Analysis
- max time kernel
147s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
27/03/2024, 16:27
General
- Target 2024-03-27_24c804f1c5d63c55558fd9092199b43a_karagany_mafia_ramnit.exe
- Size 311KB
- Sample240327-tx3d5afh69
- SHA256 3e764285adea480b3fb2f685bac5a075189fd984d3619b47f6cea56fa387ed8b
Score
10/10
Malware Config
Signatures
- Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
- UPX dump on OEP (original entry point) 2 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Program crash 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-27_24c804f1c5d63c55558fd9092199b43a_karagany_mafia_ramnit.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-27_24c804f1c5d63c55558fd9092199b43a_karagany_mafia_ramnit.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-03-27_24c804f1c5d63c55558fd9092199b43a_karagany_mafia_ramnitmgr.exeC:\Users\Admin\AppData\Local\Temp\2024-03-27_24c804f1c5d63c55558fd9092199b43a_karagany_mafia_ramnitmgr.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 5403⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3704 -ip 37041⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
2024-03-27_24c804f1c5d63c55558fd9092199b43a_karagany_mafia_ramnitmgr.exe
~TM6E2B.tmp
memory/1920-0-0x0000000000020000-0x0000000000075000-memory.dmp
memory/1920-5-0x0000000000020000-0x0000000000075000-memory.dmp
memory/3704-7-0x0000000002170000-0x000000000219A000-memory.dmp
memory/3704-11-0x00000000779D2000-0x00000000779D3000-memory.dmp
memory/3704-10-0x0000000000400000-0x000000000042A000-memory.dmp
memory/3704-12-0x00000000779D2000-0x00000000779D4000-memory.dmp