ramnit | 042c0ff8e658b9b9b86134cf0aecc96f95a37ab5c0c8b9ed935432d20b9a38c8

Analysis

max time kernel
133s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29-05-2024 06:22

Target

4862b08d097e6ce910d0209f40862c00_NeikiAnalytics.dll
Size

68KB
MD5

4862b08d097e6ce910d0209f40862c00
SHA1

d227aae9b114674dcdbe398868e338655306785a
SHA256

042c0ff8e658b9b9b86134cf0aecc96f95a37ab5c0c8b9ed935432d20b9a38c8
SHA512

478b0f87fc3df13431fad44d7d08bab7cdcc878feeb8e2734792873fab14dcf00afb724baa887439712aa8a6b0a104ed206e4265c4f26319f986f3bfec0cf7af
SSDEEP

1536:MLNd/Pk7btaoX7DypKr0wNIYIUSS9eyBX5Q0iZs3V:GNhY5aora80mIYI7i5QXs3

Score

10^/10

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Drops startup file 1 IoCs

Processes:

rundll32.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\citjuimu.exe	rundll32.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2988 764 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2988	764	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3632 wrote to memory of 764	3632	rundll32.exe	rundll32.exe
PID 3632 wrote to memory of 764	3632	rundll32.exe	rundll32.exe
PID 3632 wrote to memory of 764	3632	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4862b08d097e6ce910d0209f40862c00_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3632
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4862b08d097e6ce910d0209f40862c00_NeikiAnalytics.dll,#1
  2⤵
  - Drops startup file
  PID:764
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 764 -s 636
    3⤵
    - Program crash
    PID:2988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 764 -ip 764
1⤵
PID:4244

memory/764-0-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download