ramnit | 90fe4a2c533a138b5252097c4ca53cbea34b56001ddebe30897846b52bb504c3

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25/03/2024, 22:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
90fe4a2c533a138b5252097c4ca53cbea34b56001ddebe30897846b52bb504c3.dll
Size 5.0MB
Sample240325-1wxktaaa79
SHA256 90fe4a2c533a138b5252097c4ca53cbea34b56001ddebe30897846b52bb504c3
MD5 8efafe2bcae7bcbb1b98c5b924dcfe92
SHA1 d5458eb33c5980e072ee1854caf3cdf808efa900
SHA512 bec2158e4301bfeb2af187c60cc51e150f6130912f3ff3d95b72f35e921dd6dc518d2adaf6bb5fccf8304f89907bc3d783cb99df52d29f4eac4486d95f85c28e
SSDEEP 98304:V0kp2gS4l4C1t0pnyjSmu8lFPzFF55DeHQSUf2ZTlrYdlM78PO1ERt2a:V0kp2gS4l4C1t0pnyjSmu8lFb/55DeHC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Executes dropped EXE 1 IoCs

pid	Process
5352	rundll32mgr.exe

Loads dropped DLL 1 IoCs

pid	Process
5352	rundll32mgr.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5352-5-0x0000000000400000-0x000000000042A000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5888	5392	WerFault.exe	96
5996	5352	WerFault.exe	97

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4260 wrote to memory of 5392	4260	rundll32.exe	96
PID 4260 wrote to memory of 5392	4260	rundll32.exe	96
PID 4260 wrote to memory of 5392	4260	rundll32.exe	96
PID 5392 wrote to memory of 5352	5392	rundll32.exe	97
PID 5392 wrote to memory of 5352	5392	rundll32.exe	97
PID 5392 wrote to memory of 5352	5392	rundll32.exe	97

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\90fe4a2c533a138b5252097c4ca53cbea34b56001ddebe30897846b52bb504c3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4260
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\90fe4a2c533a138b5252097c4ca53cbea34b56001ddebe30897846b52bb504c3.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:5392
- - C:\Windows\SysWOW64\rundll32mgr.exe
    C:\Windows\SysWOW64\rundll32mgr.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5352
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5352 -s 556
      4⤵
      Program crash
      PID:5996
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5392 -s 672
    3⤵
    - Program crash
    PID:5888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 5392 -ip 5392
1⤵
PID:3144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 5352 -ip 5352
1⤵
PID:560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1324 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
1⤵
PID:4672

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

~TM17AA.tmp

Path C:\Users\Admin\AppData\Local\Temp\~TM17AA.tmp
Size 1.6MB
SHA256 767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
MD5 4f3387277ccbd6d1f21ac5c07fe4ca68
SHA1 e16506f662dc92023bf82def1d621497c8ab5890
SHA512 9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
SSDEEP 24576:qhYK3o0FvOh/e8AuDq8TJqbEPVVdqi90gvuPGO12HoIGTufqN8:2XFvO5egq8TMbEL59JCKSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

rundll32mgr.exe

Path C:\Windows\SysWOW64\rundll32mgr.exe
Size 184KB
SHA256 3aab3cf37efd4c034da13a0d7ba8725f49a21d227e05f3bba91d8d36350f4a67
MD5 1d92c741bc5b2d34dcd0a0265ab54275
SHA1 a160982825420567c15f6c11f777cb4ccbe69bb8
SHA512 1da728dba6383e0e9fc51370f8fb782a15e724b57b952d952e4c719f81d517a56035b1e9496da3d7f9bf79af0a4bd5caa8a351ca60f40d637da3648224944b94
SSDEEP 1536:xfZZnAEjEIZvumULmj4wrraK5dZ4Ltta9Km/ec3DtAL6bmZ4bXSjrAE+fySPoqRI:xnnAQVG/LytaKItS/fiLKS+f5Aq7i
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/5352-5-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/5352-6-0x0000000002170000-0x000000000219A000-memory.dmp

Download

memory/5352-10-0x0000000077812000-0x0000000077814000-memory.dmp

Download

memory/5352-11-0x0000000077812000-0x0000000077813000-memory.dmp

Download

memory/5392-0-0x0000000074D70000-0x000000007527F000-memory.dmp

Download

memory/5392-13-0x0000000074D70000-0x000000007527F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads