ramnit | 34b54cd936109de793abf56935b21be1de9fbf5f6892bb00ecfc36c4668238a3

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
01/02/2024, 08:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

866a7486a8022f7a088f58e4eb1bd322.exe
Size

256KB
MD5

866a7486a8022f7a088f58e4eb1bd322
SHA1

48d920ce86a75fe24b11b841b2b7d14de2671bb9
SHA256

34b54cd936109de793abf56935b21be1de9fbf5f6892bb00ecfc36c4668238a3
SHA512

5ff55d142f80ad7efd3ee1bffce1aa38b9e5ceeaa320a2ecbafb0d1b28a89d708f665c5e2deee5d3e420a79b89a619da881d876864a0ae59fced2fd2a41f628f
SSDEEP

6144:bMzzILGFkzhr0pGj9oXgIYZrcjrhGNRx7:TcoqGj9oXgIur8Qrx7

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2368-0-0x0000000000400000-0x000000000047C000-memory.dmp	upx
behavioral1/memory/2368-4-0x0000000000400000-0x000000000047C000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2368	866a7486a8022f7a088f58e4eb1bd322.exe

Suspicious behavior: MapViewOfSection 21 IoCs

pid	Process
2368	866a7486a8022f7a088f58e4eb1bd322.exe
2368	866a7486a8022f7a088f58e4eb1bd322.exe
2368	866a7486a8022f7a088f58e4eb1bd322.exe
2368	866a7486a8022f7a088f58e4eb1bd322.exe
2368	866a7486a8022f7a088f58e4eb1bd322.exe
2368	866a7486a8022f7a088f58e4eb1bd322.exe
2368	866a7486a8022f7a088f58e4eb1bd322.exe
2368	866a7486a8022f7a088f58e4eb1bd322.exe
2368	866a7486a8022f7a088f58e4eb1bd322.exe
2368	866a7486a8022f7a088f58e4eb1bd322.exe
2368	866a7486a8022f7a088f58e4eb1bd322.exe
2368	866a7486a8022f7a088f58e4eb1bd322.exe
2368	866a7486a8022f7a088f58e4eb1bd322.exe
2368	866a7486a8022f7a088f58e4eb1bd322.exe
2368	866a7486a8022f7a088f58e4eb1bd322.exe
2368	866a7486a8022f7a088f58e4eb1bd322.exe
2368	866a7486a8022f7a088f58e4eb1bd322.exe
2368	866a7486a8022f7a088f58e4eb1bd322.exe
2368	866a7486a8022f7a088f58e4eb1bd322.exe
2368	866a7486a8022f7a088f58e4eb1bd322.exe
2368	866a7486a8022f7a088f58e4eb1bd322.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2368	866a7486a8022f7a088f58e4eb1bd322.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 388	2368	866a7486a8022f7a088f58e4eb1bd322.exe	25
PID 2368 wrote to memory of 388	2368	866a7486a8022f7a088f58e4eb1bd322.exe	25
PID 2368 wrote to memory of 388	2368	866a7486a8022f7a088f58e4eb1bd322.exe	25
PID 2368 wrote to memory of 388	2368	866a7486a8022f7a088f58e4eb1bd322.exe	25
PID 2368 wrote to memory of 388	2368	866a7486a8022f7a088f58e4eb1bd322.exe	25
PID 2368 wrote to memory of 388	2368	866a7486a8022f7a088f58e4eb1bd322.exe	25
PID 2368 wrote to memory of 388	2368	866a7486a8022f7a088f58e4eb1bd322.exe	25
PID 2368 wrote to memory of 400	2368	866a7486a8022f7a088f58e4eb1bd322.exe	24
PID 2368 wrote to memory of 400	2368	866a7486a8022f7a088f58e4eb1bd322.exe	24
PID 2368 wrote to memory of 400	2368	866a7486a8022f7a088f58e4eb1bd322.exe	24
PID 2368 wrote to memory of 400	2368	866a7486a8022f7a088f58e4eb1bd322.exe	24
PID 2368 wrote to memory of 400	2368	866a7486a8022f7a088f58e4eb1bd322.exe	24
PID 2368 wrote to memory of 400	2368	866a7486a8022f7a088f58e4eb1bd322.exe	24
PID 2368 wrote to memory of 400	2368	866a7486a8022f7a088f58e4eb1bd322.exe	24
PID 2368 wrote to memory of 436	2368	866a7486a8022f7a088f58e4eb1bd322.exe	23
PID 2368 wrote to memory of 436	2368	866a7486a8022f7a088f58e4eb1bd322.exe	23
PID 2368 wrote to memory of 436	2368	866a7486a8022f7a088f58e4eb1bd322.exe	23
PID 2368 wrote to memory of 436	2368	866a7486a8022f7a088f58e4eb1bd322.exe	23
PID 2368 wrote to memory of 436	2368	866a7486a8022f7a088f58e4eb1bd322.exe	23
PID 2368 wrote to memory of 436	2368	866a7486a8022f7a088f58e4eb1bd322.exe	23
PID 2368 wrote to memory of 436	2368	866a7486a8022f7a088f58e4eb1bd322.exe	23
PID 2368 wrote to memory of 480	2368	866a7486a8022f7a088f58e4eb1bd322.exe	22
PID 2368 wrote to memory of 480	2368	866a7486a8022f7a088f58e4eb1bd322.exe	22
PID 2368 wrote to memory of 480	2368	866a7486a8022f7a088f58e4eb1bd322.exe	22
PID 2368 wrote to memory of 480	2368	866a7486a8022f7a088f58e4eb1bd322.exe	22
PID 2368 wrote to memory of 480	2368	866a7486a8022f7a088f58e4eb1bd322.exe	22
PID 2368 wrote to memory of 480	2368	866a7486a8022f7a088f58e4eb1bd322.exe	22
PID 2368 wrote to memory of 480	2368	866a7486a8022f7a088f58e4eb1bd322.exe	22
PID 2368 wrote to memory of 496	2368	866a7486a8022f7a088f58e4eb1bd322.exe	1
PID 2368 wrote to memory of 496	2368	866a7486a8022f7a088f58e4eb1bd322.exe	1
PID 2368 wrote to memory of 496	2368	866a7486a8022f7a088f58e4eb1bd322.exe	1
PID 2368 wrote to memory of 496	2368	866a7486a8022f7a088f58e4eb1bd322.exe	1
PID 2368 wrote to memory of 496	2368	866a7486a8022f7a088f58e4eb1bd322.exe	1
PID 2368 wrote to memory of 496	2368	866a7486a8022f7a088f58e4eb1bd322.exe	1
PID 2368 wrote to memory of 496	2368	866a7486a8022f7a088f58e4eb1bd322.exe	1
PID 2368 wrote to memory of 504	2368	866a7486a8022f7a088f58e4eb1bd322.exe	21
PID 2368 wrote to memory of 504	2368	866a7486a8022f7a088f58e4eb1bd322.exe	21
PID 2368 wrote to memory of 504	2368	866a7486a8022f7a088f58e4eb1bd322.exe	21
PID 2368 wrote to memory of 504	2368	866a7486a8022f7a088f58e4eb1bd322.exe	21
PID 2368 wrote to memory of 504	2368	866a7486a8022f7a088f58e4eb1bd322.exe	21
PID 2368 wrote to memory of 504	2368	866a7486a8022f7a088f58e4eb1bd322.exe	21
PID 2368 wrote to memory of 504	2368	866a7486a8022f7a088f58e4eb1bd322.exe	21
PID 2368 wrote to memory of 604	2368	866a7486a8022f7a088f58e4eb1bd322.exe	20
PID 2368 wrote to memory of 604	2368	866a7486a8022f7a088f58e4eb1bd322.exe	20
PID 2368 wrote to memory of 604	2368	866a7486a8022f7a088f58e4eb1bd322.exe	20
PID 2368 wrote to memory of 604	2368	866a7486a8022f7a088f58e4eb1bd322.exe	20
PID 2368 wrote to memory of 604	2368	866a7486a8022f7a088f58e4eb1bd322.exe	20
PID 2368 wrote to memory of 604	2368	866a7486a8022f7a088f58e4eb1bd322.exe	20
PID 2368 wrote to memory of 604	2368	866a7486a8022f7a088f58e4eb1bd322.exe	20
PID 2368 wrote to memory of 680	2368	866a7486a8022f7a088f58e4eb1bd322.exe	19
PID 2368 wrote to memory of 680	2368	866a7486a8022f7a088f58e4eb1bd322.exe	19
PID 2368 wrote to memory of 680	2368	866a7486a8022f7a088f58e4eb1bd322.exe	19
PID 2368 wrote to memory of 680	2368	866a7486a8022f7a088f58e4eb1bd322.exe	19
PID 2368 wrote to memory of 680	2368	866a7486a8022f7a088f58e4eb1bd322.exe	19
PID 2368 wrote to memory of 680	2368	866a7486a8022f7a088f58e4eb1bd322.exe	19
PID 2368 wrote to memory of 680	2368	866a7486a8022f7a088f58e4eb1bd322.exe	19
PID 2368 wrote to memory of 752	2368	866a7486a8022f7a088f58e4eb1bd322.exe	2
PID 2368 wrote to memory of 752	2368	866a7486a8022f7a088f58e4eb1bd322.exe	2
PID 2368 wrote to memory of 752	2368	866a7486a8022f7a088f58e4eb1bd322.exe	2
PID 2368 wrote to memory of 752	2368	866a7486a8022f7a088f58e4eb1bd322.exe	2
PID 2368 wrote to memory of 752	2368	866a7486a8022f7a088f58e4eb1bd322.exe	2
PID 2368 wrote to memory of 752	2368	866a7486a8022f7a088f58e4eb1bd322.exe	2
PID 2368 wrote to memory of 752	2368	866a7486a8022f7a088f58e4eb1bd322.exe	2
PID 2368 wrote to memory of 828	2368	866a7486a8022f7a088f58e4eb1bd322.exe	18

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:496

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
1⤵
PID:900

C:\Windows\system32\sppsvc.exe
C:\Windows\system32\sppsvc.exe
1⤵
PID:2244

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1224

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1376
- C:\Users\Admin\AppData\Local\Temp\866a7486a8022f7a088f58e4eb1bd322.exe
  "C:\Users\Admin\AppData\Local\Temp\866a7486a8022f7a088f58e4eb1bd322.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2368

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1328

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
1⤵
PID:1032

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService
1⤵
PID:348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
1⤵
PID:1004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
PID:864

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
1⤵
PID:828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS
1⤵
PID:680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
1⤵
PID:604

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
1⤵
PID:504

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:480

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:436

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:400

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:388

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2368-0-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/2368-1-0x00000000773CF000-0x00000000773D0000-memory.dmp

Filesize
4KB

Download
memory/2368-2-0x00000000773D0000-0x00000000773D1000-memory.dmp

Filesize
4KB

Download
memory/2368-4-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/2368-3-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download