ramnit | 1c8d6b8afee606a8f74d8dbc2b6f1840bd1864c10a56a0da888d920921f9d818

Analysis

max time kernel
92s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 12:10

Target
a2fe2b3ac25ab9ab9e7f963ea13569c0_NeikiAnalytics.dll
Size 68KB
Sample240603-pchf1aea2x
SHA256 1c8d6b8afee606a8f74d8dbc2b6f1840bd1864c10a56a0da888d920921f9d818
MD5 a2fe2b3ac25ab9ab9e7f963ea13569c0
SHA1 5f51f77ca0ec0d724bfbf5dc6686f84b21d42e56
SHA512 0e2e5e3aaa50f46f516a1a88dd8f6a7be2d73cd2c545d811573602c366be7c15fbd95fc9a526459e97963609d08d722e7bcb811cafefe83f734aee3059593be9
SSDEEP 1536:MLNd/Pk7btaoX7DypKr0wN6YIUSS9edBdu0iZs32:GNhY5aora80m6YI7duXs3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Drops startup file 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ocrnvtyx.exe	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
216	3888	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 3888	2384	rundll32.exe	82
PID 2384 wrote to memory of 3888	2384	rundll32.exe	82
PID 2384 wrote to memory of 3888	2384	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a2fe2b3ac25ab9ab9e7f963ea13569c0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a2fe2b3ac25ab9ab9e7f963ea13569c0_NeikiAnalytics.dll,#1
  2⤵
  - Drops startup file
  PID:3888
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3888 -s 636
    3⤵
    - Program crash
    PID:216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3888 -ip 3888
1⤵
PID:4352

memory/3888-0-0x0000000010000000-0x0000000010014000-memory.dmp

Download