ramnit | 7a57c1907f34d63701cf5afc8bae25724fc33c0bd389d8cd20ff4d4696980c76

Analysis

max time kernel
141s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25/03/2024, 14:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7a57c1907f34d63701cf5afc8bae25724fc33c0bd389d8cd20ff4d4696980c76.dll
Size 3.0MB
Sample240325-rf2edsdc4t
SHA256 7a57c1907f34d63701cf5afc8bae25724fc33c0bd389d8cd20ff4d4696980c76
MD5 bf10a4cd1a1e1c1b661a54be7cebd42a
SHA1 59c9a86e68c5db178997781be2a0a38b14e20bae
SHA512 8c98f0ecb9dc55eb6952317375ea41545a977bea8cf7eb02864e3178d08d4b66bc935e1296c2a391a69f51290d8a4273fb801b7c9b57e8a16a022a3421abe381
SSDEEP 24576:iZdzmeCQ09ZMlrJNs43F7LuZ/JocR8dE8Urb9joii9g//YwbFIp6ZtaHBc7G3+wO:/exrlr3cR7dj5i4Qpv8LAlztm46hD
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Executes dropped EXE 1 IoCs

pid	Process
3896	rundll32mgr.exe

Loads dropped DLL 1 IoCs

pid	Process
3896	rundll32mgr.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3896-5-0x0000000000400000-0x000000000042A000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4852	3896	WerFault.exe	89

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5096 wrote to memory of 2440	5096	rundll32.exe	88
PID 5096 wrote to memory of 2440	5096	rundll32.exe	88
PID 5096 wrote to memory of 2440	5096	rundll32.exe	88
PID 2440 wrote to memory of 3896	2440	rundll32.exe	89
PID 2440 wrote to memory of 3896	2440	rundll32.exe	89
PID 2440 wrote to memory of 3896	2440	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7a57c1907f34d63701cf5afc8bae25724fc33c0bd389d8cd20ff4d4696980c76.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7a57c1907f34d63701cf5afc8bae25724fc33c0bd389d8cd20ff4d4696980c76.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2440
- - C:\Windows\SysWOW64\rundll32mgr.exe
    C:\Windows\SysWOW64\rundll32mgr.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3896
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3896 -s 516
      4⤵
      Program crash
      PID:4852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3896 -ip 3896
1⤵
PID:3176

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

~TM35F4.tmp

Path C:\Users\Admin\AppData\Local\Temp\~TM35F4.tmp
Size 1.6MB
SHA256 767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
MD5 4f3387277ccbd6d1f21ac5c07fe4ca68
SHA1 e16506f662dc92023bf82def1d621497c8ab5890
SHA512 9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
SSDEEP 24576:qhYK3o0FvOh/e8AuDq8TJqbEPVVdqi90gvuPGO12HoIGTufqN8:2XFvO5egq8TMbEL59JCKSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

rundll32mgr.exe

Path C:\Windows\SysWOW64\rundll32mgr.exe
Size 184KB
SHA256 3aab3cf37efd4c034da13a0d7ba8725f49a21d227e05f3bba91d8d36350f4a67
MD5 1d92c741bc5b2d34dcd0a0265ab54275
SHA1 a160982825420567c15f6c11f777cb4ccbe69bb8
SHA512 1da728dba6383e0e9fc51370f8fb782a15e724b57b952d952e4c719f81d517a56035b1e9496da3d7f9bf79af0a4bd5caa8a351ca60f40d637da3648224944b94
SSDEEP 1536:xfZZnAEjEIZvumULmj4wrraK5dZ4Ltta9Km/ec3DtAL6bmZ4bXSjrAE+fySPoqRI:xnnAQVG/LytaKItS/fiLKS+f5Aq7i
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2440-3-0x0000000074B00000-0x0000000074F36000-memory.dmp

Download

memory/3896-5-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3896-6-0x0000000000570000-0x000000000059A000-memory.dmp

Download

memory/3896-10-0x00000000774D2000-0x00000000774D4000-memory.dmp

Download

memory/3896-11-0x00000000774D2000-0x00000000774D3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads