ramnit | ea863772564cbd1fb0bc7778d34f70b7a7755ccce0606b96e01dc4a8fc80b3ee

General

Target

b8fef5b21e28029c9237233efc68fc6f.exe
Size

100KB
MD5

b8fef5b21e28029c9237233efc68fc6f
SHA1

8dd54f6e717991f3daba459eb700661f6bbf131e
SHA256

ea863772564cbd1fb0bc7778d34f70b7a7755ccce0606b96e01dc4a8fc80b3ee
SHA512

c5aa9c9c8fb70bc3368ec75dc4b22254ca8c6eca880eabedf0c9d5610d3f57728beb79658ac10d995e639dc196f57f460c7361850b51e6a9be4045b2edd1f949
SSDEEP

3072:OyfGVaHHHlu8qq2WbGaP0YKjnGVk8jwaaHw7Koj4rDMwl:Oj4HUv0vcZBD

Score

10^/10

ramnit banker evasion persistence spyware stealer trojan worm

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,C:\\Users\\Admin\\AppData\\Local\\csmqdfwc\\kyednigo.exe"	svchost.exe

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1548.002

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

svchost.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.

Query Registry
T1012

System Information Discovery
T1082

Processes:

svchost.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	svchost.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svchost.exe

Drops startup file 2 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kyednigo.exe	svchost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kyednigo.exe	svchost.exe

Executes dropped EXE 1 IoCs

Processes:

ceyxpkiypjuamhij.exe

pid process

2956 ceyxpkiypjuamhij.exe

pid	process
2956	ceyxpkiypjuamhij.exe

Loads dropped DLL 5 IoCs

Processes:

b8fef5b21e28029c9237233efc68fc6f.exe

pid	process
2020	b8fef5b21e28029c9237233efc68fc6f.exe
2020	b8fef5b21e28029c9237233efc68fc6f.exe
2020	b8fef5b21e28029c9237233efc68fc6f.exe
2020	b8fef5b21e28029c9237233efc68fc6f.exe
2020	b8fef5b21e28029c9237233efc68fc6f.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\KyeDnigo = "C:\\Users\\Admin\\AppData\\Local\\csmqdfwc\\kyednigo.exe"	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

svchost.exe

pid	process
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

480

pid	process
480

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

b8fef5b21e28029c9237233efc68fc6f.exesvchost.exesvchost.execeyxpkiypjuamhij.exe

description	pid	process
Token: SeSecurityPrivilege	2020	b8fef5b21e28029c9237233efc68fc6f.exe
Token: SeDebugPrivilege	2020	b8fef5b21e28029c9237233efc68fc6f.exe
Token: SeSecurityPrivilege	1980	svchost.exe
Token: SeSecurityPrivilege	2780	svchost.exe
Token: SeDebugPrivilege	2780	svchost.exe
Token: SeRestorePrivilege	2780	svchost.exe
Token: SeBackupPrivilege	2780	svchost.exe
Token: SeRestorePrivilege	2780	svchost.exe
Token: SeBackupPrivilege	2780	svchost.exe
Token: SeRestorePrivilege	2780	svchost.exe
Token: SeBackupPrivilege	2780	svchost.exe
Token: SeRestorePrivilege	2780	svchost.exe
Token: SeBackupPrivilege	2780	svchost.exe
Token: SeRestorePrivilege	2780	svchost.exe
Token: SeBackupPrivilege	2780	svchost.exe
Token: SeRestorePrivilege	2780	svchost.exe
Token: SeBackupPrivilege	2780	svchost.exe
Token: SeSecurityPrivilege	2956	ceyxpkiypjuamhij.exe
Token: SeLoadDriverPrivilege	2956	ceyxpkiypjuamhij.exe
Token: SeRestorePrivilege	2780	svchost.exe
Token: SeBackupPrivilege	2780	svchost.exe
Token: SeRestorePrivilege	2780	svchost.exe
Token: SeBackupPrivilege	2780	svchost.exe
Token: SeRestorePrivilege	2780	svchost.exe
Token: SeBackupPrivilege	2780	svchost.exe
Token: SeRestorePrivilege	2780	svchost.exe
Token: SeBackupPrivilege	2780	svchost.exe
Token: SeRestorePrivilege	2780	svchost.exe
Token: SeBackupPrivilege	2780	svchost.exe
Token: SeRestorePrivilege	2780	svchost.exe
Token: SeBackupPrivilege	2780	svchost.exe
Token: SeRestorePrivilege	2780	svchost.exe
Token: SeBackupPrivilege	2780	svchost.exe
Token: SeRestorePrivilege	2780	svchost.exe
Token: SeBackupPrivilege	2780	svchost.exe
Token: SeRestorePrivilege	2780	svchost.exe
Token: SeBackupPrivilege	2780	svchost.exe
Token: SeRestorePrivilege	2780	svchost.exe
Token: SeBackupPrivilege	2780	svchost.exe
Token: SeRestorePrivilege	2780	svchost.exe
Token: SeBackupPrivilege	2780	svchost.exe
Token: SeRestorePrivilege	2780	svchost.exe
Token: SeBackupPrivilege	2780	svchost.exe
Token: SeRestorePrivilege	2780	svchost.exe
Token: SeBackupPrivilege	2780	svchost.exe
Token: SeRestorePrivilege	2780	svchost.exe
Token: SeBackupPrivilege	2780	svchost.exe
Token: SeRestorePrivilege	2780	svchost.exe
Token: SeBackupPrivilege	2780	svchost.exe
Token: SeRestorePrivilege	2780	svchost.exe
Token: SeBackupPrivilege	2780	svchost.exe
Token: SeRestorePrivilege	2780	svchost.exe
Token: SeBackupPrivilege	2780	svchost.exe
Token: SeRestorePrivilege	2780	svchost.exe
Token: SeBackupPrivilege	2780	svchost.exe
Token: SeRestorePrivilege	2780	svchost.exe
Token: SeBackupPrivilege	2780	svchost.exe
Token: SeRestorePrivilege	2780	svchost.exe
Token: SeBackupPrivilege	2780	svchost.exe
Token: SeRestorePrivilege	2780	svchost.exe
Token: SeBackupPrivilege	2780	svchost.exe
Token: SeRestorePrivilege	2780	svchost.exe
Token: SeBackupPrivilege	2780	svchost.exe
Token: SeRestorePrivilege	2780	svchost.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

b8fef5b21e28029c9237233efc68fc6f.exe

description	pid	process	target process
PID 2020 wrote to memory of 1980	2020	b8fef5b21e28029c9237233efc68fc6f.exe	svchost.exe
PID 2020 wrote to memory of 1980	2020	b8fef5b21e28029c9237233efc68fc6f.exe	svchost.exe
PID 2020 wrote to memory of 1980	2020	b8fef5b21e28029c9237233efc68fc6f.exe	svchost.exe
PID 2020 wrote to memory of 1980	2020	b8fef5b21e28029c9237233efc68fc6f.exe	svchost.exe
PID 2020 wrote to memory of 1980	2020	b8fef5b21e28029c9237233efc68fc6f.exe	svchost.exe
PID 2020 wrote to memory of 1980	2020	b8fef5b21e28029c9237233efc68fc6f.exe	svchost.exe
PID 2020 wrote to memory of 1980	2020	b8fef5b21e28029c9237233efc68fc6f.exe	svchost.exe
PID 2020 wrote to memory of 1980	2020	b8fef5b21e28029c9237233efc68fc6f.exe	svchost.exe
PID 2020 wrote to memory of 1980	2020	b8fef5b21e28029c9237233efc68fc6f.exe	svchost.exe
PID 2020 wrote to memory of 1980	2020	b8fef5b21e28029c9237233efc68fc6f.exe	svchost.exe
PID 2020 wrote to memory of 2780	2020	b8fef5b21e28029c9237233efc68fc6f.exe	svchost.exe
PID 2020 wrote to memory of 2780	2020	b8fef5b21e28029c9237233efc68fc6f.exe	svchost.exe
PID 2020 wrote to memory of 2780	2020	b8fef5b21e28029c9237233efc68fc6f.exe	svchost.exe
PID 2020 wrote to memory of 2780	2020	b8fef5b21e28029c9237233efc68fc6f.exe	svchost.exe
PID 2020 wrote to memory of 2780	2020	b8fef5b21e28029c9237233efc68fc6f.exe	svchost.exe
PID 2020 wrote to memory of 2780	2020	b8fef5b21e28029c9237233efc68fc6f.exe	svchost.exe
PID 2020 wrote to memory of 2780	2020	b8fef5b21e28029c9237233efc68fc6f.exe	svchost.exe
PID 2020 wrote to memory of 2780	2020	b8fef5b21e28029c9237233efc68fc6f.exe	svchost.exe
PID 2020 wrote to memory of 2780	2020	b8fef5b21e28029c9237233efc68fc6f.exe	svchost.exe
PID 2020 wrote to memory of 2780	2020	b8fef5b21e28029c9237233efc68fc6f.exe	svchost.exe
PID 2020 wrote to memory of 2956	2020	b8fef5b21e28029c9237233efc68fc6f.exe	ceyxpkiypjuamhij.exe
PID 2020 wrote to memory of 2956	2020	b8fef5b21e28029c9237233efc68fc6f.exe	ceyxpkiypjuamhij.exe
PID 2020 wrote to memory of 2956	2020	b8fef5b21e28029c9237233efc68fc6f.exe	ceyxpkiypjuamhij.exe
PID 2020 wrote to memory of 2956	2020	b8fef5b21e28029c9237233efc68fc6f.exe	ceyxpkiypjuamhij.exe

