ramnit | aece0d7d7ea66af6586201a36086b07e04025bffbda1034788936ed42f1d2d4d

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
30-05-2024 05:01

Target

658afe52b2727bc674bd99b1efbc4340_NeikiAnalytics.dll
Size

38KB
MD5

658afe52b2727bc674bd99b1efbc4340
SHA1

5e6ccef60b9025630865eeb7a16dc66469b7a5d9
SHA256

aece0d7d7ea66af6586201a36086b07e04025bffbda1034788936ed42f1d2d4d
SHA512

4bc29a197bb1d4e4ba1163982844fc91b9a5798e6d9065ba1d1cc609e39d96fc3c1ca1a539991b6486bbcf0e34341767403206a0681c5a1fa9eeee81206e9f7d
SSDEEP

768:Bs+/gMsLIn/wIj2labk+1IsceGSnkmJ0Yblr583CJrVV7VsXU76m2sGqVV:WD8w22laSR0V+3CJrVYXczJG

Score

10^/10

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File created C:\Windows\SysWOW64\dmlconf.dat rundll32.exe

description	ioc	process
File created	C:\Windows\SysWOW64\dmlconf.dat	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1728 wrote to memory of 1952	1728	rundll32.exe	rundll32.exe
PID 1728 wrote to memory of 1952	1728	rundll32.exe	rundll32.exe
PID 1728 wrote to memory of 1952	1728	rundll32.exe	rundll32.exe
PID 1728 wrote to memory of 1952	1728	rundll32.exe	rundll32.exe
PID 1728 wrote to memory of 1952	1728	rundll32.exe	rundll32.exe
PID 1728 wrote to memory of 1952	1728	rundll32.exe	rundll32.exe
PID 1728 wrote to memory of 1952	1728	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\658afe52b2727bc674bd99b1efbc4340_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\658afe52b2727bc674bd99b1efbc4340_NeikiAnalytics.dll,#1
  2⤵
  - Drops file in System32 directory
  PID:1952

memory/1952-1-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download