ramnit | 17a8cef3b5655f4fe6117629b7400f078506e02accc4705f1357cbac55f9522a

Analysis

max time kernel
91s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 04:29

Target
772283c17e80d7ebcfafefeedb261f40_NeikiAnalytics.dll
Size 127KB
Sample240531-e4gnnsga86
SHA256 17a8cef3b5655f4fe6117629b7400f078506e02accc4705f1357cbac55f9522a
MD5 772283c17e80d7ebcfafefeedb261f40
SHA1 79a9064413616d6fa07c05ba8edd3d06e711900e
SHA512 f47a0698ccb784511c045a7dba49bb9534caceb9150ecd8083a80c9f8d85f1aa870fa3251dff17a80cba650c311c7e679cb386ce9a6c11d16793042b253a8d25
SSDEEP 3072:OMbIWiyr7pjvTUoBFEbWwIUJlTBft3+G+N:OCIWiyr7JTn16lTBl3+G
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Drops startup file 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dnpmgiuo.exe	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2712	2744	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 2744	1344	rundll32.exe	83
PID 1344 wrote to memory of 2744	1344	rundll32.exe	83
PID 1344 wrote to memory of 2744	1344	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\772283c17e80d7ebcfafefeedb261f40_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\772283c17e80d7ebcfafefeedb261f40_NeikiAnalytics.dll,#1
  2⤵
  - Drops startup file
  PID:2744
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 624
    3⤵
    - Program crash
    PID:2712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2744 -ip 2744
1⤵
PID:4260

memory/2744-0-0x0000000010000000-0x0000000010023000-memory.dmp

Download