ramnit | 262f600f054469aa68cdb1fa554f1320eefcff6fbfd548485ff819a8a9cf34aa

General

Target

NEAS.041264e79633ca14999ae2dbf75aec96_JC.exe
Size

196KB
MD5

041264e79633ca14999ae2dbf75aec96
SHA1

885ae66fbe2e2d622a3a14c46d7fc69afede269e
SHA256

262f600f054469aa68cdb1fa554f1320eefcff6fbfd548485ff819a8a9cf34aa
SHA512

fe265d34570f2b201f3b2d08afb0b8f8871d8dbf5ddefa770c7eed637e35c6796a3c61f54c4824e58c1b0a8c720c43f7b4aee25ddb96569994603169235e66e4
SSDEEP

3072:zgZSlI/HUOjSiToj7CEqfqg2p0VWPIKYZN8NGYtR3wJe7nRW2Lr2:Uv/HFjSdfCZ4pYFiLb3qe7RZ2

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Executes dropped EXE 1 IoCs

pid	Process
2820	NEAS.041264e79633ca14999ae2dbf75aec96_JCmgr.exe

Loads dropped DLL 6 IoCs

pid	Process
2816	NEAS.041264e79633ca14999ae2dbf75aec96_JC.exe
2816	NEAS.041264e79633ca14999ae2dbf75aec96_JC.exe
2816	NEAS.041264e79633ca14999ae2dbf75aec96_JC.exe
2820	NEAS.041264e79633ca14999ae2dbf75aec96_JCmgr.exe
2816	NEAS.041264e79633ca14999ae2dbf75aec96_JC.exe
2820	NEAS.041264e79633ca14999ae2dbf75aec96_JCmgr.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2816-11-0x0000000000400000-0x000000000045F000-memory.dmp	upx
behavioral1/memory/2820-14-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/2816-29-0x0000000000400000-0x000000000045F000-memory.dmp	upx
behavioral1/memory/2820-35-0x0000000000400000-0x0000000000446000-memory.dmp	upx

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 2820	2816	NEAS.041264e79633ca14999ae2dbf75aec96_JC.exe	28
PID 2816 wrote to memory of 2820	2816	NEAS.041264e79633ca14999ae2dbf75aec96_JC.exe	28
PID 2816 wrote to memory of 2820	2816	NEAS.041264e79633ca14999ae2dbf75aec96_JC.exe	28
PID 2816 wrote to memory of 2820	2816	NEAS.041264e79633ca14999ae2dbf75aec96_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.041264e79633ca14999ae2dbf75aec96_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.041264e79633ca14999ae2dbf75aec96_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Users\Admin\AppData\Local\Temp\NEAS.041264e79633ca14999ae2dbf75aec96_JCmgr.exe
  C:\Users\Admin\AppData\Local\Temp\NEAS.041264e79633ca14999ae2dbf75aec96_JCmgr.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2820

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\NEAS.041264e79633ca14999ae2dbf75aec96_JCmgr.exe

Filesize
97KB

MD5
c1e022fb8b630cc6006ed3bc5090d22a

SHA1
6b42622aa21217aa3fa1e752ea169b2e261f4607

SHA256
030adac9b9db1dfc25823756c9afd98f2d71f03330bff39e38e02b1eb8c37a9b

SHA512
21f4d0882417a00047523ce2104ae2b5c50ce2c8328fe54668f683c4845631a1a1f02f862c0676485efa4f3606c8b8491c2a12005dd3d8fcf90a5aee071c7558

Download Submit
C:\Users\Admin\AppData\Local\Temp\NEAS.041264e79633ca14999ae2dbf75aec96_JCmgr.exe

Filesize
97KB

MD5
c1e022fb8b630cc6006ed3bc5090d22a

SHA1
6b42622aa21217aa3fa1e752ea169b2e261f4607

SHA256
030adac9b9db1dfc25823756c9afd98f2d71f03330bff39e38e02b1eb8c37a9b

SHA512
21f4d0882417a00047523ce2104ae2b5c50ce2c8328fe54668f683c4845631a1a1f02f862c0676485efa4f3606c8b8491c2a12005dd3d8fcf90a5aee071c7558

Download Submit
\Users\Admin\AppData\Local\Temp\NEAS.041264e79633ca14999ae2dbf75aec96_JCmgr.exe

