ramnit | 5582dbe625d86c6ebb4d9c6eb4a4e92a97d5a566135eec76af2c75243cef101e

Analysis

max time kernel
133s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 23:47

Target

0d905f2155dd1ccafd9a27ebf4e55eb0_NeikiAnalytics.dll
Size

68KB
MD5

0d905f2155dd1ccafd9a27ebf4e55eb0
SHA1

0b807dd47faba7cf3b8c7a7b52a8840e57499223
SHA256

5582dbe625d86c6ebb4d9c6eb4a4e92a97d5a566135eec76af2c75243cef101e
SHA512

c0de4a4fe7776565882ab55d603c03b685b82c1facbd372c20eea16a6808e6c6e4a9674dd54110457a88b899f7e0c97dc3bae5fb6b8daf87349f435f0649a461
SSDEEP

1536:MLNd/Pk7btaoX7DypKr0wNuYIUSS9eyBYBW0iZs3L:GNhY5aora80muYI7DBWXs3

Score

10^/10

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Drops startup file 1 IoCs

Processes:

rundll32.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dpupbevq.exe	rundll32.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3684 3260 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3684	3260	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2448 wrote to memory of 3260	2448	rundll32.exe	rundll32.exe
PID 2448 wrote to memory of 3260	2448	rundll32.exe	rundll32.exe
PID 2448 wrote to memory of 3260	2448	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d905f2155dd1ccafd9a27ebf4e55eb0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d905f2155dd1ccafd9a27ebf4e55eb0_NeikiAnalytics.dll,#1
  2⤵
  - Drops startup file
  PID:3260
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3260 -s 624
    3⤵
    - Program crash
    PID:3684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3260 -ip 3260
1⤵
PID:376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1324,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:8
1⤵
PID:2404

memory/3260-0-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download