ramnit | dbf0aa9e6748d05db237680c24a61a87696c29743ea0d846f1f165e286d3a3c3

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30-05-2024 03:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dbf0aa9e6748d05db237680c24a61a87696c29743ea0d846f1f165e286d3a3c3.dll
Size

5.5MB
MD5

6949b3ae885ba31eff86b28b68b81453
SHA1

363e7dd0bfae6deeda597bafa935c27a12df6559
SHA256

dbf0aa9e6748d05db237680c24a61a87696c29743ea0d846f1f165e286d3a3c3
SHA512

2eac5f63fd4a5c6b0cfef94e2b726c4227920c0128584a270cff7a0342020a2ed57728cceb71ca0105a5c4a481f567e7374fdd4e4ede64dac9be7f31ecf929ad
SSDEEP

98304:tivlGupvdCf9DpTl4cjg1z+X2kU3D4YJRNhu6VKt9wXgvhiWaOuBuc3hF4pBMV:t0lGgCf5pB4sg1z+X2n3D4GRfu6VzR

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

UPX dump on OEP (original entry point) 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2620-12-0x0000000000400000-0x0000000000435000-memory.dmp	UPX
behavioral1/memory/2620-22-0x0000000000400000-0x0000000000435000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

Processes:

rundll32mgr.exe

pid process

2620 rundll32mgr.exe
Loads dropped DLL 4 IoCs

Processes:

rundll32.exerundll32mgr.exe

pid process

2136 rundll32.exe
2136 rundll32.exe
2620 rundll32mgr.exe
2620 rundll32mgr.exe

pid	process
2620	rundll32mgr.exe

pid	process
2136	rundll32.exe
2136	rundll32.exe
2620	rundll32mgr.exe
2620	rundll32mgr.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2620-12-0x0000000000400000-0x0000000000435000-memory.dmp	upx
behavioral1/memory/2620-22-0x0000000000400000-0x0000000000435000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe

description	ioc	process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 640 wrote to memory of 2136	640	rundll32.exe	rundll32.exe
PID 640 wrote to memory of 2136	640	rundll32.exe	rundll32.exe
PID 640 wrote to memory of 2136	640	rundll32.exe	rundll32.exe
PID 640 wrote to memory of 2136	640	rundll32.exe	rundll32.exe
PID 640 wrote to memory of 2136	640	rundll32.exe	rundll32.exe
PID 640 wrote to memory of 2136	640	rundll32.exe	rundll32.exe
PID 640 wrote to memory of 2136	640	rundll32.exe	rundll32.exe
PID 2136 wrote to memory of 2620	2136	rundll32.exe	rundll32mgr.exe
PID 2136 wrote to memory of 2620	2136	rundll32.exe	rundll32mgr.exe
PID 2136 wrote to memory of 2620	2136	rundll32.exe	rundll32mgr.exe
PID 2136 wrote to memory of 2620	2136	rundll32.exe	rundll32mgr.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dbf0aa9e6748d05db237680c24a61a87696c29743ea0d846f1f165e286d3a3c3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dbf0aa9e6748d05db237680c24a61a87696c29743ea0d846f1f165e286d3a3c3.dll,#1
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2136
- - C:\Windows\SysWOW64\rundll32mgr.exe
    C:\Windows\SysWOW64\rundll32mgr.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\~TM9897.tmp

Filesize
1.2MB

MD5
d124f55b9393c976963407dff51ffa79

SHA1
2c7bbedd79791bfb866898c85b504186db610b5d

SHA256
ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef

SHA512
278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06

Download Submit
\Users\Admin\AppData\Local\Temp\~TM9992.tmp

Filesize
1.1MB

MD5
9b98d47916ead4f69ef51b56b0c2323c

SHA1
290a80b4ded0efc0fd00816f373fcea81a521330

SHA256
96e0ae104c9662d0d20fdf59844c2d18334e5847b6c4fc7f8ce4b3b87f39887b

SHA512
68b67021f228d8d71df4deb0b6388558b2f935a6aa466a12199cd37ada47ee588ea407b278d190d3a498b0ef3f5f1a2573a469b7ea5561ab2e7055c45565fe94

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
97KB

MD5
04beaa248742a71cf028677279233fbe

SHA1
c392e6e173fbc4df0a3c45698b9130e3f63d39bc

SHA256
c90e1c184dc44f9312476fdd824a08e54bd667c2954daff7d2d6b992a12a926e

SHA512
f99f427678ac8ec45963e2d4e018e116243d67a791109b7bf27ddb6e3c450cd931e66d552e0574d6f63cbb3b163eee061566657193ebe72ee8c21e991fcc52f9

Download Submit
memory/2136-1-0x0000000074AA0000-0x0000000075056000-memory.dmp

Filesize
5.7MB

Download
memory/2136-3-0x00000000744E0000-0x0000000074A96000-memory.dmp

Filesize
5.7MB

Download
memory/2136-10-0x0000000074AA0000-0x0000000075056000-memory.dmp

Filesize
5.7MB

Download
memory/2136-14-0x00000000001F0000-0x0000000000225000-memory.dmp

Filesize
212KB

Download
memory/2136-13-0x00000000001F0000-0x0000000000225000-memory.dmp

Filesize
212KB

Download
memory/2136-11-0x00000000744E0000-0x0000000074A96000-memory.dmp

Filesize
5.7MB

Download
memory/2620-12-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2620-22-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download