ramnit | e92712c5a1f3cdd8cc0755932127ad16adc81af5d84da50c2fbf036205263335

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 04:18

Target

e92712c5a1f3cdd8cc0755932127ad16adc81af5d84da50c2fbf036205263335.dll
Size

38KB
MD5

66b10b8fd5cd5bac42790cfd046a0b72
SHA1

84c5ee4e4a80739aff2a702386fa057714a3e843
SHA256

e92712c5a1f3cdd8cc0755932127ad16adc81af5d84da50c2fbf036205263335
SHA512

658ef6def3a1b476079341e96cbba6a5e4a9e4224798b0c1e70d76ba21ccbae4d4284ad0b12ae85e873b61d79c09c7f4922b7b7a885f8d5ce4d19b6cc5bc056e
SSDEEP

768:Bs+/gMsLIn/wIj2labk+1IsceGSnkmJ0Yblr583CJrVV7UIXU76m2szqVV:WD8w22laSR0V+3CJrV7XczJz

Score

10^/10

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File created C:\Windows\SysWOW64\dmlconf.dat rundll32.exe

description	ioc	process
File created	C:\Windows\SysWOW64\dmlconf.dat	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1924 wrote to memory of 1932	1924	rundll32.exe	rundll32.exe
PID 1924 wrote to memory of 1932	1924	rundll32.exe	rundll32.exe
PID 1924 wrote to memory of 1932	1924	rundll32.exe	rundll32.exe
PID 1924 wrote to memory of 1932	1924	rundll32.exe	rundll32.exe
PID 1924 wrote to memory of 1932	1924	rundll32.exe	rundll32.exe
PID 1924 wrote to memory of 1932	1924	rundll32.exe	rundll32.exe
PID 1924 wrote to memory of 1932	1924	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e92712c5a1f3cdd8cc0755932127ad16adc81af5d84da50c2fbf036205263335.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1924

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e92712c5a1f3cdd8cc0755932127ad16adc81af5d84da50c2fbf036205263335.dll,#1
2⤵
- Drops file in System32 directory
PID:1932

memory/1932-2-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/1932-1-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download