ramnit | aedf792eb9cbd91013e5e1904cc1e3e8338c779d0e110593d864e29281d59f19

Analysis

max time kernel
142s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 01:53

Target

aedf792eb9cbd91013e5e1904cc1e3e8338c779d0e110593d864e29281d59f19.dll
Size

38KB
MD5

9d5db017dde79b957a9c7c639a470b6c
SHA1

9b8c9c762068bd8ec650f806bb80bc2c042a5303
SHA256

aedf792eb9cbd91013e5e1904cc1e3e8338c779d0e110593d864e29281d59f19
SHA512

cbf93f004b9274a4330089f14f37ad41eb8b5a2113cd142ba4c74dc004cc0082b2580de088d06d813289ab1cf8346a198e97cc78d5ec6909fb34760485132e61
SSDEEP

768:Bs+/gMsLIn/wIj2labk+1IsceGSnkmJ0Yblr583CJrVV7IhXUWe6m2sgQVV:WD8w22laSR0V+3CJrV6XOzJg

Score

10^/10

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File created C:\Windows\SysWOW64\dmlconf.dat rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4172 1284 WerFault.exe rundll32.exe

description	ioc	process
File created	C:\Windows\SysWOW64\dmlconf.dat	rundll32.exe

pid	pid_target	process	target process
4172	1284	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4764 wrote to memory of 1284	4764	rundll32.exe	rundll32.exe
PID 4764 wrote to memory of 1284	4764	rundll32.exe	rundll32.exe
PID 4764 wrote to memory of 1284	4764	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aedf792eb9cbd91013e5e1904cc1e3e8338c779d0e110593d864e29281d59f19.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4764

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aedf792eb9cbd91013e5e1904cc1e3e8338c779d0e110593d864e29281d59f19.dll,#1
2⤵
- Drops file in System32 directory
PID:1284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1284 -s 600
3⤵
- Program crash
PID:4172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1284 -ip 1284
1⤵
PID:2872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3720 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
1⤵
PID:4776

memory/1284-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download