ramnit | fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

Analysis

max time kernel
149s
max time network
276s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 03:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ICONMO~1Srv.exe
Size 55KB
Sample240530-ec57ysdd4x
SHA256 fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
MD5 ff5e1f27193ce51eec318714ef038bef
SHA1 b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA512 c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
SSDEEP 1536:Q+hzRsibKplyXTq8OGRnsPFG+RODTb7MXL5uXZnzE:bROzoTq0+RO7IwnY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Executes dropped EXE 1 IoCs

pid	Process
2820	DesktopLayer.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3552-0-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/files/0x000b000000023406-6.dat	upx
behavioral1/memory/2820-8-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2820-9-0x0000000000400000-0x000000000042E000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	ICONMO~1Srv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	ICONMO~1Srv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px34CB.tmp	ICONMO~1Srv.exe

Modifies Internet Explorer settings 1 TTPs 15 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{87E6D917-1E37-11EF-9A94-620C7149A6B2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2820	DesktopLayer.exe
2820	DesktopLayer.exe
2820	DesktopLayer.exe
2820	DesktopLayer.exe
2820	DesktopLayer.exe
2820	DesktopLayer.exe
2820	DesktopLayer.exe
2820	DesktopLayer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5028	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5028	iexplore.exe
5028	iexplore.exe
5108	IEXPLORE.EXE
5108	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3552 wrote to memory of 2820	3552	ICONMO~1Srv.exe	82
PID 3552 wrote to memory of 2820	3552	ICONMO~1Srv.exe	82
PID 3552 wrote to memory of 2820	3552	ICONMO~1Srv.exe	82
PID 2820 wrote to memory of 5028	2820	DesktopLayer.exe	83
PID 2820 wrote to memory of 5028	2820	DesktopLayer.exe	83
PID 5028 wrote to memory of 5108	5028	iexplore.exe	84
PID 5028 wrote to memory of 5108	5028	iexplore.exe	84
PID 5028 wrote to memory of 5108	5028	iexplore.exe	84

C:\Users\Admin\AppData\Local\Temp\ICONMO~1Srv.exe
"C:\Users\Admin\AppData\Local\Temp\ICONMO~1Srv.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3552
- C:\Program Files (x86)\Microsoft\DesktopLayer.exe
  "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2820
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5028
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5028 CREDAT:17410 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:5108

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:3168

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DesktopLayer.exe

Path C:\Program Files (x86)\Microsoft\DesktopLayer.exe
Size 55KB
SHA256 fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
MD5 ff5e1f27193ce51eec318714ef038bef
SHA1 b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA512 c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
SSDEEP 1536:Q+hzRsibKplyXTq8OGRnsPFG+RODTb7MXL5uXZnzE:bROzoTq0+RO7IwnY
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcredist2010_x64.log-MSI_vc_red.msi.txt

Path C:\vcredist2010_x64.log-MSI_vc_red.msi.txt
Size 379KB
SHA256 5ff23074ff57228605eb5d624d4a8fcc85a84918861a84d34369df24101dae55
MD5 565a039c48f63731745d78b1e1cc6c15
SHA1 e6f6371a5c3471cf85d6e1181080ac17fbd3afc3
SHA512 cc6987bf231fbf7d9e50a4099c63c721a2b666ea771b3af1c5ef4c03a14b68052cd4ce139648f397f1c5cf27c6ea547e63c6a8c3da61635412ed2d0204ebdac1
SSDEEP 3072:qVMjX6upGGGGGGGGGGGGGGGGGyfpb3ZUSdq9bNBotp1faBebTS:2Mjx2
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcredist2010_x64.log.html

Path C:\vcredist2010_x64.log.html
Size 86KB
SHA256 93a0ea1d5ee2d4e139d526faef96442db3d1519ba161050d3d70beae7c7dcdc9
MD5 412e9ebbef0c767df1cfb5ea71ec9525
SHA1 d028b71694dfe553a71c3fd72f90a2b8a57e839e
SHA512 79f42aa593d75981201cb03d4c1362522238728b0c3c4bca0bb715c6ac36bf2617f383518d1b32993c63ecf89bd597ff3de3c992a9e98b84620b955631ae9399
SSDEEP 384:fdsOT01KcBUFJFEWUxFzvHTpPCqVjHxQEvyx6fy7Ly/:fdsOTLyUFJFEWUxFzvzRRQky6f6y/
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcredist2010_x86.log-MSI_vc_red.msi.txt

Path C:\vcredist2010_x86.log-MSI_vc_red.msi.txt
Size 395KB
SHA256 c44f119bde9dbd474d2f5ccaa8d2e4a310c2898ab63bbcda81f0f31d8c4b19b4
MD5 1af8350d793097471e34f2d4c9e18a76
SHA1 72ac1aa3ac986994687fd796127601d824a006b1
SHA512 4e68fdbe2983c33d9cbc469e689ebe453d4e4e55a282180bf626688cd5fe79be2a79878b534e685ec2785495436b0e304fe24e8da01b2c6324991d619b155ed4
SSDEEP 3072:yHLjSziOxTTTTTTTTTTTTTTTTTnmi3QD/G3vtwWzgQyJY8l+vQl:ALjgaj
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcredist2010_x86.log.html

Path C:\vcredist2010_x86.log.html
Size 81KB
SHA256 5f3c8844efa197403083ecedbce4e3ada93223c740ddd18ca26650e14c0f3038
MD5 55602be1e22e61ee23596ab7c06b8c04
SHA1 b6ce6350951dc063eaed3cc334435efd81122481
SHA512 e6a6a2c57edf6e04fc34d56c08ffb5075d7d939ea09fb062280f95ba84f36a6e74891e35edea4916eb6d52bd5e6058a9a0535b4f23ff78d587ddb0864bd8f7a5
SSDEEP 384:fdsOT01KcBUFJFEWUxFzvH71HC6dHfxQEIKx6lBTsyP:fdsOTLyUFJFEWUxFzvbZZQj66lOyP
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcredist2012_x64_0_vcRuntimeMinimum_x64.log

Path C:\vcredist2012_x64_0_vcRuntimeMinimum_x64.log
Size 168KB
SHA256 59fb3e00eb3776ccdb05dff1740cfe398bc89eac523e2415d1ad912f9377c28d
MD5 8f9c88054b43d184dffafcf4310cbc44
SHA1 73de93d033364eb1ac9cb6f4c7f091fddb415024
SHA512 bbf8cc69e27e584a575b11e5d1ec8b3dcbcc6990a9bd1af94a9331449c0b59bd91aa7721464406d60f9d978be5139b068d80b7e97f70956ff8e4a243fa1f564c
SSDEEP 1536:jqLp+v5QYmvjtEwHab+aUDwmoi47P+nKIWTf9h53ZrV5qR+sU01lqkUrLmqzFHdX:jO9ajvFnWWWxnoY2oOCw
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcredist2012_x64_1_vcRuntimeAdditional_x64.log

Path C:\vcredist2012_x64_1_vcRuntimeAdditional_x64.log
Size 195KB
SHA256 20c79a0404137c68dedb131b0cc753d509eb6535a484f8eaf6b649407b65ffd3
MD5 46ed9640420208725c43ef47da1994f8
SHA1 47103755146cdf5541c4618eb99d9cfba02f79d9
SHA512 69c3ba2b8d7d30bd03bc3dcee8f6bf5e98434009d84c1ac1c4207391c9ec1666c775c8e6df610764b1b9bb8dd45862e722ff03e444c1d9b9d8b185ec9c366b09
SSDEEP 3072:QHmjgCyyyyyyyyyyyyyyyLMNtus62K+aayhrr9Jx2Z:hjh
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcredist2012_x86_0_vcRuntimeMinimum_x86.log

Path C:\vcredist2012_x86_0_vcRuntimeMinimum_x86.log
Size 171KB
SHA256 784c354aae88e0b0f9003c2ad3f7f47ee3164bb0f607269492e805f8daea48db
MD5 875aba8db2f5a342452722cca2f16847
SHA1 1aca0a64e1322beba61ce569ba6eeea9e2b62f01
SHA512 dfaa0f4389d13064565ca33aee9ebd85d81abf43450d09c830e251bd83a5b6f5fe8bbb88181c152d7f16f02b59414cd26054fb18e232df329059f6c6c8a8f161
SSDEEP 1536:IYx0eKfAkxgzhHqmmq9UsaHkEQUF5ZVoo8roffZKkbko/L0vogYSJ/YEkloMoEow:IlTjQhyyy4LwAyOzg
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcredist2012_x86_1_vcRuntimeAdditional_x86.log

Path C:\vcredist2012_x86_1_vcRuntimeAdditional_x86.log
Size 208KB
SHA256 fcea187f5406d5d42bc68f3dfd6f96b70c721504a80486d7886e6594c840703e
MD5 7e6c645c7d55b1aa6cbfd928d71ecfb9
SHA1 990fec7cc8f528d2f0bb0f757ede344c0a17c543
SHA512 b1b0b8b5eaeedded28418c4e7d42fcb55b77fee130f5e0b63a274031e0f33b019266d3a724959d7db6c7a90fb5f29cd30645bad0315ab3756bbb703c5f876876
SSDEEP 3072:92VjDbZIDDDDDDMMMMMMMMMci60UvpwxHJ7MjPiErOG+:+j7
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcredist2013_x64_000_vcRuntimeMinimum_x64.log

Path C:\vcredist2013_x64_000_vcRuntimeMinimum_x64.log
Size 170KB
SHA256 f77bd3fefdd525fecf274128644fa5750a91fd0ecef0929bdd86082fd1b2ef34
MD5 1cd99956c470751f510a352fe5af802a
SHA1 7996259b324a6eb97e8b69accd5fc3b93ee9ae47
SHA512 085ea44c1fe6caaa2d9408aac3942160ca47f0f8942174fff7c9f2f8386ad26d5ae075eebe1fd5d9ed62606a5eab9378b541055d347c2b5a7fdd3524e060ea12
SSDEEP 1536:llFfPfKyUBNzhGnZT2PWEjuobJ5WuRvnfVmKA0eoIgqj1HdVHtCqjVcjrmddddjB:lQ3jrmddddj5fyJKbAzM
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcredist2013_x64_001_vcRuntimeAdditional_x64.log

Path C:\vcredist2013_x64_001_vcRuntimeAdditional_x64.log
Size 191KB
SHA256 04009b7c079a79dcbf4a27066174f1ccec4c54a8226e47b92d7ede1cf5146ff5
MD5 1d151ecaded0d82839476b513f6bca8f
SHA1 52bb4167395db6868f38978acbe096e6d2ce4b08
SHA512 fab64eea22e502a6ec11139248815de405dc79f019d0691327ef6378221935b78347d2e592489192399c3573c7a976fe4fe0c4ce6975349edf2c5cf3ca65cb99
SSDEEP 3072:7EJjVTJ2222222222222ia7Dilkmif0lV+E2yzm:Wj8
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcredist2013_x86_000_vcRuntimeMinimum_x86.log

Path C:\vcredist2013_x86_000_vcRuntimeMinimum_x86.log
Size 170KB
SHA256 43bc59a16216f54ea79c11132db20c72f61f2c9ebc9abef6694e44d8e49ed6c9
MD5 6c7aa150aa396c028a3b0b93101ae391
SHA1 20c0f7e1c884d694d2d258c0c84576dbce015523
SHA512 7e17463cc6205c52a932a3deb1e8b54b2d88f9dbcdf078858c79fe428efefe33548488837587ce46e0a56d30631f621683e1cb3f98c24013eff2dcf45d5339e0
SSDEEP 1536:xZ3wO4R/PE8aLXZca50LO/VJM6IFaJV1yIwQOvR/0WSyuqLFHltH9sqb4JjuM/Br:xf1juM5cccc0UvSniHgmH
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcredist2013_x86_001_vcRuntimeAdditional_x86.log

