ramnit | aa5fc8f18c85c1e9b1321cd7c7bc634c42748d54c183e167da96e029be80bd4b

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 01:38

Target

aa5fc8f18c85c1e9b1321cd7c7bc634c42748d54c183e167da96e029be80bd4b.dll
Size

38KB
MD5

fc4f8cb5a2ab0e4e43de63980f2bcfc9
SHA1

e2ea6db78fced9f93dfd92caa235a4d6d9f8b9b0
SHA256

aa5fc8f18c85c1e9b1321cd7c7bc634c42748d54c183e167da96e029be80bd4b
SHA512

ea6c31f2a93f19aa8a61dd0a921633c365a0ad7eb01117631745e2bbf211d5b45333134ab910e796439c513729c880b79b3e284d4b779d0d97ac643259532494
SSDEEP

768:Bs+/gMsLIn/wIj2labk+1IsceGSnkmJ0Yblr583CJrVV7bFXUg6m2sY2VV:WD8w22laSR0V+3CJrVzXPzJY

Score

10^/10

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File created C:\Windows\SysWOW64\dmlconf.dat rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

932 3576 WerFault.exe rundll32.exe

description	ioc	process
File created	C:\Windows\SysWOW64\dmlconf.dat	rundll32.exe

pid	pid_target	process	target process
932	3576	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3496 wrote to memory of 3576	3496	rundll32.exe	rundll32.exe
PID 3496 wrote to memory of 3576	3496	rundll32.exe	rundll32.exe
PID 3496 wrote to memory of 3576	3496	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aa5fc8f18c85c1e9b1321cd7c7bc634c42748d54c183e167da96e029be80bd4b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3496

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aa5fc8f18c85c1e9b1321cd7c7bc634c42748d54c183e167da96e029be80bd4b.dll,#1
2⤵
- Drops file in System32 directory
PID:3576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3576 -s 604
3⤵
- Program crash
PID:932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3576 -ip 3576
1⤵
PID:4588

memory/3576-1-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download