ramnit | 7fa25879a2eef66368e53f7a97c7a1018e6ca37c6006e66049a37639ef97eb73

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 00:05

Target

07f7cb6f44b538199ac2000d1269234f.dll
Size

504KB
MD5

07f7cb6f44b538199ac2000d1269234f
SHA1

2b52d224195f0d2af3b6fbcb9ddb93901a8956df
SHA256

7fa25879a2eef66368e53f7a97c7a1018e6ca37c6006e66049a37639ef97eb73
SHA512

cb3c004a7726e8d836d2d66eeaf3038363090c21b651e13f52bd0bc5101bfef0e1c3469895f1641f6fd4ff0b85dd11f2cc1cef2dc9cfdf840883a36aa585bf84
SSDEEP

12288:u79qXvjRc5AoIY+NPUlWnPp2MLlwc82id7hGZ+Z:EqXvjRc5AoITcknP8MLycYdEZ+Z

Score

10^/10

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Executes dropped EXE 1 IoCs

pid	Process
1904	rundll32mgr.exe

Loads dropped DLL 1 IoCs

pid	Process
1904	rundll32mgr.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1904-6-0x0000000000400000-0x000000000046B000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3712	1904	WerFault.exe	89

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 980 wrote to memory of 3836	980	rundll32.exe	88
PID 980 wrote to memory of 3836	980	rundll32.exe	88
PID 980 wrote to memory of 3836	980	rundll32.exe	88
PID 3836 wrote to memory of 1904	3836	rundll32.exe	89
PID 3836 wrote to memory of 1904	3836	rundll32.exe	89
PID 3836 wrote to memory of 1904	3836	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\07f7cb6f44b538199ac2000d1269234f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:980
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\07f7cb6f44b538199ac2000d1269234f.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:3836
- - C:\Windows\SysWOW64\rundll32mgr.exe
    C:\Windows\SysWOW64\rundll32mgr.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1904
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1904 -s 10184
      4⤵
      Program crash
      PID:3712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1904 -ip 1904
1⤵
PID:4656

C:\Users\Admin\AppData\Local\Temp\~TM4258.tmp

Filesize
146KB

MD5
7bf33f4856d62f0da46115b5cbd7797f

SHA1
d642ddbcd9a27493d560a9ee45988c5f690b7a46

SHA256
2f03770a6aa4b508f4f9c73dce3ff022e3fd8c75dfcd0b10978b3bb946091055

SHA512
ad27df202ac0083e74c0ae770dd74a0a503f96f4870297f9e278335178cd7364f6298890cd4b16a805172f21ecfe87e68a93f9ef90e8f668645818c400d26b95

Download Submit
C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
169KB

MD5
335f0aeb047ac7782090828b5d4fa10e

SHA1
73355b1c843bec7be94b0a39efb5ff3b1b4ee547

SHA256
6df4c841c30d414cfee93573963036abfd669627081705c6a0d9e65fd6846f53

SHA512
635d1e473a0f2cebad020f80e211b55bcb12742ddde1e65db182b077c8873f639b491ab8d11a6781095cf16729e03f93696514de72b58efad8157fad3ff399f1

Download Submit
memory/1904-5-0x00000000006D0000-0x000000000073B000-memory.dmp

Filesize
428KB

Download
memory/1904-6-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1904-11-0x0000000077132000-0x0000000077133000-memory.dmp

Filesize
4KB

Download
memory/1904-10-0x0000000077132000-0x0000000077134000-memory.dmp

Filesize
8KB

Download
memory/1904-13-0x00000000006D0000-0x000000000073B000-memory.dmp

Filesize
428KB

Download
memory/3836-0-0x0000000010000000-0x0000000010084000-memory.dmp

Filesize
528KB

Download