ramnit | c5952fe5d41cfc72c16148c31ddbebc8fc2ef6577776b5fef5d22a01b913d35f

Analysis

max time kernel
130s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25-05-2024 05:03

Target

f7101fcd3ef0a8562dbbcf2947bae8d0_NeikiAnalytics.dll
Size

68KB
MD5

f7101fcd3ef0a8562dbbcf2947bae8d0
SHA1

89412d66a65cf7da511d4330084da31085509bbd
SHA256

c5952fe5d41cfc72c16148c31ddbebc8fc2ef6577776b5fef5d22a01b913d35f
SHA512

c2140f91a0ca6e6cbb8cd435dcbeecf62da8abf36a0ea372b0262bc0855aa8dc2d928624dc3dbfd310d059820491e4ad97e3aaa38de17811d143c57a66a59673
SSDEEP

1536:MLNd/Pk7btaoX7DypKr0wNHYIUSS9eyBFzbW0iZs3f:GNhY5aora80mHYI7ObWXs3

Score

10^/10

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Drops startup file 1 IoCs

Processes:

rundll32.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wilciofm.exe	rundll32.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4964 2400 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4964	2400	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1908 wrote to memory of 2400	1908	rundll32.exe	rundll32.exe
PID 1908 wrote to memory of 2400	1908	rundll32.exe	rundll32.exe
PID 1908 wrote to memory of 2400	1908	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f7101fcd3ef0a8562dbbcf2947bae8d0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f7101fcd3ef0a8562dbbcf2947bae8d0_NeikiAnalytics.dll,#1
  2⤵
  - Drops startup file
  PID:2400
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 540
    3⤵
    - Program crash
    PID:4964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2400 -ip 2400
1⤵
PID:2620

memory/2400-0-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download