ramnit | 8a109d748a994bc877d3241de3d0d8c9f6bbf9902971c31afe750a0b11741da3

Analysis

max time kernel
133s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 19:43

Target

7e8297fcc1de6051ef5062c601042d60_NeikiAnalytics.dll
Size

68KB
MD5

7e8297fcc1de6051ef5062c601042d60
SHA1

f069f61afd10fcc66291a85e74e896738f044435
SHA256

8a109d748a994bc877d3241de3d0d8c9f6bbf9902971c31afe750a0b11741da3
SHA512

bb646f7d137c4c9f8fdf573f714643cf71d1d5594708ad8cb679af35db6976d823339c1c93434dfa8607ea1365528c4bcdb8a177b21cdeab7f79435df44ff2c0
SSDEEP

1536:MLNd/Pk7btaoX7DypKr0wN3YIUSS9eyBRbW0iZs32:GNhY5aora80m3YI7KbWXs3

Score

10^/10

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Drops startup file 1 IoCs

Processes:

rundll32.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ncunhunn.exe	rundll32.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1516 2724 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1516	2724	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3136 wrote to memory of 2724	3136	rundll32.exe	rundll32.exe
PID 3136 wrote to memory of 2724	3136	rundll32.exe	rundll32.exe
PID 3136 wrote to memory of 2724	3136	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7e8297fcc1de6051ef5062c601042d60_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3136

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7e8297fcc1de6051ef5062c601042d60_NeikiAnalytics.dll,#1
2⤵
- Drops startup file
PID:2724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 640
3⤵
- Program crash
PID:1516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2724 -ip 2724
1⤵
PID:2500

memory/2724-0-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download