ramnit | 4b9ec227818536361e153e79d62af1e5f1f7dc0979b0c33a3ab24808f63a7b3c

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 16:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7d611036199b0fe2f4ac19be22ff9425.dll
Size

196KB
MD5

7d611036199b0fe2f4ac19be22ff9425
SHA1

d0e13d54ec1fe740d0c91c7eccf55acf64de3c3d
SHA256

4b9ec227818536361e153e79d62af1e5f1f7dc0979b0c33a3ab24808f63a7b3c
SHA512

b840f8f9b490fd27653f5f0842484941b43d051779f5a6f706edad7844bd60f9fdac6bde8436e32474256e9bbbb4cfeb958a0b4f5360d28c4e67e651132517d2
SSDEEP

3072:Ba9QmP7HKzAjfvvBQZ52+TDf2wBCwCWsh2WzYDx/pyBLorPaQYiJ4+Hx+C0Rrkhs:s9zjKAHZQeOxBCMsh29lpaaiq4jC0F

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Executes dropped EXE 1 IoCs

pid	Process
2928	regsvr32mgr.exe

Loads dropped DLL 4 IoCs

pid	Process
2892	regsvr32.exe
2892	regsvr32.exe
2928	regsvr32mgr.exe
2928	regsvr32mgr.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2928-23-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral1/memory/2928-12-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral1/files/0x000b0000000133a9-9.dat	upx
behavioral1/memory/2892-3-0x0000000000300000-0x000000000035D000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\regsvr32mgr.exe	regsvr32.exe

Program crash 1 IoCs

pid	pid_target	Process
2916	2928	WerFault.exe

Modifies registry class 30 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48DA6741-1BF0-4A44-8325-293086C79077}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48DA6741-1BF0-4A44-8325-293086C79077}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48DA6741-1BF0-4A44-8325-293086C79077}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IAS.DataStoreComServer.1\ = " "	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IAS.DataStoreComServer\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48DA6741-1BF0-4A44-8325-293086C79077}\ProgID\ = "IAS.DataStoreComServer.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IAS.DataStoreComServer\CLSID\ = "{48DA6741-1BF0-4A44-8325-293086C79077}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48DA6741-1BF0-4A44-8325-293086C79077}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IAS.DataStoreComServer.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48DA6741-1BF0-4A44-8325-293086C79077}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48DA6741-1BF0-4A44-8325-293086C79077}\TypeLib\ = "{DFDFB4EB-32B7-4B7F-A3D4-F798F75D3A46}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{83E05BD5-AEC1-4E58-AE50-E819C7296F67}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{83E05BD5-AEC1-4E58-AE50-E819C7296F67}\ = "IIASDataStoreComServer"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IAS.DataStoreComServer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48DA6741-1BF0-4A44-8325-293086C79077}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48DA6741-1BF0-4A44-8325-293086C79077}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7d611036199b0fe2f4ac19be22ff9425.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IAS.DataStoreComServer\ = " "	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48DA6741-1BF0-4A44-8325-293086C79077}\VersionIndependentProgID\ = "IAS.DataStoreComServer"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48DA6741-1BF0-4A44-8325-293086C79077}\InprocServer32\ThreadingModel = "Free"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{83E05BD5-AEC1-4E58-AE50-E819C7296F67}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{83E05BD5-AEC1-4E58-AE50-E819C7296F67}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{83E05BD5-AEC1-4E58-AE50-E819C7296F67}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IAS.DataStoreComServer.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IAS.DataStoreComServer.1\CLSID\ = "{48DA6741-1BF0-4A44-8325-293086C79077}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48DA6741-1BF0-4A44-8325-293086C79077}\ = " "	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{83E05BD5-AEC1-4E58-AE50-E819C7296F67}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{83E05BD5-AEC1-4E58-AE50-E819C7296F67}\TypeLib\ = "{DFDFB4EB-32B7-4B7F-A3D4-F798F75D3A46}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IAS.DataStoreComServer\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IAS.DataStoreComServer\CurVer\ = "IAS.DataStoreComServer.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48DA6741-1BF0-4A44-8325-293086C79077}\Version\ = "1.0"	regsvr32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 2892	2536	regsvr32.exe	16
PID 2536 wrote to memory of 2892	2536	regsvr32.exe	16
PID 2536 wrote to memory of 2892	2536	regsvr32.exe	16
PID 2536 wrote to memory of 2892	2536	regsvr32.exe	16
PID 2536 wrote to memory of 2892	2536	regsvr32.exe	16
PID 2536 wrote to memory of 2892	2536	regsvr32.exe	16
PID 2536 wrote to memory of 2892	2536	regsvr32.exe	16
PID 2892 wrote to memory of 2928	2892	regsvr32.exe	18
PID 2892 wrote to memory of 2928	2892	regsvr32.exe	18
PID 2892 wrote to memory of 2928	2892	regsvr32.exe	18
PID 2892 wrote to memory of 2928	2892	regsvr32.exe	18

