ramnit | 67b488bcc767acad42f559f279c243048a8699d077a9983e46dee3f19c08ff7d

General

Target

2024-05-21_071f5252ff02fdea1f4516c2c5484904_bkransomware_ramnit.exe
Size

3.2MB
MD5

071f5252ff02fdea1f4516c2c5484904
SHA1

c5115c6feb327fa7d83463f6c56c1d586f4dee20
SHA256

67b488bcc767acad42f559f279c243048a8699d077a9983e46dee3f19c08ff7d
SHA512

35af14e74109f8386c5397c4af9cd62ec729a4e1d5c7263721d82dc334288afd3891e369a4d6c1e49e906891815e1af34f29f8735dc976ea4b3d83c253436600
SSDEEP

98304:9wUPeZtmGYvOnPdUwYjQQERhfFLOAkGkzdnEVomFHKnPw:98RDV0QQERNFLOyomFHKnP

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

UPX dump on OEP (original entry point) 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/748-7-0x0000000000400000-0x0000000000415000-memory.dmp	UPX
behavioral2/memory/656-13-0x0000000000400000-0x0000000000415000-memory.dmp	UPX
behavioral2/memory/656-14-0x0000000000400000-0x0000000000415000-memory.dmp	UPX

Executes dropped EXE 2 IoCs

Processes:

2024-05-21_071f5252ff02fdea1f4516c2c5484904_bkransomware_ramnitSrv.exeDesktopLayer.exe

pid process

748 2024-05-21_071f5252ff02fdea1f4516c2c5484904_bkransomware_ramnitSrv.exe
656 DesktopLayer.exe

pid	process
748	2024-05-21_071f5252ff02fdea1f4516c2c5484904_bkransomware_ramnitSrv.exe
656	DesktopLayer.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/748-7-0x0000000000400000-0x0000000000415000-memory.dmp	upx
behavioral2/memory/656-13-0x0000000000400000-0x0000000000415000-memory.dmp	upx
behavioral2/memory/656-14-0x0000000000400000-0x0000000000415000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

Processes:

2024-05-21_071f5252ff02fdea1f4516c2c5484904_bkransomware_ramnitSrv.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft\px4565.tmp	2024-05-21_071f5252ff02fdea1f4516c2c5484904_bkransomware_ramnitSrv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	2024-05-21_071f5252ff02fdea1f4516c2c5484904_bkransomware_ramnitSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	2024-05-21_071f5252ff02fdea1f4516c2c5484904_bkransomware_ramnitSrv.exe

Modifies Internet Explorer settings 1 TTPs 30 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31107978"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2034877084"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31107978"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2061908162"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31107978"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{A4E03652-177D-11EF-9519-527CD1CC5F27} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423066362"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2035032983"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

DesktopLayer.exe

pid	process
656	DesktopLayer.exe
656	DesktopLayer.exe
656	DesktopLayer.exe
656	DesktopLayer.exe
656	DesktopLayer.exe
656	DesktopLayer.exe
656	DesktopLayer.exe
656	DesktopLayer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2696 iexplore.exe

pid	process
2696	iexplore.exe

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

2024-05-21_071f5252ff02fdea1f4516c2c5484904_bkransomware_ramnit.exeiexplore.exeIEXPLORE.EXE

pid	process
4820	2024-05-21_071f5252ff02fdea1f4516c2c5484904_bkransomware_ramnit.exe
4820	2024-05-21_071f5252ff02fdea1f4516c2c5484904_bkransomware_ramnit.exe
2696	iexplore.exe
2696	iexplore.exe
3448	IEXPLORE.EXE
3448	IEXPLORE.EXE
3448	IEXPLORE.EXE
3448	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

2024-05-21_071f5252ff02fdea1f4516c2c5484904_bkransomware_ramnit.exe2024-05-21_071f5252ff02fdea1f4516c2c5484904_bkransomware_ramnitSrv.exeDesktopLayer.exeiexplore.exe

description	pid	process	target process
PID 4820 wrote to memory of 748	4820	2024-05-21_071f5252ff02fdea1f4516c2c5484904_bkransomware_ramnit.exe	2024-05-21_071f5252ff02fdea1f4516c2c5484904_bkransomware_ramnitSrv.exe
PID 4820 wrote to memory of 748	4820	2024-05-21_071f5252ff02fdea1f4516c2c5484904_bkransomware_ramnit.exe	2024-05-21_071f5252ff02fdea1f4516c2c5484904_bkransomware_ramnitSrv.exe
PID 4820 wrote to memory of 748	4820	2024-05-21_071f5252ff02fdea1f4516c2c5484904_bkransomware_ramnit.exe	2024-05-21_071f5252ff02fdea1f4516c2c5484904_bkransomware_ramnitSrv.exe
PID 748 wrote to memory of 656	748	2024-05-21_071f5252ff02fdea1f4516c2c5484904_bkransomware_ramnitSrv.exe	DesktopLayer.exe
PID 748 wrote to memory of 656	748	2024-05-21_071f5252ff02fdea1f4516c2c5484904_bkransomware_ramnitSrv.exe	DesktopLayer.exe
PID 748 wrote to memory of 656	748	2024-05-21_071f5252ff02fdea1f4516c2c5484904_bkransomware_ramnitSrv.exe	DesktopLayer.exe
PID 656 wrote to memory of 2696	656	DesktopLayer.exe	iexplore.exe
PID 656 wrote to memory of 2696	656	DesktopLayer.exe	iexplore.exe
PID 2696 wrote to memory of 3448	2696	iexplore.exe	IEXPLORE.EXE
PID 2696 wrote to memory of 3448	2696	iexplore.exe	IEXPLORE.EXE
PID 2696 wrote to memory of 3448	2696	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\2024-05-21_071f5252ff02fdea1f4516c2c5484904_bkransomware_ramnit.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-21_071f5252ff02fdea1f4516c2c5484904_bkransomware_ramnit.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Users\Admin\AppData\Local\Temp\2024-05-21_071f5252ff02fdea1f4516c2c5484904_bkransomware_ramnitSrv.exe
  C:\Users\Admin\AppData\Local\Temp\2024-05-21_071f5252ff02fdea1f4516c2c5484904_bkransomware_ramnitSrv.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:748
- - C:\Program Files (x86)\Microsoft\DesktopLayer.exe
    "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:656
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2696
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2696 CREDAT:17410 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:3448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
78207b82cd88741596bfbe35667bef0c

SHA1
d2aa9f014d12219d074f7b4c92efebbf8e615791

SHA256
55b97539e3725b2fd6fdbb103e48b51e8cc3b4dd33e3e3c5d74bdfd54e48d01d

SHA512
2b7a26550c51d8bf6eceafcf1ca47f2f02f02700b13ac2684442592b5a774f9a667227ac9865387234c556fd24de20239edd1b2e9085025840ecbc844a480083

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
c287a162bff535e00d85bc6d877052e0

SHA1
afb4aff4c3ca94d21eab8aa08f6d3e0a6ba99845

SHA256
074f57fc1862074ff4e8ff97ea2ad1dc63321facea71bd8926296d2811d83149

SHA512
dc3eb4ac93fdc361118840a45689709c13baf33522e0ad7e8e86be5d251dc387e51611aeba4e211350fe0f01c8ee111ce2c8c5f176d1ecca14c43767a0101bf3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2IX84YPE\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\2024-05-21_071f5252ff02fdea1f4516c2c5484904_bkransomware_ramnitSrv.exe

Filesize
52KB

MD5
dfedbf24a34773ddc45f07eec3c88850

SHA1
e779d4d74f4abdd886a336739c2fed0bd7142bdf

SHA256
f799507b4af8fba919170a21413333998ac6715397b9a07b7caa752ea4fa8168

SHA512
bf68485a7f8d7a6808fd9df5016acb94426f0f21f9b7722d1130896f974a256c8ff7d077e2869673cfa440017dd93c7cd28f1426f6f949d7c1a4d2642c13af34

Download Submit
memory/656-12-0x0000000000480000-0x0000000000481000-memory.dmp

Filesize
4KB

Download
memory/656-13-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/656-14-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/748-7-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/748-6-0x0000000001EF0000-0x0000000001F05000-memory.dmp

Filesize
84KB

Download
memory/4820-2-0x0000000000EF0000-0x0000000001236000-memory.dmp

Filesize
3.3MB

Download
memory/4820-16-0x0000000000EF0000-0x0000000001236000-memory.dmp

Filesize
3.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads