ramnit | bd5982f797b9d1f6e932c7a8a2705ae1a38b5ff83e7670e12809a6ee74b0c9b8

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 02:36

Target

bd5982f797b9d1f6e932c7a8a2705ae1a38b5ff83e7670e12809a6ee74b0c9b8.dll
Size

38KB
MD5

5920faa17dcac69cd5ab8d8fd14fdf43
SHA1

0fa4da2dc4a0c2a96511bbd2c3d5f6e26940bdac
SHA256

bd5982f797b9d1f6e932c7a8a2705ae1a38b5ff83e7670e12809a6ee74b0c9b8
SHA512

8bdabe217ef77c62c9178eb2837b6aa30b9b6b289069cd7c392a8d0bf9de40259834b853c9e5b81ca176803307c25fce931261a4f118c3af7c9d608658144faa
SSDEEP

768:Bs+/gMsLIn/wIj2labk+1IsceGSnkmJ0Yblr583CJrVV7fIXU76m2sjhVV:WD8w22laSR0V+3CJrVyXczJj

Score

10^/10

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File created C:\Windows\SysWOW64\dmlconf.dat rundll32.exe

description	ioc	process
File created	C:\Windows\SysWOW64\dmlconf.dat	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3024 wrote to memory of 1996	3024	rundll32.exe	rundll32.exe
PID 3024 wrote to memory of 1996	3024	rundll32.exe	rundll32.exe
PID 3024 wrote to memory of 1996	3024	rundll32.exe	rundll32.exe
PID 3024 wrote to memory of 1996	3024	rundll32.exe	rundll32.exe
PID 3024 wrote to memory of 1996	3024	rundll32.exe	rundll32.exe
PID 3024 wrote to memory of 1996	3024	rundll32.exe	rundll32.exe
PID 3024 wrote to memory of 1996	3024	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd5982f797b9d1f6e932c7a8a2705ae1a38b5ff83e7670e12809a6ee74b0c9b8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3024

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd5982f797b9d1f6e932c7a8a2705ae1a38b5ff83e7670e12809a6ee74b0c9b8.dll,#1
2⤵
- Drops file in System32 directory
PID:1996

memory/1996-2-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/1996-1-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download