ramnit | e3c799397c7e076d9e1d69ed46a093fb6bf46f08146f088a022a6a2d5a4abce2 | Triage

Sharing

General

Target

e3c799397c7e076d9e1d69ed46a093fb6bf46f08146f088a022a6a2d5a4abce2
Size

110KB
Sample

221204-qs6n7sgf8x
MD5

a7af90f5da509415d3e03b2636628529
SHA1

ab5f9294f77211bce8c0860964ef0408eeccf9f5
SHA256

e3c799397c7e076d9e1d69ed46a093fb6bf46f08146f088a022a6a2d5a4abce2
SHA512

02e9d40d28bef9cf976342cdc19bc0b5081bf87ab2fc57b792201f3a57a6595f38f2e4fda31610687e5f621dc446dc14b92fee6c7c5eb8aff878cdc31fb90845
SSDEEP

3072:ch6Jsu7EQ7qOIx4J2vNbGfvGnd3gW5ZM4/us:+0V7EQ7GNdndPZMTs

Score

10^/10

ramnit banker evasion persistence spyware stealer trojan worm

Malware Config

Targets

- Target
  
  e3c799397c7e076d9e1d69ed46a093fb6bf46f08146f088a022a6a2d5a4abce2
- Size
  
  110KB
- MD5
  
  a7af90f5da509415d3e03b2636628529
- SHA1
  
  ab5f9294f77211bce8c0860964ef0408eeccf9f5
- SHA256
  
  e3c799397c7e076d9e1d69ed46a093fb6bf46f08146f088a022a6a2d5a4abce2
- SHA512
  
  02e9d40d28bef9cf976342cdc19bc0b5081bf87ab2fc57b792201f3a57a6595f38f2e4fda31610687e5f621dc446dc14b92fee6c7c5eb8aff878cdc31fb90845
- SSDEEP
  
  3072:ch6Jsu7EQ7qOIx4J2vNbGfvGnd3gW5ZM4/us:+0V7EQ7GNdndPZMTs
Score

10^/10

ramnit banker evasion persistence spyware stealer trojan worm
- Modifies WinLogon for persistence
  persistence
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- UAC bypass
  evasion trojan
- Executes dropped EXE
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ramnitbankerevasionpersistencespywarestealertrojanworm

behavioral2