ramnit | 46c3ecca40673389f32be3265cc46faae523de13fb8d70e9c65477b8bbcb576a

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 21:12

Target

46c3ecca40673389f32be3265cc46faae523de13fb8d70e9c65477b8bbcb576a.dll
Size

38KB
MD5

eaf79519edf23a96e9adee63728d0919
SHA1

3354a587013838085bab0e2d1948b62f526287c3
SHA256

46c3ecca40673389f32be3265cc46faae523de13fb8d70e9c65477b8bbcb576a
SHA512

7a831de96d4d17d1289fa39f78940781ee50f6dbe816b090a8e40837203def0b4e93999f8c532c565471d783324dd2ee9c82d506ea0eac2ab2129d4c0b4a9e6b
SSDEEP

768:Bs+/gMsLIn/wIj2labk+1IsceGSnkmJ0Yblr583CJrVV7WIXUU6m2spNVV:WD8w22laSR0V+3CJrVZXjzJp

Score

10^/10

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File created C:\Windows\SysWOW64\dmlconf.dat rundll32.exe

description	ioc	process
File created	C:\Windows\SysWOW64\dmlconf.dat	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2092 wrote to memory of 2808	2092	rundll32.exe	rundll32.exe
PID 2092 wrote to memory of 2808	2092	rundll32.exe	rundll32.exe
PID 2092 wrote to memory of 2808	2092	rundll32.exe	rundll32.exe
PID 2092 wrote to memory of 2808	2092	rundll32.exe	rundll32.exe
PID 2092 wrote to memory of 2808	2092	rundll32.exe	rundll32.exe
PID 2092 wrote to memory of 2808	2092	rundll32.exe	rundll32.exe
PID 2092 wrote to memory of 2808	2092	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\46c3ecca40673389f32be3265cc46faae523de13fb8d70e9c65477b8bbcb576a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2092

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\46c3ecca40673389f32be3265cc46faae523de13fb8d70e9c65477b8bbcb576a.dll,#1
2⤵
- Drops file in System32 directory
PID:2808

memory/2808-1-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download