ramnit | aea9898569e631c6a5cb23b2cf2e03b532b54bb381909b8b32dd4b1c57e5c948

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27-05-2024 03:00

Target

1b875525ac72e088da7a3942e154a250_NeikiAnalytics.dll
Size

67KB
MD5

1b875525ac72e088da7a3942e154a250
SHA1

d12e164a5d280d30f2dca47bf87151523fe56256
SHA256

aea9898569e631c6a5cb23b2cf2e03b532b54bb381909b8b32dd4b1c57e5c948
SHA512

0f573276b69a44fefd9b570f2a3f786dc3967685b1de956da21aaaa1f6835bb8cbd926d5d80260187a458b6adada536e5f1993d55cac9cb599df957fede92cda
SSDEEP

1536:GJ4UwPZgpoc1wzruMEaYCB+2H03c0iZs3:GOx+poHHuDaYCBecXs3

Score

10^/10

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Drops startup file 1 IoCs

Processes:

rundll32.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dbmmmgnt.exe	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 492 wrote to memory of 2096	492	rundll32.exe	rundll32.exe
PID 492 wrote to memory of 2096	492	rundll32.exe	rundll32.exe
PID 492 wrote to memory of 2096	492	rundll32.exe	rundll32.exe
PID 492 wrote to memory of 2096	492	rundll32.exe	rundll32.exe
PID 492 wrote to memory of 2096	492	rundll32.exe	rundll32.exe
PID 492 wrote to memory of 2096	492	rundll32.exe	rundll32.exe
PID 492 wrote to memory of 2096	492	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1b875525ac72e088da7a3942e154a250_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:492

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1b875525ac72e088da7a3942e154a250_NeikiAnalytics.dll,#1
2⤵
- Drops startup file
PID:2096

memory/2096-0-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download