ramnit | cdca0ae8c21e4840cae12d88f1e67302ad740db7e554ed2956a1700987145e81

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
25/03/2024, 16:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
de6e3691cde96669fb8f13c5dc833006.dll
Size 952KB
Sample240325-ttd75acf77
SHA256 cdca0ae8c21e4840cae12d88f1e67302ad740db7e554ed2956a1700987145e81
MD5 de6e3691cde96669fb8f13c5dc833006
SHA1 0e097e90d6421f98ca9a3a8982f19bc7da758be8
SHA512 65429e6672749c0065ce18b54286c56c0f8bc5e01b59991415f533847519edb0a996daf63ea8a6ed28e180ba5c5f0dac82c06b0735330084e6387a99382ea8fa
SSDEEP 24576:woFTBsfTu1cT8fAIqqurybCuUg3zch4DIF881w:wo5w3QiquryebgGb881w
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ramnit banker spyware stealer trojan worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Executes dropped EXE 1 IoCs

pid	Process
1664	rundll32mgr.exe

Loads dropped DLL 3 IoCs

pid	Process
2732	rundll32.exe
1664	rundll32mgr.exe
1664	rundll32mgr.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2176	1664	WerFault.exe	29

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2732	3024	rundll32.exe	28
PID 3024 wrote to memory of 2732	3024	rundll32.exe	28
PID 3024 wrote to memory of 2732	3024	rundll32.exe	28
PID 3024 wrote to memory of 2732	3024	rundll32.exe	28
PID 3024 wrote to memory of 2732	3024	rundll32.exe	28
PID 3024 wrote to memory of 2732	3024	rundll32.exe	28
PID 3024 wrote to memory of 2732	3024	rundll32.exe	28
PID 2732 wrote to memory of 1664	2732	rundll32.exe	29
PID 2732 wrote to memory of 1664	2732	rundll32.exe	29
PID 2732 wrote to memory of 1664	2732	rundll32.exe	29
PID 2732 wrote to memory of 1664	2732	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\de6e3691cde96669fb8f13c5dc833006.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\de6e3691cde96669fb8f13c5dc833006.dll,#1
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Windows\SysWOW64\rundll32mgr.exe
    C:\Windows\SysWOW64\rundll32mgr.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1664
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1664 -s 168
      4⤵
      Program crash
      PID:2176

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

~TM15C2.tmp

Path \Users\Admin\AppData\Local\Temp\~TM15C2.tmp
Size 1.2MB
SHA256 ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef
MD5 d124f55b9393c976963407dff51ffa79
SHA1 2c7bbedd79791bfb866898c85b504186db610b5d
SHA512 278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06
SSDEEP 24576:gwS6Xkd14PpBi6vPfdviHPZ2jslseW64AcECwA:lUd1ypBLPdmZ2Ox4AcECwA
MD5 SHA1 SHA512 SSDEEP

Submit Download

~TM15D3.tmp

Path \Users\Admin\AppData\Local\Temp\~TM15D3.tmp
Size 1.1MB
SHA256 96e0ae104c9662d0d20fdf59844c2d18334e5847b6c4fc7f8ce4b3b87f39887b
MD5 9b98d47916ead4f69ef51b56b0c2323c
SHA1 290a80b4ded0efc0fd00816f373fcea81a521330
SHA512 68b67021f228d8d71df4deb0b6388558b2f935a6aa466a12199cd37ada47ee588ea407b278d190d3a498b0ef3f5f1a2573a469b7ea5561ab2e7055c45565fe94
SSDEEP 24576:N2PEQWsHunfuKH8CBlcODV3iNXm5llVi:kPEQBHuXH8W/V3isk
MD5 SHA1 SHA512 SSDEEP

Submit Download

rundll32mgr.exe

Path \Windows\SysWOW64\rundll32mgr.exe
Size 242KB
SHA256 b50283737ebc2c01bac02f55691b6451541f583eca0d433cceb9bd5898a9baf8
MD5 c905d28a83ad0c69b46a70f2b55c2479
SHA1 99c37d5b060dea0ccf518d2973f6da72a62f9357
SHA512 e769f1298c1b02d21250f7838f7ddac2f4486fd0bb7d9fb35a2eddb92641f1922b09105ff5a8ea96a512020f7d0ecbd3b87de318f831ab1d97650d26141463ca
SSDEEP 3072:blp0B/vt40K3qrmInqPg+4+sQffBKTt/Ea/49wresCnLsitNx:D0RvC0hmInWgl+5fBMVEagOenLzNx
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1664-20-0x0000000000400000-0x00000000004F2E7C-memory.dmp

Download

memory/1664-9-0x0000000000400000-0x00000000004F2E7C-memory.dmp

Download

memory/1664-11-0x00000000003E0000-0x00000000003E2000-memory.dmp

Download

memory/1664-15-0x0000000000400000-0x00000000004F2E7C-memory.dmp

Download

memory/1664-18-0x0000000077BAF000-0x0000000077BB1000-memory.dmp

Download

memory/1664-19-0x0000000077BB0000-0x0000000077BB1000-memory.dmp

Download

memory/1664-22-0x0000000075800000-0x0000000075910000-memory.dmp

Download

memory/1664-21-0x0000000077BB0000-0x0000000077BB2000-memory.dmp

Download

memory/1664-23-0x0000000077BB0000-0x0000000077BB2000-memory.dmp

Download

memory/2732-7-0x0000000000BE0000-0x0000000000CD3000-memory.dmp

Download

memory/2732-0-0x0000000010000000-0x00000000100F2000-memory.dmp

Download

memory/2732-3-0x0000000010000000-0x00000000100F2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads