ramnit | 709c6f1b5c599ccb231d0fef6e5aefa62c68493a00fa04e4b2c37da9d79c8483

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 23:10

Target

709c6f1b5c599ccb231d0fef6e5aefa62c68493a00fa04e4b2c37da9d79c8483.dll
Size

38KB
MD5

fe3f24f69df1ff371c05079e394c5d18
SHA1

5763472320946ea37171b75581bf2d15c73ba048
SHA256

709c6f1b5c599ccb231d0fef6e5aefa62c68493a00fa04e4b2c37da9d79c8483
SHA512

685e01f4303e5e60f928a0d740e02e38408a3a889965ca1c6ceeb0b2046bbfa5fe433969a6c2cc8a86f72c1082dc451db990b73f25b3668bac7339992e0e9328
SSDEEP

768:Bs+/gMsLIn/wIj2labk+1IsceGSnkmJ0Yblr583CJrVV7wIXUAn6m2sOIVV:WD8w22laSR0V+3CJrVnXxzJO

Score

10^/10

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File created C:\Windows\SysWOW64\dmlconf.dat rundll32.exe

description	ioc	process
File created	C:\Windows\SysWOW64\dmlconf.dat	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2172 wrote to memory of 1532	2172	rundll32.exe	rundll32.exe
PID 2172 wrote to memory of 1532	2172	rundll32.exe	rundll32.exe
PID 2172 wrote to memory of 1532	2172	rundll32.exe	rundll32.exe
PID 2172 wrote to memory of 1532	2172	rundll32.exe	rundll32.exe
PID 2172 wrote to memory of 1532	2172	rundll32.exe	rundll32.exe
PID 2172 wrote to memory of 1532	2172	rundll32.exe	rundll32.exe
PID 2172 wrote to memory of 1532	2172	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\709c6f1b5c599ccb231d0fef6e5aefa62c68493a00fa04e4b2c37da9d79c8483.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2172

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\709c6f1b5c599ccb231d0fef6e5aefa62c68493a00fa04e4b2c37da9d79c8483.dll,#1
2⤵
- Drops file in System32 directory
PID:1532

memory/1532-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/1532-1-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/1532-2-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download