.exe
1388	7dd9897371ea0d03433b2d215a89bc0f8affff4046460b0dd2d018a7aa882151.exe
1872	7dd9897371ea0d03433b2d215a89bc0f8affff4046460b0dd2d018a7aa882151mgr.exe
1872	7dd9897371ea0d03433b2d215a89bc0f8affff4046460b0dd2d018a7aa882151mgr.exe
1328	7dd9897371ea0d03433b2d215a89bc0f8affff4046460b0dd2d018a7aa882151mgrmgr.exe
1328	7dd9897371ea0d03433b2d215a89bc0f8affff4046460b0dd2d018a7aa882151mgrmgr.exe
1316	7dd9897371ea0d03433b2d215a89bc0f8affff4046460b0dd2d018a7aa882151mgrmgrmgr.exe
1872	7dd9897371ea0d03433b2d215a89bc0f8affff4046460b0dd2d018a7aa882151mgr.exe
1328	7dd9897371ea0d03433b2d215a89bc0f8affff4046460b0dd2d018a7aa882151mgrmgr.exe
1328	7dd9897371ea0d03433b2d215a89bc0f8affff4046460b0dd2d018a7aa882151mgrmgr.exe
1316	7dd9897371ea0d03433b2d215a89bc0f8affff4046460b0dd2d018a7aa882151mgrmgrmgr.exe
1872	7dd9897371ea0d03433b2d215a89bc0f8affff4046460b0dd2d018a7aa882151mgr.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1388	7dd9897371ea0d03433b2d215a89bc0f8affff4046460b0dd2d018a7aa882151.exe
1388	7dd9897371ea0d03433b2d215a89bc0f8affff4046460b0dd2d018a7aa882151.exe
1388	7dd9897371ea0d03433b2d215a89bc0f8affff4046460b0dd2d018a7aa882151.exe
1388	7dd9897371ea0d03433b2d215a89bc0f8affff4046460b0dd2d018a7aa882151.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 1872	1388	7dd9897371ea0d03433b2d215a89bc0f8affff4046460b0dd2d018a7aa882151.exe	27
PID 1388 wrote to memory of 1872	1388	7dd9897371ea0d03433b2d215a89bc0f8affff4046460b0dd2d018a7aa882151.exe	27
PID 1388 wrote to memory of 1872	1388	7dd9897371ea0d03433b2d215a89bc0f8affff4046460b0dd2d018a7aa882151.exe	27
PID 1388 wrote to memory of 1872	1388	7dd9897371ea0d03433b2d215a89bc0f8affff4046460b0dd2d018a7aa882151.exe	27
PID 1872 wrote to memory of 1328	1872	7dd9897371ea0d03433b2d215a89bc0f8affff4046460b0dd2d018a7aa882151mgr.exe	28
PID 1872 wrote to memory of 1328	1872	7dd9897371ea0d03433b2d215a89bc0f8affff4046460b0dd2d018a7aa882151mgr.exe	28
PID 1872 wrote to memory of 1328	1872	7dd9897371ea0d03433b2d215a89bc0f8affff4046460b0dd2d018a7aa882151mgr.exe	28
PID 1872 wrote to memory of 1328	1872	7dd9897371ea0d03433b2d215a89bc0f8affff4046460b0dd2d018a7aa882151mgr.exe	28
PID 1328 wrote to memory of 1316	1328	7dd9897371ea0d03433b2d215a89bc0f8affff4046460b0dd2d018a7aa882151mgrmgr.exe	29
PID 1328 wrote to memory of 1316	1328	7dd9897371ea0d03433b2d215a89bc0f8affff4046460b0dd2d018a7aa882151mgrmgr.exe	29
PID 1328 wrote to memory of 1316	1328	7dd9897371ea0d03433b2d215a89bc0f8affff4046460b0dd2d018a7aa882151mgrmgr.exe	29
PID 1328 wrote to memory of 1316	1328	7dd9897371ea0d03433b2d215a89bc0f8affff4046460b0dd2d018a7aa882151mgrmgr.exe	29

C:\Users\Admin\AppData\Local\Temp\7dd9897371ea0d03433b2d215a89bc0f8affff4046460b0dd2d018a7aa882151.exe
"C:\Users\Admin\AppData\Local\Temp\7dd9897371ea0d03433b2d215a89bc0f8affff4046460b0dd2d018a7aa882151.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Users\Admin\AppData\Local\Temp\7dd9897371ea0d03433b2d215a89bc0f8affff4046460b0dd2d018a7aa882151mgr.exe
  C:\Users\Admin\AppData\Local\Temp\7dd9897371ea0d03433b2d215a89bc0f8affff4046460b0dd2d018a7aa882151mgr.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1872
- - C:\Users\Admin\AppData\Local\Temp\7dd9897371ea0d03433b2d215a89bc0f8affff4046460b0dd2d018a7aa882151mgrmgr.exe
    C:\Users\Admin\AppData\Local\Temp\7dd9897371ea0d03433b2d215a89bc0f8affff4046460b0dd2d018a7aa882151mgrmgr.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1328
  - - C:\Users\Admin\AppData\Local\Temp\7dd9897371ea0d03433b2d215a89bc0f8affff4046460b0dd2d018a7aa882151mgrmgrmgr.exe
      C:\Users\Admin\AppData\Local\Temp\7dd9897371ea0d03433b2d215a89bc0f8affff4046460b0dd2d018a7aa882151mgrmgrmgr.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1316

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7dd9897371ea0d03433b2d215a89bc0f8affff4046460b0dd2d018a7aa882151mgr.exe

Filesize
289KB

MD5
4d81ad0379673e84fb7ca5a33ae38696

SHA1
fd1335251a179997b509a78486cc940a57915d51

SHA256
0ba7961261c178cf64f1663866d41267f64885b8f62c4772569d60f020e244a6

SHA512
be2ebc584df773b56d420652dfdb0ec6da06df317183b9c5c720c41a6c335c7ecb3bdc36eccdb69e279e1a345305d1670bf41e92a8a0bfad8992cc98feb5a22f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7dd9897371ea0d03433b2d215a89bc0f8affff4046460b0dd2d018a7aa882151mgrmgr.exe

Filesize
191KB

MD5
c7652599cce5eea10f9c4349e24a66e4

SHA1
66b8c35e80e48fa7787378cc12678fa0330325ab

SHA256
562217a47b8ca9b12ae5549ca671baf91833dbff66289dbf6ec3a10add5a5bf7

SHA512
7e174f8820d3e5847aa28128d6fd5d843002ff034afb5afe2cc664df65f3884f310634eee60627dafd2c68baf1ccda69c021131cf6539620c4f1c12c4f38481d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7dd9897371ea0d03433b2d215a89bc0f8affff4046460b0dd2d018a7aa882151mgrmgrmgr.exe

Filesize
94KB

MD5
8abf6898662a995642dd979ff1fe5eef

SHA1
08aeda19120993801a6f3a8aa2b73b559ed361ad

SHA256
8aa6d0613c1ad6326d92678bc90dd10be1fba7a5b5f9d7a4a6fac6a42baf94cb

SHA512
a1e88bde3478d8a0c74824998b13e1fdf4484eec444540352076acc43675ecd2daed86e719b3889e7e8ce2104b2b7259a237b42d474acbca8f7e7fb3f37a3313

Download Submit
\Users\Admin\AppData\Local\Temp\7dd9897371ea0d03433b2d215a89bc0f8affff4046460b0dd2d018a7aa882151mgr.exe

Filesize
289KB

MD5
4d81ad0379673e84fb7ca5a33ae38696

SHA1
fd1335251a179997b509a78486cc940a57915d51

SHA256
0ba7961261c178cf64f1663866d41267f64885b8f62c4772569d60f020e244a6

SHA512
be2ebc584df773b56d420652dfdb0ec6da06df317183b9c5c720c41a6c335c7ecb3bdc36eccdb69e279e1a345305d1670bf41e92a8a0bfad8992cc98feb5a22f

Download Submit
\Users\Admin\AppData\Local\Temp\7dd9897371ea0d03433b2d215a89bc0f8affff4046460b0dd2d018a7aa882151mgr.exe

Filesize
289KB

MD5
4d81ad0379673e84fb7ca5a33ae38696

SHA1
fd1335251a179997b509a78486cc940a57915d51

SHA256
0ba7961261c178cf64f1663866d41267f64885b8f62c4772569d60f020e244a6

SHA512
be2ebc584df773b56d420652dfdb0ec6da06df317183b9c5c720c41a6c335c7ecb3bdc36eccdb69e279e1a345305d1670bf41e92a8a0bfad8992cc98feb5a22f

Download Submit
\Users\Admin\AppData\Local\Temp\7dd9897371ea0d03433b2d215a89bc0f8affff4046460b0dd2d018a7aa882151mgrmgr.exe

Filesize
191KB

MD5
c7652599cce5eea10f9c4349e24a66e4

SHA1
66b8c35e80e48fa7787378cc12678fa0330325ab

SHA256
562217a47b8ca9b12ae5549ca671baf91833dbff66289dbf6ec3a10add5a5bf7

SHA512
7e174f8820d3e5847aa28128d6fd5d843002ff034afb5afe2cc664df65f3884f310634eee60627dafd2c68baf1ccda69c021131cf6539620c4f1c12c4f38481d

Download Submit
\Users\Admin\AppData\Local\Temp\7dd9897371ea0d03433b2d215a89bc0f8affff4046460b0dd2d018a7aa882151mgrmgr.exe

Filesize
191KB

MD5
c7652599cce5eea10f9c4349e24a66e4

SHA1
66b8c35e80e48fa7787378cc12678fa0330325ab

SHA256
562217a47b8ca9b12ae5549ca671baf91833dbff66289dbf6ec3a10add5a5bf7

SHA512
7e174f8820d3e5847aa28128d6fd5d843002ff034afb5afe2cc664df65f3884f310634eee60627dafd2c68baf1ccda69c021131cf6539620c4f1c12c4f38481d

Download Submit
\Users\Admin\AppData\Local\Temp\7dd9897371ea0d03433b2d215a89bc0f8affff4046460b0dd2d018a7aa882151mgrmgrmgr.exe

Filesize
94KB

MD5
8abf6898662a995642dd979ff1fe5eef

SHA1
08aeda19120993801a6f3a8aa2b73b559ed361ad

SHA256
8aa6d0613c1ad6326d92678bc90dd10be1fba7a5b5f9d7a4a6fac6a42baf94cb

SHA512
a1e88bde3478d8a0c74824998b13e1fdf4484eec444540352076acc43675ecd2daed86e719b3889e7e8ce2104b2b7259a237b42d474acbca8f7e7fb3f37a3313

Download Submit
\Users\Admin\AppData\Local\Temp\7dd9897371ea0d03433b2d215a89bc0f8affff4046460b0dd2d018a7aa882151mgrmgrmgr.exe

Filesize
94KB

MD5
8abf6898662a995642dd979ff1fe5eef

SHA1
08aeda19120993801a6f3a8aa2b73b559ed361ad

SHA256
8aa6d0613c1ad6326d92678bc90dd10be1fba7a5b5f9d7a4a6fac6a42baf94cb

SHA512
a1e88bde3478d8a0c74824998b13e1fdf4484eec444540352076acc43675ecd2daed86e719b3889e7e8ce2104b2b7259a237b42d474acbca8f7e7fb3f37a3313

Download Submit
\Users\Admin\AppData\Local\Temp\~TM9F9A.tmp

Filesize
1.2MB

MD5
d124f55b9393c976963407dff51ffa79

SHA1
2c7bbedd79791bfb866898c85b504186db610b5d

SHA256
ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef

SHA512
278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06

Download Submit
\Users\Admin\AppData\Local\Temp\~TM9FAA.tmp

Filesize
1.2MB

MD5
d124f55b9393c976963407dff51ffa79

SHA1
2c7bbedd79791bfb866898c85b504186db610b5d

SHA256
ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef

SHA512
278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06

Download Submit
\Users\Admin\AppData\Local\Temp\~TM9FD9.tmp

Filesize
1.2MB

MD5
d124f55b9393c976963407dff51ffa79

SHA1
2c7bbedd79791bfb866898c85b504186db610b5d

SHA256
ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef

SHA512
278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06

Download Submit
\Users\Admin\AppData\Local\Temp\~TMA047.tmp

Filesize
1.1MB

MD5
9b98d47916ead4f69ef51b56b0c2323c

SHA1
290a80b4ded0efc0fd00816f373fcea81a521330

SHA256
96e0ae104c9662d0d20fdf59844c2d18334e5847b6c4fc7f8ce4b3b87f39887b

SHA512
68b67021f228d8d71df4deb0b6388558b2f935a6aa466a12199cd37ada47ee588ea407b278d190d3a498b0ef3f5f1a2573a469b7ea5561ab2e7055c45565fe94

Download Submit
\Users\Admin\AppData\Local\Temp\~TMA048.tmp

Filesize
1.1MB

MD5
9b98d47916ead4f69ef51b56b0c2323c

SHA1
290a80b4ded0efc0fd00816f373fcea81a521330

SHA256
96e0ae104c9662d0d20fdf59844c2d18334e5847b6c4fc7f8ce4b3b87f39887b

SHA512
68b67021f228d8d71df4deb0b6388558b2f935a6aa466a12199cd37ada47ee588ea407b278d190d3a498b0ef3f5f1a2573a469b7ea5561ab2e7055c45565fe94

Download Submit
\Users\Admin\AppData\Local\Temp\~TMA049.tmp

Filesize
1.1MB

MD5
9b98d47916ead4f69ef51b56b0c2323c

SHA1
290a80b4ded0efc0fd00816f373fcea81a521330

SHA256
96e0ae104c9662d0d20fdf59844c2d18334e5847b6c4fc7f8ce4b3b87f39887b

SHA512
68b67021f228d8d71df4deb0b6388558b2f935a6aa466a12199cd37ada47ee588ea407b278d190d3a498b0ef3f5f1a2573a469b7ea5561ab2e7055c45565fe94

Download Submit
memory/1316-83-0x0000000076EF0000-0x0000000077070000-memory.dmp

Filesize
1.5MB

Download
memory/1316-76-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1316-79-0x00000000002D0000-0x0000000000313000-memory.dmp

Filesize
268KB

Download
memory/1328-82-0x0000000076EF0000-0x0000000077070000-memory.dmp

Filesize
1.5MB

Download
memory/1328-78-0x0000000000220000-0x0000000000263000-memory.dmp

Filesize
268KB

Download
memory/1328-75-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1388-80-0x0000000000400000-0x0000000000567000-memory.dmp

Filesize
1.4MB

Download
memory/1388-84-0x0000000000230000-0x00000000002A4000-memory.dmp

Filesize
464KB

Download
memory/1388-86-0x0000000000230000-0x00000000002A4000-memory.dmp

Filesize
464KB

Download
memory/1388-89-0x0000000000400000-0x0000000000567000-memory.dmp

Filesize
1.4MB

Download
memory/1388-54-0x0000000074AD1000-0x0000000074AD3000-memory.dmp

Filesize
8KB

Download
memory/1872-87-0x0000000076EF0000-0x0000000077070000-memory.dmp

Filesize
1.5MB

Download
memory/1872-88-0x0000000076EF0000-0x0000000077070000-memory.dmp

Filesize
1.5MB

Download
memory/1872-81-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/1872-85-0x00000000002C0000-0x000000000031C000-memory.dmp

Filesize
368KB

Download