Overview

overview

10

Static

static

a78aa7e8cb...80.exe

windows7-x64

10

a78aa7e8cb...80.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a78aa7e8cb918a202fbc37863674fea1008063e771cc440f2e466bd1cc418f80

  • Size

    95KB

  • Sample

    230129-nk91jsef4v

  • MD5

    92abcb46ed44b6f5e4457839d63c048f

  • SHA1

    d409f13652b6bd456a3b08ccc775392950aa3739

  • SHA256

    a78aa7e8cb918a202fbc37863674fea1008063e771cc440f2e466bd1cc418f80

  • SHA512

    cbfda6d0a54f59612a581929d33ff6deb2faba9e781227c933a255c1f067e7736f484346bc7ab9e1acc3ea2192a3731ab3e57ad6592810bb0d41b415a2306fa6

  • SSDEEP

    1536:u7dkoVi9I2VK/JmpMZGH7+NICr3DUDloBzq3GmT2BbahE7jwaaHw7Koj4rhfu+u1:mdkoV4I2VK/Jmp6Gb+eCDgb3GmT2Bb5B

Score
10/10
ramnitbankerevasionpersistencespywarestealertrojanworm

Malware Config

Targets

    • Target

      a78aa7e8cb918a202fbc37863674fea1008063e771cc440f2e466bd1cc418f80

    • Size

      95KB

    • MD5

      92abcb46ed44b6f5e4457839d63c048f

    • SHA1

      d409f13652b6bd456a3b08ccc775392950aa3739

    • SHA256

      a78aa7e8cb918a202fbc37863674fea1008063e771cc440f2e466bd1cc418f80

    • SHA512

      cbfda6d0a54f59612a581929d33ff6deb2faba9e781227c933a255c1f067e7736f484346bc7ab9e1acc3ea2192a3731ab3e57ad6592810bb0d41b415a2306fa6

    • SSDEEP

      1536:u7dkoVi9I2VK/JmpMZGH7+NICr3DUDloBzq3GmT2BbahE7jwaaHw7Koj4rhfu+u1:mdkoV4I2VK/Jmp6Gb+eCDgb3GmT2Bb5B

    Score
    10/10
    ramnitbankerevasionpersistencespywarestealertrojanworm

    • Modifies WinLogon for persistence

      persistence

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

      trojanspywarestealerwormbankerramnit

    • UAC bypass

      evasiontrojan

    • Executes dropped EXE

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Bypass User Account Control

1
T1088

Defense Evasion

Modify Registry

4
T1112

Bypass User Account Control

1
T1088

Disabling Security Tools

1
T1089

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks