ramnit | 98f4c77934148ba111bead466d8e6d21ed14fc9d0d7a952e84008b3c2ee6445f

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 01:21

Target
5e781638fbd17cafa8c1609a56d76d90_NeikiAnalytics.dll
Size 38KB
Sample240530-bq5lsshc9y
SHA256 98f4c77934148ba111bead466d8e6d21ed14fc9d0d7a952e84008b3c2ee6445f
MD5 5e781638fbd17cafa8c1609a56d76d90
SHA1 d7d787b21807392ddc89f20505f2b56c9665591f
SHA512 d7f1f9e1ee136e2a86dd468a940ec850f1285d7a94205ecb7e9aa7731f86593d24c1115ce8771a61ecbdb81b338bc50deaa1f0877afdc60c8af68c1e146e676d
SSDEEP 768:Bs+/gMsLIn/wIj2labk+1IsceGSnkmJ0Yblr583CJrVV7WIXUC6m2si2VV:WD8w22laSR0V+3CJrV9XJzJi
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\dmlconf.dat	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2096	3544	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 116 wrote to memory of 3544	116	rundll32.exe	82
PID 116 wrote to memory of 3544	116	rundll32.exe	82
PID 116 wrote to memory of 3544	116	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e781638fbd17cafa8c1609a56d76d90_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:116
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e781638fbd17cafa8c1609a56d76d90_NeikiAnalytics.dll,#1
  2⤵
  - Drops file in System32 directory
  PID:3544
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3544 -s 604
    3⤵
    - Program crash
    PID:2096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3544 -ip 3544
1⤵
PID:4396

memory/3544-1-0x0000000010000000-0x000000001000D000-memory.dmp

Download