ramnit | 7a0e26e007b27b01f63fb57bc61fd92dcb71236de0872a84194ba25ddc3c1060

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 23:29

Target

7a0e26e007b27b01f63fb57bc61fd92dcb71236de0872a84194ba25ddc3c1060.dll
Size

38KB
MD5

64f17e453b784330575f2635afeab3fc
SHA1

4be2b02f05eb899c23ae572048488dbc578409be
SHA256

7a0e26e007b27b01f63fb57bc61fd92dcb71236de0872a84194ba25ddc3c1060
SHA512

09fc365c7af129f0f9bd2f12adb3c13ca4f410c8cb7c62c7cb33f7fe47df4ba03c0c6510f4b68168040a580b2dbef6442210bd84f510b6883ddb501531ad5fff
SSDEEP

768:Bs+/gMsLIn/wIj2labk+1IsceGSnkmJ0Yblr583CJrVV7QhXU76m2sZaVV:WD8w22laSR0V+3CJrVGXczJZ

Score

10^/10

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File created C:\Windows\SysWOW64\dmlconf.dat rundll32.exe

description	ioc	process
File created	C:\Windows\SysWOW64\dmlconf.dat	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2196 wrote to memory of 2808	2196	rundll32.exe	rundll32.exe
PID 2196 wrote to memory of 2808	2196	rundll32.exe	rundll32.exe
PID 2196 wrote to memory of 2808	2196	rundll32.exe	rundll32.exe
PID 2196 wrote to memory of 2808	2196	rundll32.exe	rundll32.exe
PID 2196 wrote to memory of 2808	2196	rundll32.exe	rundll32.exe
PID 2196 wrote to memory of 2808	2196	rundll32.exe	rundll32.exe
PID 2196 wrote to memory of 2808	2196	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7a0e26e007b27b01f63fb57bc61fd92dcb71236de0872a84194ba25ddc3c1060.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7a0e26e007b27b01f63fb57bc61fd92dcb71236de0872a84194ba25ddc3c1060.dll,#1
  2⤵
  - Drops file in System32 directory
  PID:2808

memory/2808-2-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2808-1-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download