ramnit | b7d06da96466eae0245b8d665e7f2b1779e72667ff549cc5373422b17de342cb

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 02:08

Target

b7d06da96466eae0245b8d665e7f2b1779e72667ff549cc5373422b17de342cb.dll
Size

38KB
MD5

474d62f3cc9bad3328e0011e24aef7ed
SHA1

fedac51d8f8bb220107c0a1e1eda87fd99307e78
SHA256

b7d06da96466eae0245b8d665e7f2b1779e72667ff549cc5373422b17de342cb
SHA512

8e70b1f689af017fecc1a0c504b675d90f55cf4698ee0f85957e70679ad38d582bdb5e60e8eaff0dad7e7af5b1f6a3cd6079c3bb278cc7f3b8d4e5fd994c3a98
SSDEEP

768:Bs+/gMsLIn/wIj2labk+1IsceGSnkmJ0Yblr583CJrVV74IXUG6m2sLnVV:WD8w22laSR0V+3CJrVjXRzJL

Score

10^/10

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File created C:\Windows\SysWOW64\dmlconf.dat rundll32.exe

description	ioc	process
File created	C:\Windows\SysWOW64\dmlconf.dat	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2208 wrote to memory of 2200	2208	rundll32.exe	rundll32.exe
PID 2208 wrote to memory of 2200	2208	rundll32.exe	rundll32.exe
PID 2208 wrote to memory of 2200	2208	rundll32.exe	rundll32.exe
PID 2208 wrote to memory of 2200	2208	rundll32.exe	rundll32.exe
PID 2208 wrote to memory of 2200	2208	rundll32.exe	rundll32.exe
PID 2208 wrote to memory of 2200	2208	rundll32.exe	rundll32.exe
PID 2208 wrote to memory of 2200	2208	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b7d06da96466eae0245b8d665e7f2b1779e72667ff549cc5373422b17de342cb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2208

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b7d06da96466eae0245b8d665e7f2b1779e72667ff549cc5373422b17de342cb.dll,#1
2⤵
- Drops file in System32 directory
PID:2200

memory/2200-1-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download