ramnit | aa5fc8f18c85c1e9b1321cd7c7bc634c42748d54c183e167da96e029be80bd4b

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 01:38

Target

aa5fc8f18c85c1e9b1321cd7c7bc634c42748d54c183e167da96e029be80bd4b.dll
Size

38KB
MD5

fc4f8cb5a2ab0e4e43de63980f2bcfc9
SHA1

e2ea6db78fced9f93dfd92caa235a4d6d9f8b9b0
SHA256

aa5fc8f18c85c1e9b1321cd7c7bc634c42748d54c183e167da96e029be80bd4b
SHA512

ea6c31f2a93f19aa8a61dd0a921633c365a0ad7eb01117631745e2bbf211d5b45333134ab910e796439c513729c880b79b3e284d4b779d0d97ac643259532494
SSDEEP

768:Bs+/gMsLIn/wIj2labk+1IsceGSnkmJ0Yblr583CJrVV7bFXUg6m2sY2VV:WD8w22laSR0V+3CJrVzXPzJY

Score

10^/10

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File created C:\Windows\SysWOW64\dmlconf.dat rundll32.exe

description	ioc	process
File created	C:\Windows\SysWOW64\dmlconf.dat	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2252 wrote to memory of 3004	2252	rundll32.exe	rundll32.exe
PID 2252 wrote to memory of 3004	2252	rundll32.exe	rundll32.exe
PID 2252 wrote to memory of 3004	2252	rundll32.exe	rundll32.exe
PID 2252 wrote to memory of 3004	2252	rundll32.exe	rundll32.exe
PID 2252 wrote to memory of 3004	2252	rundll32.exe	rundll32.exe
PID 2252 wrote to memory of 3004	2252	rundll32.exe	rundll32.exe
PID 2252 wrote to memory of 3004	2252	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aa5fc8f18c85c1e9b1321cd7c7bc634c42748d54c183e167da96e029be80bd4b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2252

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aa5fc8f18c85c1e9b1321cd7c7bc634c42748d54c183e167da96e029be80bd4b.dll,#1
2⤵
- Drops file in System32 directory
PID:3004

memory/3004-1-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/3004-2-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download