ramnit | 709c6f1b5c599ccb231d0fef6e5aefa62c68493a00fa04e4b2c37da9d79c8483

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 23:10

Target

709c6f1b5c599ccb231d0fef6e5aefa62c68493a00fa04e4b2c37da9d79c8483.dll
Size

38KB
MD5

fe3f24f69df1ff371c05079e394c5d18
SHA1

5763472320946ea37171b75581bf2d15c73ba048
SHA256

709c6f1b5c599ccb231d0fef6e5aefa62c68493a00fa04e4b2c37da9d79c8483
SHA512

685e01f4303e5e60f928a0d740e02e38408a3a889965ca1c6ceeb0b2046bbfa5fe433969a6c2cc8a86f72c1082dc451db990b73f25b3668bac7339992e0e9328
SSDEEP

768:Bs+/gMsLIn/wIj2labk+1IsceGSnkmJ0Yblr583CJrVV7wIXUAn6m2sOIVV:WD8w22laSR0V+3CJrVnXxzJO

Score

10^/10

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File created C:\Windows\SysWOW64\dmlconf.dat rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4204 904 WerFault.exe rundll32.exe

description	ioc	process
File created	C:\Windows\SysWOW64\dmlconf.dat	rundll32.exe

pid	pid_target	process	target process
4204	904	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2564 wrote to memory of 904	2564	rundll32.exe	rundll32.exe
PID 2564 wrote to memory of 904	2564	rundll32.exe	rundll32.exe
PID 2564 wrote to memory of 904	2564	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\709c6f1b5c599ccb231d0fef6e5aefa62c68493a00fa04e4b2c37da9d79c8483.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2564

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\709c6f1b5c599ccb231d0fef6e5aefa62c68493a00fa04e4b2c37da9d79c8483.dll,#1
2⤵
- Drops file in System32 directory
PID:904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 904 -s 616
3⤵
- Program crash
PID:4204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 904 -ip 904
1⤵
PID:3496

memory/904-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download