Path C:\vcredist2013_x86_001_vcRuntimeAdditional_x86.log
Size 198KB
SHA256 3142292382800b522b0d9c24d0bb54fbeb0df6f3bce2769df66c872255565a48
MD5 656bdf5c9dff46515e7f4ffa8d184a7f
SHA1 a242ea0669d0a6eb1ccaabfa516a140b6ff8be61
SHA512 b8374339d2c2f04e7d295c46b1acdb1b1a21796f0a52a6ad26793be9ff7fca688936524e138a80024c236bfd2a8be05538fad6d38722c790b0615afde271715d
SSDEEP 3072:f50j43aaaaaaaaaaaaaUIwFBqD93vSx51Y4gJLX3333333333YBDR:yjK
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcredist2022_x64_000_vcRuntimeMinimum_x64.log

Path C:\vcredist2022_x64_000_vcRuntimeMinimum_x64.log
Size 123KB
SHA256 36ec7632c396d67f9e1124d051ccfc3b8ad5b6c514eae830226cab30e24f7229
MD5 9808d68bf9c3875ccf86708a28649d02
SHA1 6589e342d4515dc044bd09843ef35d99dce32512
SHA512 049af8b9ceb3fa0b188b9b55b5e49360794dd85acb7bfb1734d6402b3e00590bb76f352868cb63f334759406bf30ac794f747f1294b17417e50a2f6bc4134f23
SSDEEP 1536:QL7fXqBZr6u8dfnvDmuROC0hZOWZHvH4pT0VCiu78jVGGNNNNNNNNNNIKiV5/SIM:QaFjVHNNNNNNNNNNIKiV5/SIUTMc/yK
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcredist2022_x64_001_vcRuntimeAdditional_x64.log

Path C:\vcredist2022_x64_001_vcRuntimeAdditional_x64.log
Size 129KB
SHA256 c4dc33e9b9aa2f39574acd6aede70e32f54b74c797753dc965e4e2deeb2a3ffd
MD5 0b37a98cf0038126c6dd82e5e6103fec
SHA1 b735c64c2c6754d64078e0ac48dd673f3a08b84c
SHA512 56c5d1d3005b578cc575e979b31a79d6c4f12fdf3fbed4f721d33e57d3a25518c4eb3c853f72e497e95459e21031a5ac118950b1c04d6ec77a69c8cac661768b
SSDEEP 3072:C4ijU30333HHHHHHHHHHGoxMQDd9gZ7X1ISplj:wjq
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcredist2022_x86_000_vcRuntimeMinimum_x86.log

Path C:\vcredist2022_x86_000_vcRuntimeMinimum_x86.log
Size 123KB
SHA256 32863b7344a2347a0018d66984aa912ce1112c0d4891def3a25459f3ee62cbe2
MD5 0d4fa02c71a9e2be44040833e7e086cb
SHA1 e5c857a7072a72db7b5c41f05194d7e5e8739b9e
SHA512 56694ad4a77ab42a88752edbc5b9da80a8137c27627f005ddd826f06b4d758820a184b2e78bd1f5d477850753136d334c9e178ebbdf44c588eab199f5cd27e65
SSDEEP 3072:nT9zK9DdTVgTEiF4dKxFX5lC8EjkJMqqqqqqqqqV6GhGhCoynOA6QNwA36Orn0R0:npzK9DdTVgTEiF6KxFX5lC8EjkaQNwAT
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcredist2022_x86_001_vcRuntimeAdditional_x86.log

Path C:\vcredist2022_x86_001_vcRuntimeAdditional_x86.log
Size 135KB
SHA256 6f521cf4c9ef4d41d221fb864a1f50532d77cc25b607034783cb21541b1b2b19
MD5 2553d065a73511fe45180d288331a849
SHA1 e735da57d8c3c4e518d41577ed1aa41bfc03faea
SHA512 921d7b7d9bc0ebe5b8dbbfb4f6d87a6b3d0f4549bffe87f22483271c37ef5a462612a2f99ecc22411524b3b80176c660c3f4ad8b395ea1b813b8c1c6aaae06eb
SSDEEP 3072:s5mjbMJJJJJJJJJJJJGuFsUchKhtIRiSBcTR/K:DjZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2820-9-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2820-7-0x00000000004E0000-0x00000000004E1000-memory.dmp

Download

memory/2820-8-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/3552-1-0x00000000006A0000-0x00000000006AF000-memory.dmp

Download

memory/3552-0-0x0000000000400000-0x000000000042E000-memory.dmp

Download