ramnit | ab6740bda183a9355a14c3e39439dd6286acd8cd9969f7ae337b8a94cebfad85

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
31-05-2024 04:21

Target

76e213da78ba8bfd0b65e9ff9b6c5b70_NeikiAnalytics.dll
Size

38KB
MD5

76e213da78ba8bfd0b65e9ff9b6c5b70
SHA1

d7e47a874ca1d396ae09534f3cee3fd66919466a
SHA256

ab6740bda183a9355a14c3e39439dd6286acd8cd9969f7ae337b8a94cebfad85
SHA512

a745c75a335283766f0cc6f6a794466dc7711183dee948ef6be300c7f8f0f8cab342b5c0b1d0dc81a0354a8ffd0a3ee65a9d9c237c2ce14cb6eb9d4708fa26f0
SSDEEP

768:Bs+/gMsLIn/wIj2labk+1IsceGSnkmJ0Yblr583CJrVV70IXUi6m2sSwVV:WD8w22laSR0V+3CJrVLXpzJS

Score

10^/10

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File created C:\Windows\SysWOW64\dmlconf.dat rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1856 2664 WerFault.exe rundll32.exe

description	ioc	process
File created	C:\Windows\SysWOW64\dmlconf.dat	rundll32.exe

pid	pid_target	process	target process
1856	2664	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3972 wrote to memory of 2664	3972	rundll32.exe	rundll32.exe
PID 3972 wrote to memory of 2664	3972	rundll32.exe	rundll32.exe
PID 3972 wrote to memory of 2664	3972	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\76e213da78ba8bfd0b65e9ff9b6c5b70_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\76e213da78ba8bfd0b65e9ff9b6c5b70_NeikiAnalytics.dll,#1
  2⤵
  - Drops file in System32 directory
  PID:2664
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 604
    3⤵
    - Program crash
    PID:1856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2664 -ip 2664
1⤵
PID:1480

memory/2664-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download