ramnit | f69069f5f92b6e43fbd1fc183966bc873892c3276e12105c130a741a777ea829

Analysis

max time kernel
131s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 00:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8fe8bb45a97f24c3c85d01e034539e90_NeikiAnalytics.dll
Size 234KB
Sample240603-a66claee33
SHA256 f69069f5f92b6e43fbd1fc183966bc873892c3276e12105c130a741a777ea829
MD5 8fe8bb45a97f24c3c85d01e034539e90
SHA1 04ce9272778dc7fff574c139050227bf841f9624
SHA512 d16ac21c532c8537c8a1df7e088ee47c21c1dda844267b508f783f41afe39349374d784afb7ac4e9c3d6395c1eec5b209cd25f7b873c1c4d65167eefb101c57a
SSDEEP 3072:dnTrsEJTqVXHUJePMqvk9sEFU6tiNO85/BEZR6aJjdGE0F6GqJb:dnTAEJqKJedvIsn6I9BEZR6an0Fg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Executes dropped EXE 1 IoCs

pid	Process
684	rundll32mgr.exe

Loads dropped DLL 1 IoCs

pid	Process
684	rundll32mgr.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/684-7-0x0000000000400000-0x0000000000446000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1356	2996	WerFault.exe	83
3124	684	WerFault.exe	84

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4728 wrote to memory of 2996	4728	rundll32.exe	83
PID 4728 wrote to memory of 2996	4728	rundll32.exe	83
PID 4728 wrote to memory of 2996	4728	rundll32.exe	83
PID 2996 wrote to memory of 684	2996	rundll32.exe	84
PID 2996 wrote to memory of 684	2996	rundll32.exe	84
PID 2996 wrote to memory of 684	2996	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8fe8bb45a97f24c3c85d01e034539e90_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8fe8bb45a97f24c3c85d01e034539e90_NeikiAnalytics.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2996
- - C:\Windows\SysWOW64\rundll32mgr.exe
    C:\Windows\SysWOW64\rundll32mgr.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:684
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 684 -s 10168
      4⤵
      Program crash
      PID:3124
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 620
    3⤵
    - Program crash
    PID:1356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2996 -ip 2996
1⤵
PID:4272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 684 -ip 684
1⤵
PID:532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

~TM4343.tmp

Path C:\Users\Admin\AppData\Local\Temp\~TM4343.tmp
Size 1.6MB
SHA256 767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
MD5 4f3387277ccbd6d1f21ac5c07fe4ca68
SHA1 e16506f662dc92023bf82def1d621497c8ab5890
SHA512 9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
SSDEEP 24576:qhYK3o0FvOh/e8AuDq8TJqbEPVVdqi90gvuPGO12HoIGTufqN8:2XFvO5egq8TMbEL59JCKSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

rundll32mgr.exe

Path C:\Windows\SysWOW64\rundll32mgr.exe
Size 227KB
SHA256 20d47369661b9c2b8264dbf50225ecb5c777f3ee9397bca0581e77865d31c97e
MD5 00db1dc3bb53779c04608487477ba078
SHA1 f7521d86c3c06f114cf7eaf31b8953bf30e07c6a
SHA512 3d703575a6e54f122bfb4815753387e5f42094f24899976ffce17972f92c329c4340ae088d2b349c65c9b5709d3c08acdafbe859411931b70cc39202112b67b9
SSDEEP 3072:ZZSlI/HUOjSiToj7CEqfqg2rTeigwkYcyzmA:Zv/HFjSdfCZ4rTeiZcK
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/684-5-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/684-7-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/2996-1-0x0000000010000000-0x000000001003F000-memory.dmp

Download

memory/2996-10-0x0000000010000000-0x000000001003F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads