ramnit | f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb

General

Target

f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe
Size

116KB
MD5

55e5647a4cf23700abb43e04349af7ff
SHA1

4fbf606c1dd07729bdd5974b7660dd66d7ea6dd9
SHA256

f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb
SHA512

086e98b6f4bb96a2f59be2a53c3134424efa56d631938477ba42e6e08f79c2f870a5cbb73be64c00aeea13852d5179600fbbbf055224efbab1ade19a36e5c2b9
SSDEEP

1536:V+hzRsibKplyXTq8OGRnsPFG+RODTb7MXL5uXZnzEYNlcVQIFkbq/p23JAMBTqJd:gROzoTq0+RO7IwnYu6VHir3J2qed

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1900-55-0x0000000000400000-0x000000000043D000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

Processes:

f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft\px4B53.tmp	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe

pid process

1900 f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe

Suspicious behavior: MapViewOfSection 22 IoCs

Processes:

f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe

pid	process
1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe
1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe
1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe
1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe
1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe
1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe
1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe
1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe
1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe
1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe
1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe
1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe
1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe
1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe
1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe
1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe
1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe
1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe
1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe
1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe
1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe
1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

Processes:

f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe

description	pid	process
Token: SeDebugPrivilege	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe
Token: SeTakeOwnershipPrivilege	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe
Token: SeRestorePrivilege	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe
Token: SeBackupPrivilege	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe
Token: SeChangeNotifyPrivilege	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe
Token: SeTakeOwnershipPrivilege	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe
Token: SeRestorePrivilege	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe
Token: SeBackupPrivilege	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe
Token: SeChangeNotifyPrivilege	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe
Token: SeTakeOwnershipPrivilege	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe
Token: SeRestorePrivilege	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe
Token: SeBackupPrivilege	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe
Token: SeChangeNotifyPrivilege	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe
Token: SeTakeOwnershipPrivilege	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe
Token: SeRestorePrivilege	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe
Token: SeBackupPrivilege	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe
Token: SeChangeNotifyPrivilege	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe
Token: SeTakeOwnershipPrivilege	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe
Token: SeRestorePrivilege	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe
Token: SeBackupPrivilege	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe
Token: SeChangeNotifyPrivilege	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe

description	pid	process	target process
PID 1900 wrote to memory of 360	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe	wininit.exe
PID 1900 wrote to memory of 360	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe	wininit.exe
PID 1900 wrote to memory of 360	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe	wininit.exe
PID 1900 wrote to memory of 360	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe	wininit.exe
PID 1900 wrote to memory of 360	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe	wininit.exe
PID 1900 wrote to memory of 360	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe	wininit.exe
PID 1900 wrote to memory of 360	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe	wininit.exe
PID 1900 wrote to memory of 384	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe	csrss.exe
PID 1900 wrote to memory of 384	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe	csrss.exe
PID 1900 wrote to memory of 384	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe	csrss.exe
PID 1900 wrote to memory of 384	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe	csrss.exe
PID 1900 wrote to memory of 384	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe	csrss.exe
PID 1900 wrote to memory of 384	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe	csrss.exe
PID 1900 wrote to memory of 384	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe	csrss.exe
PID 1900 wrote to memory of 420	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe	winlogon.exe
PID 1900 wrote to memory of 420	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe	winlogon.exe
PID 1900 wrote to memory of 420	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe	winlogon.exe
PID 1900 wrote to memory of 420	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe	winlogon.exe
PID 1900 wrote to memory of 420	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe	winlogon.exe
PID 1900 wrote to memory of 420	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe	winlogon.exe
PID 1900 wrote to memory of 420	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe	winlogon.exe
PID 1900 wrote to memory of 464	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe	services.exe
PID 1900 wrote to memory of 464	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe	services.exe
PID 1900 wrote to memory of 464	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe	services.exe
PID 1900 wrote to memory of 464	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe	services.exe
PID 1900 wrote to memory of 464	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe	services.exe
PID 1900 wrote to memory of 464	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe	services.exe
PID 1900 wrote to memory of 464	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe	services.exe
PID 1900 wrote to memory of 480	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe	lsass.exe
PID 1900 wrote to memory of 480	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe	lsass.exe
PID 1900 wrote to memory of 480	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe	lsass.exe
PID 1900 wrote to memory of 480	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe	lsass.exe
PID 1900 wrote to memory of 480	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe	lsass.exe
PID 1900 wrote to memory of 480	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe	lsass.exe
PID 1900 wrote to memory of 480	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe	lsass.exe
PID 1900 wrote to memory of 488	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe	lsm.exe
PID 1900 wrote to memory of 488	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe	lsm.exe
PID 1900 wrote to memory of 488	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe	lsm.exe
PID 1900 wrote to memory of 488	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe	lsm.exe
PID 1900 wrote to memory of 488	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe	lsm.exe
PID 1900 wrote to memory of 488	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe	lsm.exe
PID 1900 wrote to memory of 488	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe	lsm.exe
PID 1900 wrote to memory of 600	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe	svchost.exe
PID 1900 wrote to memory of 600	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe	svchost.exe
PID 1900 wrote to memory of 600	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe	svchost.exe
PID 1900 wrote to memory of 600	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe	svchost.exe
PID 1900 wrote to memory of 600	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe	svchost.exe
PID 1900 wrote to memory of 600	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe	svchost.exe
PID 1900 wrote to memory of 600	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe	svchost.exe
PID 1900 wrote to memory of 680	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe	svchost.exe
PID 1900 wrote to memory of 680	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe	svchost.exe
PID 1900 wrote to memory of 680	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe	svchost.exe
PID 1900 wrote to memory of 680	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe	svchost.exe
PID 1900 wrote to memory of 680	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe	svchost.exe
PID 1900 wrote to memory of 680	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe	svchost.exe
PID 1900 wrote to memory of 680	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe	svchost.exe
PID 1900 wrote to memory of 764	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe	svchost.exe
PID 1900 wrote to memory of 764	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe	svchost.exe
PID 1900 wrote to memory of 764	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe	svchost.exe
PID 1900 wrote to memory of 764	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe	svchost.exe
PID 1900 wrote to memory of 764	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe	svchost.exe
PID 1900 wrote to memory of 764	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe	svchost.exe
PID 1900 wrote to memory of 764	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe	svchost.exe
PID 1900 wrote to memory of 816	1900	f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe	svchost.exe

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:480

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:464

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
2⤵
PID:816

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
3⤵
PID:1180

C:\Windows\system32\sppsvc.exe
C:\Windows\system32\sppsvc.exe
2⤵
PID:1824

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
2⤵
PID:1068

C:\Windows\system32\taskhost.exe
"taskhost.exe"
2⤵
PID:1116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
2⤵
PID:1044

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
2⤵
PID:540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService
2⤵
PID:240

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
2⤵
PID:964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
2⤵
PID:852

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
2⤵
PID:764

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS
2⤵
PID:680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
2⤵
PID:600

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:384

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:360

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
2⤵
PID:488

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
PID:1912

\\?\C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:2036

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1240

C:\Users\Admin\AppData\Local\Temp\f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe
"C:\Users\Admin\AppData\Local\Temp\f1055a713baebc863c92d5e9b70c83b4043a9c3b5975fd63683421d46988bfcb.exe"
2⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1900

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1900-55-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads