ramnit | 87a42043bc478cec68bf5f181efa3de0e597ceb0c2a68e4b626d1e53e3f29b1d | Triage

Submit
Reports

Overview

overview

Static

static

87a42043bc...1d.exe

windows7-x64

87a42043bc...1d.exe

windows10-2004-x64

Sharing

General

Target

87a42043bc478cec68bf5f181efa3de0e597ceb0c2a68e4b626d1e53e3f29b1d
Size

130KB
Sample

230129-3fdtwaae91
MD5

22d8fb0fde2ec77b0a3da0a7588bfa40
SHA1

e76802220d01891479b64bf709fd0c2d3ec266bb
SHA256

87a42043bc478cec68bf5f181efa3de0e597ceb0c2a68e4b626d1e53e3f29b1d
SHA512

1304e549ebafd89163db4e4728dab986cd100de6cf1f26e98ef6e681d2fb995c1607a58ff27a097675e8979247d0ad2a2d98a24b795f6e3a930d8188a0e4f6b4
SSDEEP

3072:NYaENCs1tDKROWgPJblycavQARvZeURunoswmKK:NYaMCSqOWgP/av6U1U

Score

10^/10

ramnit banker evasion persistence spyware stealer trojan worm

Static task

static1

Behavioral task

behavioral1

Sample

87a42043bc478cec68bf5f181efa3de0e597ceb0c2a68e4b626d1e53e3f29b1d.exe

Resource

win7-20220812-en

ramnit banker evasion persistence spyware stealer trojan worm

windows7-x64

18 signatures

150 seconds

Behavioral task

behavioral2

Sample

87a42043bc478cec68bf5f181efa3de0e597ceb0c2a68e4b626d1e53e3f29b1d.exe

Resource

win10v2004-20221111-en

ramnit banker spyware stealer trojan worm

windows10-2004-x64

11 signatures

150 seconds

Malware Config

Targets

- Target
  
  87a42043bc478cec68bf5f181efa3de0e597ceb0c2a68e4b626d1e53e3f29b1d
- Size
  
  130KB
- MD5
  
  22d8fb0fde2ec77b0a3da0a7588bfa40
- SHA1
  
  e76802220d01891479b64bf709fd0c2d3ec266bb
- SHA256
  
  87a42043bc478cec68bf5f181efa3de0e597ceb0c2a68e4b626d1e53e3f29b1d
- SHA512
  
  1304e549ebafd89163db4e4728dab986cd100de6cf1f26e98ef6e681d2fb995c1607a58ff27a097675e8979247d0ad2a2d98a24b795f6e3a930d8188a0e4f6b4
- SSDEEP
  
  3072:NYaENCs1tDKROWgPJblycavQARvZeURunoswmKK:NYaMCSqOWgP/av6U1U
Score

10^/10

ramnit banker evasion persistence spyware stealer trojan worm
- Modifies WinLogon for persistence
  persistence
- Modifies firewall policy service
  evasion
- Modifies security service
  evasion
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Modify Registry

Bypass User Account Control

Disabling Security Tools

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

ramnitbankerevasionpersistencespywarestealertrojanworm

behavioral2

ramnitbankerspywarestealertrojanworm

© 2018-2024

Terms | Privacy