ramnit | aea9898569e631c6a5cb23b2cf2e03b532b54bb381909b8b32dd4b1c57e5c948

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27-05-2024 03:00

Target

1b875525ac72e088da7a3942e154a250_NeikiAnalytics.dll
Size

67KB
MD5

1b875525ac72e088da7a3942e154a250
SHA1

d12e164a5d280d30f2dca47bf87151523fe56256
SHA256

aea9898569e631c6a5cb23b2cf2e03b532b54bb381909b8b32dd4b1c57e5c948
SHA512

0f573276b69a44fefd9b570f2a3f786dc3967685b1de956da21aaaa1f6835bb8cbd926d5d80260187a458b6adada536e5f1993d55cac9cb599df957fede92cda
SSDEEP

1536:GJ4UwPZgpoc1wzruMEaYCB+2H03c0iZs3:GOx+poHHuDaYCBecXs3

Score

10^/10

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Drops startup file 1 IoCs

Processes:

rundll32.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ykqcykpl.exe	rundll32.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1080 2416 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1080	2416	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4160 wrote to memory of 2416	4160	rundll32.exe	rundll32.exe
PID 4160 wrote to memory of 2416	4160	rundll32.exe	rundll32.exe
PID 4160 wrote to memory of 2416	4160	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1b875525ac72e088da7a3942e154a250_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4160

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1b875525ac72e088da7a3942e154a250_NeikiAnalytics.dll,#1
2⤵
- Drops startup file
PID:2416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 616
3⤵
- Program crash
PID:1080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2416 -ip 2416
1⤵
PID:3264

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4156 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:3520

memory/2416-0-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download