ramnit | d419bf6343de9408c0c707f50ab1cb4c66825fa8448a6aaef35202043bbebb45

General

Target

d419bf6343de9408c0c707f50ab1cb4c66825fa8448a6aaef35202043bbebb45.exe
Size

329KB
MD5

212099eab70a0848955ae0b4a0ec81f0
SHA1

b85460f23d763ab4af4e2397bf39ebe0639a585d
SHA256

d419bf6343de9408c0c707f50ab1cb4c66825fa8448a6aaef35202043bbebb45
SHA512

12a702075666a4ee316ccd987506787e85902d548c6939bfae729ee3dc7d4e4f5a96f301ea0d3562619cd1de21828605066f4cd22b55e245381ecff308637568
SSDEEP

3072:FrSFhxp7xHSc7qzPKb/0at9ayXAVJlz0rpl:uhxFxy8qeb/9zaw+zyp

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/364-56-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/364-57-0x0000000000400000-0x000000000045B000-memory.dmp	upx

Modifies Internet Explorer settings 1 TTPs 53 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3C839961-9F9E-11ED-8803-52E8C5FCC7C7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3C803E01-9F9E-11ED-8803-52E8C5FCC7C7} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "381738731"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

d419bf6343de9408c0c707f50ab1cb4c66825fa8448a6aaef35202043bbebb45.exe

pid	process
364	d419bf6343de9408c0c707f50ab1cb4c66825fa8448a6aaef35202043bbebb45.exe
364	d419bf6343de9408c0c707f50ab1cb4c66825fa8448a6aaef35202043bbebb45.exe
364	d419bf6343de9408c0c707f50ab1cb4c66825fa8448a6aaef35202043bbebb45.exe
364	d419bf6343de9408c0c707f50ab1cb4c66825fa8448a6aaef35202043bbebb45.exe
364	d419bf6343de9408c0c707f50ab1cb4c66825fa8448a6aaef35202043bbebb45.exe
364	d419bf6343de9408c0c707f50ab1cb4c66825fa8448a6aaef35202043bbebb45.exe
364	d419bf6343de9408c0c707f50ab1cb4c66825fa8448a6aaef35202043bbebb45.exe
364	d419bf6343de9408c0c707f50ab1cb4c66825fa8448a6aaef35202043bbebb45.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

d419bf6343de9408c0c707f50ab1cb4c66825fa8448a6aaef35202043bbebb45.exe

description pid process

Token: SeDebugPrivilege 364 d419bf6343de9408c0c707f50ab1cb4c66825fa8448a6aaef35202043bbebb45.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

iexplore.exeiexplore.exe

pid process

892 iexplore.exe
1536 iexplore.exe

description	pid	process
Token: SeDebugPrivilege	364	d419bf6343de9408c0c707f50ab1cb4c66825fa8448a6aaef35202043bbebb45.exe

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

iexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXE

pid	process
892	iexplore.exe
892	iexplore.exe
1536	iexplore.exe
1536	iexplore.exe
1668	IEXPLORE.EXE
1668	IEXPLORE.EXE
1180	IEXPLORE.EXE
1180	IEXPLORE.EXE
1668	IEXPLORE.EXE
1668	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

d419bf6343de9408c0c707f50ab1cb4c66825fa8448a6aaef35202043bbebb45.exeiexplore.exeiexplore.exe

description	pid	process	target process
PID 364 wrote to memory of 892	364	d419bf6343de9408c0c707f50ab1cb4c66825fa8448a6aaef35202043bbebb45.exe	iexplore.exe
PID 364 wrote to memory of 892	364	d419bf6343de9408c0c707f50ab1cb4c66825fa8448a6aaef35202043bbebb45.exe	iexplore.exe
PID 364 wrote to memory of 892	364	d419bf6343de9408c0c707f50ab1cb4c66825fa8448a6aaef35202043bbebb45.exe	iexplore.exe
PID 364 wrote to memory of 892	364	d419bf6343de9408c0c707f50ab1cb4c66825fa8448a6aaef35202043bbebb45.exe	iexplore.exe
PID 364 wrote to memory of 1536	364	d419bf6343de9408c0c707f50ab1cb4c66825fa8448a6aaef35202043bbebb45.exe	iexplore.exe
PID 364 wrote to memory of 1536	364	d419bf6343de9408c0c707f50ab1cb4c66825fa8448a6aaef35202043bbebb45.exe	iexplore.exe
PID 364 wrote to memory of 1536	364	d419bf6343de9408c0c707f50ab1cb4c66825fa8448a6aaef35202043bbebb45.exe	iexplore.exe
PID 364 wrote to memory of 1536	364	d419bf6343de9408c0c707f50ab1cb4c66825fa8448a6aaef35202043bbebb45.exe	iexplore.exe
PID 892 wrote to memory of 1180	892	iexplore.exe	IEXPLORE.EXE
PID 892 wrote to memory of 1180	892	iexplore.exe	IEXPLORE.EXE
PID 892 wrote to memory of 1180	892	iexplore.exe	IEXPLORE.EXE
PID 892 wrote to memory of 1180	892	iexplore.exe	IEXPLORE.EXE
PID 1536 wrote to memory of 1668	1536	iexplore.exe	IEXPLORE.EXE
PID 1536 wrote to memory of 1668	1536	iexplore.exe	IEXPLORE.EXE
PID 1536 wrote to memory of 1668	1536	iexplore.exe	IEXPLORE.EXE
PID 1536 wrote to memory of 1668	1536	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\d419bf6343de9408c0c707f50ab1cb4c66825fa8448a6aaef35202043bbebb45.exe
"C:\Users\Admin\AppData\Local\Temp\d419bf6343de9408c0c707f50ab1cb4c66825fa8448a6aaef35202043bbebb45.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:364

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:892

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:892 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1180

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1536

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1536 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1668

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{3C803E01-9F9E-11ED-8803-52E8C5FCC7C7}.dat
Filesize
5KB

MD5
97370f0b1420ff0d84d6d0bc74787a48

SHA1
d17878426001537e9d5a05d67b9d89437eb3763a

SHA256
0b0777d6e09ba9ce851a4daf65c125a33224ec9e190e36799e2683fe9647ff0f

SHA512
8fb504ca3f4ac2098925cad1591acd27c2d1fd271ad4230b813451fff9edf5658a87c916d9f20517e5ecbbc78eb65a82ead1f0b50870a13d22ed9d5174db674f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{3C839961-9F9E-11ED-8803-52E8C5FCC7C7}.dat
Filesize
4KB

MD5
5f9c95bf7331350cfaed400c1796fe8e

SHA1
25d5ffd8a2875d2f76adf986c69937d28141cdf8

SHA256
33b50cb482b80ec1314d569421a0ae8c27679ede593ed8ed93438a56fcd88896

SHA512
a0f1080cc91ccac3628f9c52a147a217de67df865b1bb86c2a71a425e6628a4cdced673a0edf1ede510243b022a25e73e8a9904fb07e2f3dfefff98e6c35832f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\UP8S0GYC.txt
Filesize
603B

MD5
e91ac6e838225332817886f5680fcc08

SHA1
4040d1863ad827f9b9f06e39d73a3b4b48aeb62b

SHA256
e9c6171a984eb4ffc4544d8fc6a5536c6d6b79a3af27ed116d478de2a6933565

SHA512
e993ad0d253b3dc94406f7f1656551ed0598e68825bffaf62399eeb05ad98847498e2e09b84f1148c6b89b2312d48d7cbdce93119308bfd77c85f1c6c523ebb9

Download Submit
memory/364-56-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/364-57-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads