ramnit | c16b01a1f81f754486b08cf90b70b7cf0b8a3c6d593a04486ab750e3cde68721

General

Target

c16b01a1f81f754486b08cf90b70b7cf0b8a3c6d593a04486ab750e3cde68721.exe
Size

329KB
MD5

1bf102fb31ae779cacb418b1cdff3c60
SHA1

1af48a92b2ab09d655f96470342a2c7dc30afe97
SHA256

c16b01a1f81f754486b08cf90b70b7cf0b8a3c6d593a04486ab750e3cde68721
SHA512

3af419a6e15af403344306ed03bcd39a410ae2a262b101a21b4ff7866131bf69e386e987830887c51c63d3cf5b3ebed162787955df7d9da0454af0583256a610
SSDEEP

3072:frSFhxp7xHSc7qzPKb/0at9ayXAVJlz0rpl:whxFxy8qeb/9zaw+zyp

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1708-56-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral1/memory/1708-57-0x0000000000400000-0x000000000046B000-memory.dmp	upx

Modifies Internet Explorer settings 1 TTPs 53 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E6C95531-9FB3-11ED-965B-E20468906380} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E6CCFEB1-9FB3-11ED-965B-E20468906380} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "381748036"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

c16b01a1f81f754486b08cf90b70b7cf0b8a3c6d593a04486ab750e3cde68721.exe

pid	process
1708	c16b01a1f81f754486b08cf90b70b7cf0b8a3c6d593a04486ab750e3cde68721.exe
1708	c16b01a1f81f754486b08cf90b70b7cf0b8a3c6d593a04486ab750e3cde68721.exe
1708	c16b01a1f81f754486b08cf90b70b7cf0b8a3c6d593a04486ab750e3cde68721.exe
1708	c16b01a1f81f754486b08cf90b70b7cf0b8a3c6d593a04486ab750e3cde68721.exe
1708	c16b01a1f81f754486b08cf90b70b7cf0b8a3c6d593a04486ab750e3cde68721.exe
1708	c16b01a1f81f754486b08cf90b70b7cf0b8a3c6d593a04486ab750e3cde68721.exe
1708	c16b01a1f81f754486b08cf90b70b7cf0b8a3c6d593a04486ab750e3cde68721.exe
1708	c16b01a1f81f754486b08cf90b70b7cf0b8a3c6d593a04486ab750e3cde68721.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

c16b01a1f81f754486b08cf90b70b7cf0b8a3c6d593a04486ab750e3cde68721.exe

description pid process

Token: SeDebugPrivilege 1708 c16b01a1f81f754486b08cf90b70b7cf0b8a3c6d593a04486ab750e3cde68721.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

iexplore.exeiexplore.exe

pid process

316 iexplore.exe
1648 iexplore.exe

description	pid	process
Token: SeDebugPrivilege	1708	c16b01a1f81f754486b08cf90b70b7cf0b8a3c6d593a04486ab750e3cde68721.exe

pid	process
316	iexplore.exe
1648	iexplore.exe

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

iexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXE

pid	process
1648	iexplore.exe
1648	iexplore.exe
316	iexplore.exe
316	iexplore.exe
1380	IEXPLORE.EXE
1380	IEXPLORE.EXE
520	IEXPLORE.EXE
520	IEXPLORE.EXE
520	IEXPLORE.EXE
520	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

c16b01a1f81f754486b08cf90b70b7cf0b8a3c6d593a04486ab750e3cde68721.exeiexplore.exeiexplore.exe

description	pid	process	target process
PID 1708 wrote to memory of 1648	1708	c16b01a1f81f754486b08cf90b70b7cf0b8a3c6d593a04486ab750e3cde68721.exe	iexplore.exe
PID 1708 wrote to memory of 1648	1708	c16b01a1f81f754486b08cf90b70b7cf0b8a3c6d593a04486ab750e3cde68721.exe	iexplore.exe
PID 1708 wrote to memory of 1648	1708	c16b01a1f81f754486b08cf90b70b7cf0b8a3c6d593a04486ab750e3cde68721.exe	iexplore.exe
PID 1708 wrote to memory of 1648	1708	c16b01a1f81f754486b08cf90b70b7cf0b8a3c6d593a04486ab750e3cde68721.exe	iexplore.exe
PID 1708 wrote to memory of 316	1708	c16b01a1f81f754486b08cf90b70b7cf0b8a3c6d593a04486ab750e3cde68721.exe	iexplore.exe
PID 1708 wrote to memory of 316	1708	c16b01a1f81f754486b08cf90b70b7cf0b8a3c6d593a04486ab750e3cde68721.exe	iexplore.exe
PID 1708 wrote to memory of 316	1708	c16b01a1f81f754486b08cf90b70b7cf0b8a3c6d593a04486ab750e3cde68721.exe	iexplore.exe
PID 1708 wrote to memory of 316	1708	c16b01a1f81f754486b08cf90b70b7cf0b8a3c6d593a04486ab750e3cde68721.exe	iexplore.exe
PID 1648 wrote to memory of 1380	1648	iexplore.exe	IEXPLORE.EXE
PID 1648 wrote to memory of 1380	1648	iexplore.exe	IEXPLORE.EXE
PID 1648 wrote to memory of 1380	1648	iexplore.exe	IEXPLORE.EXE
PID 1648 wrote to memory of 1380	1648	iexplore.exe	IEXPLORE.EXE
PID 316 wrote to memory of 520	316	iexplore.exe	IEXPLORE.EXE
PID 316 wrote to memory of 520	316	iexplore.exe	IEXPLORE.EXE
PID 316 wrote to memory of 520	316	iexplore.exe	IEXPLORE.EXE
PID 316 wrote to memory of 520	316	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\c16b01a1f81f754486b08cf90b70b7cf0b8a3c6d593a04486ab750e3cde68721.exe
"C:\Users\Admin\AppData\Local\Temp\c16b01a1f81f754486b08cf90b70b7cf0b8a3c6d593a04486ab750e3cde68721.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1708

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1648

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1648 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1380

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:316

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:316 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:520

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{E6C95531-9FB3-11ED-965B-E20468906380}.dat
Filesize
3KB

MD5
07378f9ae2918bf41f5f90b78e4e28a1

SHA1
02bb374029c6add4f50ca21cb64c50f532d2cd5f

SHA256
db75fd2ef37c7e959a1614d220c8fc148f7081305bafa547c19ae8e2f84047e9

SHA512
d552135cd2fbe4c49e079f46ea7febe1eddc2895f25fe270d9bbf3b4bbfb8702921ddab4671e8b22102b5a6b8585b0fe462a8c86b1d2f319acaae1c317dc54b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{E6CCFEB1-9FB3-11ED-965B-E20468906380}.dat
Filesize
3KB

MD5
6ce42c4f7a0623ad6c6d660b97a00746

SHA1
504036b6f3dbd6ff023439deee46ed1d89a0e501

SHA256
5ebe0df0b809f2a5022875e1710931cd696090e07e99f0f5275e50772d50f834

SHA512
d9fc84da446d668109c51014ed6f5f19cb78f579520347738431b18b569cc1a55fec1326397c76d8e08381723ec35d48e1fb2cd48020aa413de30cf429973386

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\CTUANWFN.txt
Filesize
607B

MD5
de1f36bda5f539e2ba717f36b9cfeb7f

SHA1
0f31d265d223f2da3aeb82fb5888582393316924

SHA256
e83135f990de72b99267d88b3521e89255c590f732661826f66943ceab454f7e

SHA512
7b5ef0bcaaa83e2f9f12a35aab953b1e2450ad8ce9afb906fc727bce85b25a2911c3557cdaf345844aad3495ad91d88645ca89093ef114ca6dbf3b9817571d73

Download Submit
memory/1708-56-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1708-57-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads