ramnit | c9907e55f0d5592ff335d35708baeb186e11300df90aa3aef1a142344ecc493f | Triage

Analysis

max time kernel
104s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
25/04/2023, 17:26 UTC

Sharing

Report Analysis Logs

General

Target

Backdoor.Win32.IRCNite.exe
Size

159KB
MD5

709286f2947b18adb809110084227eea
SHA1

2e17106d559df79268d4a8b65b3edf2becc01daa
SHA256

c9907e55f0d5592ff335d35708baeb186e11300df90aa3aef1a142344ecc493f
SHA512

3449920ebde4a20fe51cfe3dadda41c9ca220dc4d0eb2d782e13be074378c3f4653be8fa0492f50e8487756cb4d8ee003998f1bcc302cb54063f312a764dc6fa
SSDEEP

3072:f2gWOEjo6pqMLvJkSo1KArzoHHAgzzInpD:OgXM9UKGzYHAKO

Score

10^/10

ramnit banker evasion persistence spyware stealer trojan upx worm

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

Winlogon Helper DLL

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,,C:\\Users\\Admin\\AppData\\Local\\gfvfrqth\\olnrctau.exe"	Backdoor.Win32.IRCNite.exe

Modifies firewall policy service 2 TTPs 3 IoCs

Modify Registry

Modify Existing Service

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	Backdoor.Win32.IRCNite.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	Backdoor.Win32.IRCNite.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	Backdoor.Win32.IRCNite.exe

Modifies security service 2 TTPs 3 IoCs

Modify Registry

Modify Existing Service

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	Backdoor.Win32.IRCNite.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mpssvc\Start = "4"	Backdoor.Win32.IRCNite.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	Backdoor.Win32.IRCNite.exe

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

UAC bypass 3 TTPs 1 IoCs

Bypass User Account Control

Disabling Security Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Backdoor.Win32.IRCNite.exe

Windows security bypass 2 TTPs 6 IoCs

Disabling Security Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	Backdoor.Win32.IRCNite.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	Backdoor.Win32.IRCNite.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	Backdoor.Win32.IRCNite.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	Backdoor.Win32.IRCNite.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	Backdoor.Win32.IRCNite.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	Backdoor.Win32.IRCNite.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\olnrctau.exe	Backdoor.Win32.IRCNite.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\olnrctau.exe	Backdoor.Win32.IRCNite.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1932-133-0x0000000015190000-0x0000000015209000-memory.dmp	upx
behavioral2/memory/1932-134-0x0000000015190000-0x0000000015209000-memory.dmp	upx
behavioral2/memory/1932-140-0x0000000015190000-0x0000000015209000-memory.dmp	upx

Windows security modification 2 TTPs 6 IoCs

Disabling Security Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	Backdoor.Win32.IRCNite.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	Backdoor.Win32.IRCNite.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	Backdoor.Win32.IRCNite.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	Backdoor.Win32.IRCNite.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	Backdoor.Win32.IRCNite.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	Backdoor.Win32.IRCNite.exe

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OlnRctau = "C:\\Users\\Admin\\AppData\\Local\\gfvfrqth\\olnrctau.exe"	Backdoor.Win32.IRCNite.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

System Information Discovery

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Backdoor.Win32.IRCNite.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1932	Backdoor.Win32.IRCNite.exe
1932	Backdoor.Win32.IRCNite.exe
1932	Backdoor.Win32.IRCNite.exe
1932	Backdoor.Win32.IRCNite.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeSecurityPrivilege	1932	Backdoor.Win32.IRCNite.exe

System policy modification 1 TTPs 1 IoCs

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Backdoor.Win32.IRCNite.exe

C:\Users\Admin\AppData\Local\Temp\Backdoor.Win32.IRCNite.exe
"C:\Users\Admin\AppData\Local\Temp\Backdoor.Win32.IRCNite.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies firewall policy service
- Modifies security service
- UAC bypass
- Windows security bypass
- Drops startup file
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:1932

Network

DNS

146.78.124.51.in-addr.arpa

Remote address:

8.8.8.8:53

Request

146.78.124.51.in-addr.arpa

IN PTR

Response
DNS

228.249.119.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

228.249.119.40.in-addr.arpa

IN PTR

Response
DNS

44.8.109.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

44.8.109.52.in-addr.arpa

IN PTR

Response
DNS

8.3.197.209.in-addr.arpa

Remote address:

8.8.8.8:53

Request

8.3.197.209.in-addr.arpa

IN PTR

Response

8.3.197.209.in-addr.arpa

IN PTR

vip0x008map2sslhwcdnnet

93.184.220.29:80

322 B
7
93.184.220.29:80

322 B
7
87.248.202.1:80

322 B
7
87.248.202.1:80

322 B
7
173.223.113.164:443

322 B
7
173.223.113.131:80

322 B
7
204.79.197.203:80

322 B
7
88.221.25.155:80

322 B
7

8.8.8.8:53

146.78.124.51.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

146.78.124.51.in-addr.arpa
8.8.8.8:53

228.249.119.40.in-addr.arpa

dns

73 B
159 B
1
1

DNS Request

228.249.119.40.in-addr.arpa
8.8.8.8:53

44.8.109.52.in-addr.arpa

dns

70 B
144 B
1
1

DNS Request

44.8.109.52.in-addr.arpa
8.8.8.8:53

8.3.197.209.in-addr.arpa

dns

70 B
111 B
1
1

DNS Request

8.3.197.209.in-addr.arpa

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1932-133-0x0000000015190000-0x0000000015209000-memory.dmp

Filesize
484KB

Download
memory/1932-134-0x0000000015190000-0x0000000015209000-memory.dmp

Filesize
484KB

Download
memory/1932-139-0x0000000000440000-0x0000000000441000-memory.dmp

Filesize
4KB

Download
memory/1932-138-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

Filesize
4KB

Download
memory/1932-140-0x0000000015190000-0x0000000015209000-memory.dmp

Filesize
484KB

Download