ramnit | ddec3bbfcef0f8f9d618900ee6a516a603f4b04a11f3278ed9fc6422f1aa831d

Analysis

max time kernel
139s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 12:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ddec3bbfcef0f8f9d618900ee6a516a603f4b04a11f3278ed9fc6422f1aa831d.exe
Size

121KB
MD5

dde3eadc52b0b9d94334342185bc0802
SHA1

344281d825f4b94779c278def024eef72a6d9657
SHA256

ddec3bbfcef0f8f9d618900ee6a516a603f4b04a11f3278ed9fc6422f1aa831d
SHA512

4ac85fda88c517c9a974e57f675e7153cee143878d6cc75ec370f21cd26bac60f953c326d594e902cfca5f481c7a0ee9ce714034d07a6c871126e76faa78b132
SSDEEP

768:9QxkwiHBsIqHpcrkMEYEhA7P4RhAtmaZFb79U9MKAjBEig6/1k21m3uHRdMNDj2f:98kwitTEhU4HDa1KkjWXUa21mc/Mue9G

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Executes dropped EXE 1 IoCs

pid	Process
2556	WaterMark.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2324-136-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral2/memory/2556-140-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral2/memory/2556-144-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral2/memory/2556-145-0x0000000000400000-0x0000000000426000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\pxAA7D.tmp	ddec3bbfcef0f8f9d618900ee6a516a603f4b04a11f3278ed9fc6422f1aa831d.exe
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	ddec3bbfcef0f8f9d618900ee6a516a603f4b04a11f3278ed9fc6422f1aa831d.exe
File opened for modification	C:\Program Files (x86)\Microsoft\WaterMark.exe	ddec3bbfcef0f8f9d618900ee6a516a603f4b04a11f3278ed9fc6422f1aa831d.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4728	2848	WerFault.exe	81

Modifies Internet Explorer settings 1 TTPs 43 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "377098519"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31000951"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31000951"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1085344422"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1373780880"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1085344422"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31000951"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{6B4F87CE-756A-11ED-B696-72E5C3FA065D} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1373780880"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31000951"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{6B56AE17-756A-11ED-B696-72E5C3FA065D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2556	WaterMark.exe
2556	WaterMark.exe
2556	WaterMark.exe
2556	WaterMark.exe
2556	WaterMark.exe
2556	WaterMark.exe
2556	WaterMark.exe
2556	WaterMark.exe
2556	WaterMark.exe
2556	WaterMark.exe
2556	WaterMark.exe
2556	WaterMark.exe
2556	WaterMark.exe
2556	WaterMark.exe
2556	WaterMark.exe
2556	WaterMark.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5032	iexplore.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2556	WaterMark.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5032	iexplore.exe
4892	iexplore.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
5032	iexplore.exe
5032	iexplore.exe
4892	iexplore.exe
4892	iexplore.exe
2044	IEXPLORE.EXE
2044	IEXPLORE.EXE
1212	IEXPLORE.EXE
1212	IEXPLORE.EXE
2044	IEXPLORE.EXE
2044	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 2556	2324	ddec3bbfcef0f8f9d618900ee6a516a603f4b04a11f3278ed9fc6422f1aa831d.exe	80
PID 2324 wrote to memory of 2556	2324	ddec3bbfcef0f8f9d618900ee6a516a603f4b04a11f3278ed9fc6422f1aa831d.exe	80
PID 2324 wrote to memory of 2556	2324	ddec3bbfcef0f8f9d618900ee6a516a603f4b04a11f3278ed9fc6422f1aa831d.exe	80
PID 2556 wrote to memory of 2848	2556	WaterMark.exe	81
PID 2556 wrote to memory of 2848	2556	WaterMark.exe	81
PID 2556 wrote to memory of 2848	2556	WaterMark.exe	81
PID 2556 wrote to memory of 2848	2556	WaterMark.exe	81
PID 2556 wrote to memory of 2848	2556	WaterMark.exe	81
PID 2556 wrote to memory of 2848	2556	WaterMark.exe	81
PID 2556 wrote to memory of 2848	2556	WaterMark.exe	81
PID 2556 wrote to memory of 2848	2556	WaterMark.exe	81
PID 2556 wrote to memory of 2848	2556	WaterMark.exe	81
PID 2556 wrote to memory of 4892	2556	WaterMark.exe	85
PID 2556 wrote to memory of 4892	2556	WaterMark.exe	85
PID 2556 wrote to memory of 5032	2556	WaterMark.exe	86
PID 2556 wrote to memory of 5032	2556	WaterMark.exe	86
PID 4892 wrote to memory of 1212	4892	iexplore.exe	88
PID 4892 wrote to memory of 1212	4892	iexplore.exe	88
PID 4892 wrote to memory of 1212	4892	iexplore.exe	88
PID 5032 wrote to memory of 2044	5032	iexplore.exe	87
PID 5032 wrote to memory of 2044	5032	iexplore.exe	87
PID 5032 wrote to memory of 2044	5032	iexplore.exe	87

C:\Users\Admin\AppData\Local\Temp\ddec3bbfcef0f8f9d618900ee6a516a603f4b04a11f3278ed9fc6422f1aa831d.exe
"C:\Users\Admin\AppData\Local\Temp\ddec3bbfcef0f8f9d618900ee6a516a603f4b04a11f3278ed9fc6422f1aa831d.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Program Files (x86)\Microsoft\WaterMark.exe
  "C:\Program Files (x86)\Microsoft\WaterMark.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2848
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2848 -s 204
      4⤵
      Program crash
      PID:4728
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4892
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4892 CREDAT:17410 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1212
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5032
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5032 CREDAT:17410 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2848 -ip 2848
1⤵
PID:3060

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\WaterMark.exe

Filesize
121KB

MD5
dde3eadc52b0b9d94334342185bc0802

SHA1
344281d825f4b94779c278def024eef72a6d9657

SHA256
ddec3bbfcef0f8f9d618900ee6a516a603f4b04a11f3278ed9fc6422f1aa831d

SHA512
4ac85fda88c517c9a974e57f675e7153cee143878d6cc75ec370f21cd26bac60f953c326d594e902cfca5f481c7a0ee9ce714034d07a6c871126e76faa78b132

Download Submit
C:\Program Files (x86)\Microsoft\WaterMark.exe

Filesize
121KB

MD5
dde3eadc52b0b9d94334342185bc0802

SHA1
344281d825f4b94779c278def024eef72a6d9657

SHA256
ddec3bbfcef0f8f9d618900ee6a516a603f4b04a11f3278ed9fc6422f1aa831d

SHA512
4ac85fda88c517c9a974e57f675e7153cee143878d6cc75ec370f21cd26bac60f953c326d594e902cfca5f481c7a0ee9ce714034d07a6c871126e76faa78b132

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{6B4F87CE-756A-11ED-B696-72E5C3FA065D}.dat

Filesize
3KB

MD5
e0da47983ffd08763bfb52494c7ae522

SHA1
e266842ca76fd838afcef61d52621f3c47c0f2d5

SHA256
70786f0a7052c7760db18d82e102ddacd3781fb1e0f230829fe73fbe243f10ad

SHA512
a2a812def7be574ec305f7fea6f4492ecab978cae15d085c9deaefa195238d2aa7bc02a35f405616205a21035dd26daec7fce825eaaa4c8049b8daf035f1553e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{6B56AE17-756A-11ED-B696-72E5C3FA065D}.dat

Filesize
5KB

MD5
84a53ad8b3aad92c1a9acf17c07b5fae

SHA1
47a82101bd1728c6b1d7fe579decc0298f8fba35

SHA256
99235e02cfa3a3d73ac5a9d01c6ecd122ea20f2b854cb14f579a5df8c776e840

SHA512
841220a813058c2d0c297a1cd64bf828ea1e2431d98342769a62e2e2a2201fea59b0574522e3af67c354581b38fe235227a2d4a4512b8cbf724099bcac21e6ff

Download Submit
memory/2324-136-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2324-137-0x0000000000570000-0x0000000000596000-memory.dmp

Filesize
152KB

Download
memory/2324-132-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2556-140-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2556-141-0x0000000000640000-0x0000000000666000-memory.dmp

Filesize
152KB

Download
memory/2556-144-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2556-145-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download