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\7d611036199b0fe2f4ac19be22ff9425.dll
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Windows\SysWOW64\regsvr32mgr.exe
  C:\Windows\SysWOW64\regsvr32mgr.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 104
1⤵
- Program crash
PID:2916

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\7d611036199b0fe2f4ac19be22ff9425.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\regsvr32mgr.exe

Filesize
156KB

MD5
ab321ee0c1c94b89f14687b1d692120c

SHA1
2b0420b87171f41cf2f5c8320ead8437f52942c2

SHA256
096d1a4f535a08aaa5a836c06b7bae7f865c788d7965560bc8cd10ed0b4fa0a1

SHA512
3d7c2f66c2d72576908f15c2dfb73c1173c9688e3ea23e0f95b6b01645e0054dbcf15cc3c5fa0fd39a4c8e516793463046041527fed6bc75d43a68ab9641be04

Download Submit
\Users\Admin\AppData\Local\Temp\~TM686.tmp

Filesize
1.2MB

MD5
d124f55b9393c976963407dff51ffa79

SHA1
2c7bbedd79791bfb866898c85b504186db610b5d

SHA256
ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef

SHA512
278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06

Download Submit
\Users\Admin\AppData\Local\Temp\~TM697.tmp

Filesize
1.1MB

MD5
9b98d47916ead4f69ef51b56b0c2323c

SHA1
290a80b4ded0efc0fd00816f373fcea81a521330

SHA256
96e0ae104c9662d0d20fdf59844c2d18334e5847b6c4fc7f8ce4b3b87f39887b

SHA512
68b67021f228d8d71df4deb0b6388558b2f935a6aa466a12199cd37ada47ee588ea407b278d190d3a498b0ef3f5f1a2573a469b7ea5561ab2e7055c45565fe94

Download Submit
memory/2892-25-0x0000000000300000-0x000000000035D000-memory.dmp

Filesize
372KB

Download
memory/2892-0-0x0000000074780000-0x00000000747B5000-memory.dmp

Filesize
212KB

Download
memory/2892-10-0x0000000000300000-0x000000000035D000-memory.dmp

Filesize
372KB

Download
memory/2892-3-0x0000000000300000-0x000000000035D000-memory.dmp

Filesize
372KB

Download
memory/2928-22-0x0000000075740000-0x0000000075850000-memory.dmp

Filesize
1.1MB

Download
memory/2928-16-0x000000007754F000-0x0000000077551000-memory.dmp

Filesize
8KB

Download
memory/2928-17-0x0000000077550000-0x0000000077551000-memory.dmp

Filesize
4KB

Download
memory/2928-12-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2928-18-0x0000000077550000-0x0000000077552000-memory.dmp

Filesize
8KB

Download
memory/2928-21-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2928-23-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2928-24-0x0000000075740000-0x0000000075850000-memory.dmp

Filesize
1.1MB

Download