ramnit | 8348bb84f4f0a15db681ae084e03d71a28c2d3861c29776813c72cc2ae417dfb

Analysis

max time kernel
133s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-06-2024 10:51

Target

341148705b12e51737fd884672b564a0_NeikiAnalytics.dll
Size

246KB
MD5

341148705b12e51737fd884672b564a0
SHA1

8824930a6c3098723e46ae0a76f0edc728a4cd25
SHA256

8348bb84f4f0a15db681ae084e03d71a28c2d3861c29776813c72cc2ae417dfb
SHA512

627dc43f729ae5cea316f11210fbde8213c18d99138580a182180b913695a6431f1d5c4b6d551622cc5bcdbb39a069dcf865a6c3eab46098d80ae9a96808b101
SSDEEP

3072:EQR2HnTrsEJTqVXHUJePMqvk9sEFU6tiNO85/BEZR6aJjdGE0F6GqJu:E1nTAEJqKJedvIsn6I9BEZR6an0FB

Score

10^/10

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Executes dropped EXE 1 IoCs

Processes:

rundll32mgr.exe

pid process

4224 rundll32mgr.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32mgr.exe

pid process

4224 rundll32mgr.exe

pid	process
4224	rundll32mgr.exe

pid	process
4224	rundll32mgr.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/4224-7-0x0000000000400000-0x0000000000446000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

3928 4824 WerFault.exe rundll32.exe
2544 4224 WerFault.exe rundll32mgr.exe

description	ioc	process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

pid	pid_target	process	target process
3928	4824	WerFault.exe	rundll32.exe
2544	4224	WerFault.exe	rundll32mgr.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 4016 wrote to memory of 4824	4016	rundll32.exe	rundll32.exe
PID 4016 wrote to memory of 4824	4016	rundll32.exe	rundll32.exe
PID 4016 wrote to memory of 4824	4016	rundll32.exe	rundll32.exe
PID 4824 wrote to memory of 4224	4824	rundll32.exe	rundll32mgr.exe
PID 4824 wrote to memory of 4224	4824	rundll32.exe	rundll32mgr.exe
PID 4824 wrote to memory of 4224	4824	rundll32.exe	rundll32mgr.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\341148705b12e51737fd884672b564a0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\341148705b12e51737fd884672b564a0_NeikiAnalytics.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4824
- - C:\Windows\SysWOW64\rundll32mgr.exe
    C:\Windows\SysWOW64\rundll32mgr.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4224
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4224 -s 10172
      4⤵
      Program crash
      PID:2544
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 644
    3⤵
    - Program crash
    PID:3928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4824 -ip 4824
1⤵
PID:212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4224 -ip 4224
1⤵
PID:2528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4160,i,11746347647270949551,7786733067759450703,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:8
1⤵
PID:4668

C:\Users\Admin\AppData\Local\Temp\~TMC8E.tmp

Filesize
1.6MB

MD5
4f3387277ccbd6d1f21ac5c07fe4ca68

SHA1
e16506f662dc92023bf82def1d621497c8ab5890

SHA256
767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

SHA512
9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

Download Submit
C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
227KB

MD5
00db1dc3bb53779c04608487477ba078

SHA1
f7521d86c3c06f114cf7eaf31b8953bf30e07c6a

SHA256
20d47369661b9c2b8264dbf50225ecb5c777f3ee9397bca0581e77865d31c97e

SHA512
3d703575a6e54f122bfb4815753387e5f42094f24899976ffce17972f92c329c4340ae088d2b349c65c9b5709d3c08acdafbe859411931b70cc39202112b67b9

Download Submit
memory/4224-5-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/4224-7-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/4824-1-0x0000000010000000-0x0000000010045000-memory.dmp

Filesize
276KB

Download
memory/4824-10-0x0000000010000000-0x0000000010045000-memory.dmp

Filesize
276KB

Download