ramnit | 3b27c20658498696ca570d00362cfcec6fb17bf05dbbf972ddbafc14d723b573

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 01:49

Target

974cf643a561eca21aac5cae9db09cc0_NeikiAnalytics.dll
Size

67KB
MD5

974cf643a561eca21aac5cae9db09cc0
SHA1

c831fec9a663131ecbb73e28d87d326fd67ad0fb
SHA256

3b27c20658498696ca570d00362cfcec6fb17bf05dbbf972ddbafc14d723b573
SHA512

d15641fef456b5a28eac4fcb6bf4743ba59ea1ca84953108bb2c623ebfaccb6e94ff4c46f4ea82bb12b10cdc2efd7479a241ed8b0fe18c46cb46682c0c4de6bc
SSDEEP

1536:GJ4UwPZgpoc1wzruMECYCB+2H0eQ8X0iZs3:GOx+poHHuDCYCBFXXs3

Score

10^/10

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Drops startup file 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vevjvkxy.exe	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1900	3420	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 3420	1508	rundll32.exe	82
PID 1508 wrote to memory of 3420	1508	rundll32.exe	82
PID 1508 wrote to memory of 3420	1508	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\974cf643a561eca21aac5cae9db09cc0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\974cf643a561eca21aac5cae9db09cc0_NeikiAnalytics.dll,#1
  2⤵
  - Drops startup file
  PID:3420
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3420 -s 616
    3⤵
    - Program crash
    PID:1900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3420 -ip 3420
1⤵
PID:4156

memory/3420-0-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download