ramnit | 027a57cd7faa7a59577e4fd17dc5f64636d71be39ef8bf52c0c44d378ef2fdbd

Analysis

max time kernel
147s
max time network
177s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 16:05

Target

027a57cd7faa7a59577e4fd17dc5f64636d71be39ef8bf52c0c44d378ef2fdbd.exe
Size

161KB
MD5

12c934c43853f7b5dc081ba50507dd1a
SHA1

a9f5cc2618e11fa88601534e0a9cf5f030aeb8e0
SHA256

027a57cd7faa7a59577e4fd17dc5f64636d71be39ef8bf52c0c44d378ef2fdbd
SHA512

042cffdb3a97d3afb29e3e743e454872560648b6f89fa1f38ffe4971d9dd4221c3fdd1ac4036f8949927a8498fe3fb4550e9d2852af26f727d6cef6f3298fcde
SSDEEP

3072:4r6W2wIcju6IIXlNPQmTh907Y6lP/8qkrHK:86gI4u6lXnxh65Q

Score

10^/10

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2308-133-0x0000000000400000-0x0000000000444000-memory.dmp	upx

Loads dropped DLL 1 IoCs

pid	Process
2308	027a57cd7faa7a59577e4fd17dc5f64636d71be39ef8bf52c0c44d378ef2fdbd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
776	2308	WerFault.exe	82

C:\Users\Admin\AppData\Local\Temp\027a57cd7faa7a59577e4fd17dc5f64636d71be39ef8bf52c0c44d378ef2fdbd.exe
"C:\Users\Admin\AppData\Local\Temp\027a57cd7faa7a59577e4fd17dc5f64636d71be39ef8bf52c0c44d378ef2fdbd.exe"
1⤵
- Loads dropped DLL
PID:2308
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 524
  2⤵
  - Program crash
  PID:776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2308 -ip 2308
1⤵
PID:3512

C:\Users\Admin\AppData\Local\Temp\~TM3DA5.tmp

Filesize
1.6MB

MD5
4f3387277ccbd6d1f21ac5c07fe4ca68

SHA1
e16506f662dc92023bf82def1d621497c8ab5890

SHA256
767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

SHA512
9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

Download Submit
memory/2308-132-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2308-133-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2308-134-0x0000000002180000-0x00000000021C4000-memory.dmp

Filesize
272KB

Download
memory/2308-136-0x0000000077130000-0x00000000772D3000-memory.dmp

Filesize
1.6MB

Download
memory/2308-137-0x0000000077130000-0x00000000772D3000-memory.dmp

Filesize
1.6MB

Download