C:\Users\Admin\AppData\Local\Temp\b8fef5b21e28029c9237233efc68fc6f.exe
"C:\Users\Admin\AppData\Local\Temp\b8fef5b21e28029c9237233efc68fc6f.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2020

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1980

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Checks BIOS information in registry
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2780

C:\Users\Admin\AppData\Local\Temp\ceyxpkiypjuamhij.exe
"C:\Users\Admin\AppData\Local\Temp\ceyxpkiypjuamhij.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2956

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Defense Evasion

Modify Registry

3

T1112

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

1

T1562

Disable or Modify Tools

1

T1562.001

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\csmqdfwc\kyednigo.exe
Filesize
100KB

MD5
b8fef5b21e28029c9237233efc68fc6f

SHA1
8dd54f6e717991f3daba459eb700661f6bbf131e

SHA256
ea863772564cbd1fb0bc7778d34f70b7a7755ccce0606b96e01dc4a8fc80b3ee

SHA512
c5aa9c9c8fb70bc3368ec75dc4b22254ca8c6eca880eabedf0c9d5610d3f57728beb79658ac10d995e639dc196f57f460c7361850b51e6a9be4045b2edd1f949

Download Submit
memory/1980-23-0x0000000020010000-0x000000002001C000-memory.dmp

Filesize
48KB

Download
memory/1980-12-0x0000000000050000-0x0000000000051000-memory.dmp

Filesize
4KB

Download
memory/1980-16-0x0000000020010000-0x000000002001C000-memory.dmp

Filesize
48KB

Download
memory/1980-18-0x0000000000070000-0x0000000000071000-memory.dmp

Filesize
4KB

Download
memory/1980-20-0x0000000000050000-0x0000000000051000-memory.dmp

Filesize
4KB

Download
memory/1980-10-0x0000000020010000-0x000000002001C000-memory.dmp

Filesize
48KB

Download
memory/1980-25-0x0000000020010000-0x000000002001C000-memory.dmp

Filesize
48KB

Download
memory/1980-22-0x0000000000060000-0x0000000000061000-memory.dmp

Filesize
4KB

Download
memory/1980-24-0x0000000020010000-0x000000002001C000-memory.dmp

Filesize
48KB

Download
memory/2020-54-0x0000000000400000-0x000000000043A6DC-memory.dmp

Filesize
233KB

Download
memory/2020-58-0x0000000002BB0000-0x0000000002BEB000-memory.dmp

Filesize
236KB

Download
memory/2020-0-0x0000000000400000-0x000000000043A6DC-memory.dmp

Filesize
233KB

Download
memory/2020-6-0x000000007705F000-0x0000000077060000-memory.dmp

Filesize
4KB

Download
memory/2020-5-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/2020-7-0x0000000000340000-0x0000000000341000-memory.dmp

Filesize
4KB

Download
memory/2020-8-0x0000000077060000-0x0000000077061000-memory.dmp

Filesize
4KB

Download
memory/2020-74-0x0000000002BB0000-0x0000000002BEB000-memory.dmp

Filesize
236KB

Download
memory/2020-73-0x000000007705F000-0x0000000077060000-memory.dmp

Filesize
4KB

Download
memory/2020-1-0x0000000000400000-0x000000000043A6DC-memory.dmp

Filesize
233KB

Download
memory/2020-3-0x00000000002D0000-0x00000000002D2000-memory.dmp

Filesize
8KB

Download
memory/2020-71-0x0000000002BB0000-0x0000000002BEB000-memory.dmp

Filesize
236KB

Download
memory/2020-72-0x0000000002BB0000-0x0000000002BEB000-memory.dmp

Filesize
236KB

Download
memory/2020-53-0x0000000077060000-0x0000000077061000-memory.dmp

Filesize
4KB

Download
memory/2020-2-0x0000000000400000-0x000000000043A6DC-memory.dmp

Filesize
233KB

Download
memory/2780-44-0x0000000020010000-0x000000002002C000-memory.dmp

Filesize
112KB

Download
memory/2780-96-0x0000000020010000-0x000000002002C000-memory.dmp

Filesize
112KB

Download
memory/2780-45-0x0000000020010000-0x000000002002C000-memory.dmp

Filesize
112KB

Download
memory/2780-35-0x0000000020010000-0x000000002002C000-memory.dmp

Filesize
112KB

Download
memory/2780-29-0x0000000020010000-0x000000002002C000-memory.dmp

Filesize
112KB

Download
memory/2780-104-0x0000000020010000-0x000000002002C000-memory.dmp

Filesize
112KB

Download
memory/2780-102-0x0000000020010000-0x000000002002C000-memory.dmp

Filesize
112KB

Download
memory/2780-101-0x0000000020010000-0x000000002002C000-memory.dmp

Filesize
112KB

Download
memory/2780-100-0x0000000020010000-0x000000002002C000-memory.dmp

Filesize
112KB

Download
memory/2780-85-0x0000000020010000-0x000000002002C000-memory.dmp

Filesize
112KB

Download
memory/2780-84-0x0000000020010000-0x000000002002C000-memory.dmp

Filesize
112KB

Download
memory/2780-87-0x0000000020010000-0x000000002002C000-memory.dmp

Filesize
112KB

Download
memory/2780-88-0x0000000020010000-0x000000002002C000-memory.dmp

Filesize
112KB

Download
memory/2780-86-0x0000000020010000-0x000000002002C000-memory.dmp

Filesize
112KB

Download
memory/2780-89-0x0000000020010000-0x000000002002C000-memory.dmp

Filesize
112KB

Download
memory/2780-90-0x0000000020010000-0x000000002002C000-memory.dmp

Filesize
112KB

Download
memory/2780-91-0x0000000020010000-0x000000002002C000-memory.dmp

Filesize
112KB

Download
memory/2780-92-0x0000000020010000-0x000000002002C000-memory.dmp

Filesize
112KB

Download
memory/2780-93-0x0000000020010000-0x000000002002C000-memory.dmp

Filesize
112KB

Download
memory/2780-52-0x0000000020010000-0x000000002002C000-memory.dmp

Filesize
112KB

Download
memory/2780-98-0x0000000020010000-0x000000002002C000-memory.dmp

Filesize
112KB

Download
memory/2956-83-0x0000000000400000-0x000000000043A6DC-memory.dmp

Filesize
233KB

Download
memory/2956-80-0x0000000000400000-0x000000000043A6DC-memory.dmp

Filesize
233KB

Download
memory/2956-81-0x0000000000250000-0x0000000000252000-memory.dmp

Filesize
8KB

Download
memory/2956-78-0x0000000000400000-0x000000000043A6DC-memory.dmp

Filesize
233KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads