ramnit | 9953182b68cb49448f71d29c4e104cf8a91a367dcdddfaf1385e70fbdd80b874

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 00:52

Target

9953182b68cb49448f71d29c4e104cf8a91a367dcdddfaf1385e70fbdd80b874.dll
Size

38KB
MD5

60e960b86310c8f90ab482de7c5d6b08
SHA1

70e7867d16a72e6de16b55b23c6a017eaadab819
SHA256

9953182b68cb49448f71d29c4e104cf8a91a367dcdddfaf1385e70fbdd80b874
SHA512

14205dac40d6a828ccffae2573d98f844873bbe534f6e4b1948f9d8ae6f7de7ef91d080dcf0cc810106a25230a796079bad5c2a5ab16fa896f747a7051d6902b
SSDEEP

768:Bs+/gMsLIn/wIj2labk+1IsceGSnkmJ0Yblr583CJrVV7LIXUN6m2sZMVV:WD8w22laSR0V+3CJrVuXazJZ

Score

10^/10

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File created C:\Windows\SysWOW64\dmlconf.dat rundll32.exe

description	ioc	process
File created	C:\Windows\SysWOW64\dmlconf.dat	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2784 wrote to memory of 2916	2784	rundll32.exe	rundll32.exe
PID 2784 wrote to memory of 2916	2784	rundll32.exe	rundll32.exe
PID 2784 wrote to memory of 2916	2784	rundll32.exe	rundll32.exe
PID 2784 wrote to memory of 2916	2784	rundll32.exe	rundll32.exe
PID 2784 wrote to memory of 2916	2784	rundll32.exe	rundll32.exe
PID 2784 wrote to memory of 2916	2784	rundll32.exe	rundll32.exe
PID 2784 wrote to memory of 2916	2784	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9953182b68cb49448f71d29c4e104cf8a91a367dcdddfaf1385e70fbdd80b874.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2784

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9953182b68cb49448f71d29c4e104cf8a91a367dcdddfaf1385e70fbdd80b874.dll,#1
2⤵
- Drops file in System32 directory
PID:2916

memory/2916-2-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2916-1-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download