Filesize
97KB

MD5
c1e022fb8b630cc6006ed3bc5090d22a

SHA1
6b42622aa21217aa3fa1e752ea169b2e261f4607

SHA256
030adac9b9db1dfc25823756c9afd98f2d71f03330bff39e38e02b1eb8c37a9b

SHA512
21f4d0882417a00047523ce2104ae2b5c50ce2c8328fe54668f683c4845631a1a1f02f862c0676485efa4f3606c8b8491c2a12005dd3d8fcf90a5aee071c7558

Download Submit
\Users\Admin\AppData\Local\Temp\NEAS.041264e79633ca14999ae2dbf75aec96_JCmgr.exe

Filesize
97KB

MD5
c1e022fb8b630cc6006ed3bc5090d22a

SHA1
6b42622aa21217aa3fa1e752ea169b2e261f4607

SHA256
030adac9b9db1dfc25823756c9afd98f2d71f03330bff39e38e02b1eb8c37a9b

SHA512
21f4d0882417a00047523ce2104ae2b5c50ce2c8328fe54668f683c4845631a1a1f02f862c0676485efa4f3606c8b8491c2a12005dd3d8fcf90a5aee071c7558

Download Submit
\Users\Admin\AppData\Local\Temp\~TM3B1D.tmp

Filesize
1.2MB

MD5
d124f55b9393c976963407dff51ffa79

SHA1
2c7bbedd79791bfb866898c85b504186db610b5d

SHA256
ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef

SHA512
278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06

Download Submit
\Users\Admin\AppData\Local\Temp\~TM3B8A.tmp

Filesize
1.2MB

MD5
d124f55b9393c976963407dff51ffa79

SHA1
2c7bbedd79791bfb866898c85b504186db610b5d

SHA256
ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef

SHA512
278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06

Download Submit
\Users\Admin\AppData\Local\Temp\~TM3C17.tmp

Filesize
1.1MB

MD5
9b98d47916ead4f69ef51b56b0c2323c

SHA1
290a80b4ded0efc0fd00816f373fcea81a521330

SHA256
96e0ae104c9662d0d20fdf59844c2d18334e5847b6c4fc7f8ce4b3b87f39887b

SHA512
68b67021f228d8d71df4deb0b6388558b2f935a6aa466a12199cd37ada47ee588ea407b278d190d3a498b0ef3f5f1a2573a469b7ea5561ab2e7055c45565fe94

Download Submit
\Users\Admin\AppData\Local\Temp\~TM3C85.tmp

Filesize
1.1MB

MD5
9b98d47916ead4f69ef51b56b0c2323c

SHA1
290a80b4ded0efc0fd00816f373fcea81a521330

SHA256
96e0ae104c9662d0d20fdf59844c2d18334e5847b6c4fc7f8ce4b3b87f39887b

SHA512
68b67021f228d8d71df4deb0b6388558b2f935a6aa466a12199cd37ada47ee588ea407b278d190d3a498b0ef3f5f1a2573a469b7ea5561ab2e7055c45565fe94

Download Submit
memory/2816-19-0x0000000077ACF000-0x0000000077AD1000-memory.dmp

Filesize
8KB

Download
memory/2816-12-0x0000000000230000-0x000000000028F000-memory.dmp

Filesize
380KB

Download
memory/2816-16-0x0000000000220000-0x0000000000266000-memory.dmp

Filesize
280KB

Download
memory/2816-11-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2816-0-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2816-21-0x0000000077AD0000-0x0000000077AD1000-memory.dmp

Filesize
4KB

Download
memory/2816-22-0x0000000077AD0000-0x0000000077AD2000-memory.dmp

Filesize
8KB

Download
memory/2816-30-0x0000000075920000-0x0000000075A30000-memory.dmp

Filesize
1.1MB

Download
memory/2816-4-0x0000000000220000-0x0000000000266000-memory.dmp

Filesize
280KB

Download
memory/2816-29-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2816-28-0x0000000075920000-0x0000000075A30000-memory.dmp

Filesize
1.1MB

Download
memory/2820-15-0x0000000000230000-0x0000000000276000-memory.dmp

Filesize
280KB

Download
memory/2820-14-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2820-33-0x0000000075920000-0x0000000075A30000-memory.dmp

Filesize
1.1MB

Download
memory/2820-35-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2820-36-0x0000000075920000-0x0000000075A30000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing