ramnit | aed5c7355746817265352226221264d35bf753a44f273912d42629019b7c4b8f

General

Target

aed5c7355746817265352226221264d35bf753a44f273912d42629019b7c4b8f.exe
Size

381KB
MD5

0957d5d8d21751f2fd1ad2015b19abe0
SHA1

c098ddc18a8a0dade35436f968eb43c1f4c9253c
SHA256

aed5c7355746817265352226221264d35bf753a44f273912d42629019b7c4b8f
SHA512

a7cbde567cd869828c757bd32a6571c401782bbdc54b76c1faa9e9b2509187b81dd85a0db641fa182c04edb598be75009ed02e9f0f196942d9662a8b1ed3e0b6
SSDEEP

6144:3rK18vkksg2P4vWigPJJJPJJJGJJA/+aU4Kau:3rMlM2QvgPJJJPJJJGJJpF

Score

10^/10

ramnit banker spyware stealer trojan worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Executes dropped EXE 1 IoCs

Processes:

yhrdjtahwqovjxtw.exe

pid process

2552 yhrdjtahwqovjxtw.exe

pid	process
2552	yhrdjtahwqovjxtw.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

aed5c7355746817265352226221264d35bf753a44f273912d42629019b7c4b8f.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	aed5c7355746817265352226221264d35bf753a44f273912d42629019b7c4b8f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

4996 700 WerFault.exe svchost.exe
2128 856 WerFault.exe svchost.exe

pid	pid_target	process	target process
4996	700	WerFault.exe	svchost.exe
2128	856	WerFault.exe	svchost.exe

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31011797"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2062904985"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2062904985"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{A5E76331-9FC8-11ED-AECB-5203DB9D3E0F} = "0"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31011797"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "381756940"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2260875482"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2078217312"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31011797"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31011797"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

IEXPLORE.EXE

pid process

4928 IEXPLORE.EXE
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

648

pid	process
648

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

aed5c7355746817265352226221264d35bf753a44f273912d42629019b7c4b8f.exeyhrdjtahwqovjxtw.exe

description	pid	process
Token: SeSecurityPrivilege	1064	aed5c7355746817265352226221264d35bf753a44f273912d42629019b7c4b8f.exe
Token: SeDebugPrivilege	1064	aed5c7355746817265352226221264d35bf753a44f273912d42629019b7c4b8f.exe
Token: SeSecurityPrivilege	2552	yhrdjtahwqovjxtw.exe
Token: SeLoadDriverPrivilege	2552	yhrdjtahwqovjxtw.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

IEXPLORE.EXE

pid process

4928 IEXPLORE.EXE
4928 IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

IEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

pid	process
4928	IEXPLORE.EXE
4928	IEXPLORE.EXE
4908	IEXPLORE.EXE
4908	IEXPLORE.EXE
4908	IEXPLORE.EXE
4908	IEXPLORE.EXE
4928	IEXPLORE.EXE
4928	IEXPLORE.EXE
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 37 IoCs

Processes:

aed5c7355746817265352226221264d35bf753a44f273912d42629019b7c4b8f.exeiexplore.exeIEXPLORE.EXEiexplore.exe

description	pid	process	target process
PID 1064 wrote to memory of 700	1064	aed5c7355746817265352226221264d35bf753a44f273912d42629019b7c4b8f.exe	svchost.exe
PID 1064 wrote to memory of 700	1064	aed5c7355746817265352226221264d35bf753a44f273912d42629019b7c4b8f.exe	svchost.exe
PID 1064 wrote to memory of 700	1064	aed5c7355746817265352226221264d35bf753a44f273912d42629019b7c4b8f.exe	svchost.exe
PID 1064 wrote to memory of 700	1064	aed5c7355746817265352226221264d35bf753a44f273912d42629019b7c4b8f.exe	svchost.exe
PID 1064 wrote to memory of 700	1064	aed5c7355746817265352226221264d35bf753a44f273912d42629019b7c4b8f.exe	svchost.exe
PID 1064 wrote to memory of 700	1064	aed5c7355746817265352226221264d35bf753a44f273912d42629019b7c4b8f.exe	svchost.exe
PID 1064 wrote to memory of 700	1064	aed5c7355746817265352226221264d35bf753a44f273912d42629019b7c4b8f.exe	svchost.exe
PID 1064 wrote to memory of 700	1064	aed5c7355746817265352226221264d35bf753a44f273912d42629019b7c4b8f.exe	svchost.exe
PID 1064 wrote to memory of 700	1064	aed5c7355746817265352226221264d35bf753a44f273912d42629019b7c4b8f.exe	svchost.exe
PID 1064 wrote to memory of 1404	1064	aed5c7355746817265352226221264d35bf753a44f273912d42629019b7c4b8f.exe	iexplore.exe
PID 1064 wrote to memory of 1404	1064	aed5c7355746817265352226221264d35bf753a44f273912d42629019b7c4b8f.exe	iexplore.exe
PID 1064 wrote to memory of 1404	1064	aed5c7355746817265352226221264d35bf753a44f273912d42629019b7c4b8f.exe	iexplore.exe
PID 1404 wrote to memory of 4928	1404	iexplore.exe	IEXPLORE.EXE
PID 1404 wrote to memory of 4928	1404	iexplore.exe	IEXPLORE.EXE
PID 4928 wrote to memory of 4908	4928	IEXPLORE.EXE	IEXPLORE.EXE
PID 4928 wrote to memory of 4908	4928	IEXPLORE.EXE	IEXPLORE.EXE
PID 4928 wrote to memory of 4908	4928	IEXPLORE.EXE	IEXPLORE.EXE
PID 1064 wrote to memory of 856	1064	aed5c7355746817265352226221264d35bf753a44f273912d42629019b7c4b8f.exe	svchost.exe
PID 1064 wrote to memory of 856	1064	aed5c7355746817265352226221264d35bf753a44f273912d42629019b7c4b8f.exe	svchost.exe
PID 1064 wrote to memory of 856	1064	aed5c7355746817265352226221264d35bf753a44f273912d42629019b7c4b8f.exe	svchost.exe
PID 1064 wrote to memory of 856	1064	aed5c7355746817265352226221264d35bf753a44f273912d42629019b7c4b8f.exe	svchost.exe
PID 1064 wrote to memory of 856	1064	aed5c7355746817265352226221264d35bf753a44f273912d42629019b7c4b8f.exe	svchost.exe
PID 1064 wrote to memory of 856	1064	aed5c7355746817265352226221264d35bf753a44f273912d42629019b7c4b8f.exe	svchost.exe
PID 1064 wrote to memory of 856	1064	aed5c7355746817265352226221264d35bf753a44f273912d42629019b7c4b8f.exe	svchost.exe
PID 1064 wrote to memory of 856	1064	aed5c7355746817265352226221264d35bf753a44f273912d42629019b7c4b8f.exe	svchost.exe
PID 1064 wrote to memory of 856	1064	aed5c7355746817265352226221264d35bf753a44f273912d42629019b7c4b8f.exe	svchost.exe
PID 1064 wrote to memory of 1660	1064	aed5c7355746817265352226221264d35bf753a44f273912d42629019b7c4b8f.exe	iexplore.exe
PID 1064 wrote to memory of 1660	1064	aed5c7355746817265352226221264d35bf753a44f273912d42629019b7c4b8f.exe	iexplore.exe
PID 1064 wrote to memory of 1660	1064	aed5c7355746817265352226221264d35bf753a44f273912d42629019b7c4b8f.exe	iexplore.exe
PID 1660 wrote to memory of 1148	1660	iexplore.exe	IEXPLORE.EXE
PID 1660 wrote to memory of 1148	1660	iexplore.exe	IEXPLORE.EXE
PID 4928 wrote to memory of 2336	4928	IEXPLORE.EXE	IEXPLORE.EXE
PID 4928 wrote to memory of 2336	4928	IEXPLORE.EXE	IEXPLORE.EXE
PID 4928 wrote to memory of 2336	4928	IEXPLORE.EXE	IEXPLORE.EXE
PID 1064 wrote to memory of 2552	1064	aed5c7355746817265352226221264d35bf753a44f273912d42629019b7c4b8f.exe	yhrdjtahwqovjxtw.exe
PID 1064 wrote to memory of 2552	1064	aed5c7355746817265352226221264d35bf753a44f273912d42629019b7c4b8f.exe	yhrdjtahwqovjxtw.exe
PID 1064 wrote to memory of 2552	1064	aed5c7355746817265352226221264d35bf753a44f273912d42629019b7c4b8f.exe	yhrdjtahwqovjxtw.exe

C:\Users\Admin\AppData\Local\Temp\aed5c7355746817265352226221264d35bf753a44f273912d42629019b7c4b8f.exe
"C:\Users\Admin\AppData\Local\Temp\aed5c7355746817265352226221264d35bf753a44f273912d42629019b7c4b8f.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1064

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
2⤵
PID:700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 204
3⤵
- Program crash
PID:4996

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1404

C:\Program Files\Internet Explorer\IEXPLORE.EXE
"C:\Program Files\Internet Explorer\IEXPLORE.EXE"
3⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4928

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4928 CREDAT:17410 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4908

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4928 CREDAT:82950 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2336

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
2⤵
PID:856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 856 -s 204
3⤵
- Program crash
PID:2128

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1660

C:\Program Files\Internet Explorer\IEXPLORE.EXE
"C:\Program Files\Internet Explorer\IEXPLORE.EXE"
3⤵
- Modifies Internet Explorer settings
PID:1148

C:\Users\Admin\AppData\Local\Temp\yhrdjtahwqovjxtw.exe
"C:\Users\Admin\AppData\Local\Temp\yhrdjtahwqovjxtw.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 700 -ip 700
1⤵
PID:2892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 856 -ip 856
1⤵
PID:2932

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
471B

MD5
26cb63224b51d99ce887c9ff8130a338

SHA1
108ad165d80234621dfba3fb62195a26ce821acb

SHA256
c0a8afd7b1a047144b9cf337e4518f7ce1b5108dbbd135e593b4411855222a41

SHA512
5f0782919fdc942a1614fd76e25b62c74e96e4e8a12a30b1162db2d9bd3fd6ae8160c3edc101f7ea80137aabdbae62ae57bbe29b96b995b66f80162a647bd76d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
434B

MD5
ea73985ae8ec679af86fa439567262f1

SHA1
3540101d552b92bfbe45cb6097beb5d50cf3f78c

SHA256
c1be9b0660ad90616a79c201426811de2530010e74ac272d162099f418326b4f

SHA512
ae74cdb8794dee7d1bc84c4af78d866818bcce41c16104ee45e3b812eea501b31c31df1315c881c638defa46d36a98571e71064e44b44d05678507726830e05c

Download Submit
C:\Users\Admin\AppData\Local\Temp\yhrdjtahwqovjxtw.exe
Filesize
381KB

MD5
0957d5d8d21751f2fd1ad2015b19abe0

SHA1
c098ddc18a8a0dade35436f968eb43c1f4c9253c

SHA256
aed5c7355746817265352226221264d35bf753a44f273912d42629019b7c4b8f

SHA512
a7cbde567cd869828c757bd32a6571c401782bbdc54b76c1faa9e9b2509187b81dd85a0db641fa182c04edb598be75009ed02e9f0f196942d9662a8b1ed3e0b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\yhrdjtahwqovjxtw.exe
Filesize
381KB

MD5
0957d5d8d21751f2fd1ad2015b19abe0

SHA1
c098ddc18a8a0dade35436f968eb43c1f4c9253c

SHA256
aed5c7355746817265352226221264d35bf753a44f273912d42629019b7c4b8f

SHA512
a7cbde567cd869828c757bd32a6571c401782bbdc54b76c1faa9e9b2509187b81dd85a0db641fa182c04edb598be75009ed02e9f0f196942d9662a8b1ed3e0b6

Download Submit
memory/700-134-0x0000000000000000-mapping.dmp

Download
memory/856-137-0x0000000000000000-mapping.dmp

Download
memory/1064-132-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1064-135-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1064-143-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2552-140-0x0000000000000000-mapping.dmp

Download
memory/2552-144-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads