ramnit | dfa9a4c3f187e3c4a6204c2a6cb545e629864c2424ae106da9d0a9ada8eb5542

General

Target

dfa9a4c3f187e3c4a6204c2a6cb545e629864c2424ae106da9d0a9ada8eb5542.dll
Size

508KB
MD5

a710201fa3d7aaa02f4a8d1875a37db0
SHA1

38471a0d4072cc93d380484b5170f24845cc3575
SHA256

dfa9a4c3f187e3c4a6204c2a6cb545e629864c2424ae106da9d0a9ada8eb5542
SHA512

4ee6b0ef10ac77a2b5af657cdd975f5cc1c2f354dcb09d5c2d79b80d520104b4871063c044da70ca4339cbe2c6db2d85b27d369873cd90779c29b5580f5fad65
SSDEEP

12288:eehnaNPpSVZmNxRCwnwm3W3OHIIf5QcY6QtOTD:eeh0PpS6NxNnwYeOHXHQtQ

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

UPX dump on OEP (original entry point) 9 IoCs

Processes:

resource	yara_rule
behavioral2/memory/6120-7-0x0000000000400000-0x0000000000421000-memory.dmp	UPX
behavioral2/memory/6120-8-0x0000000000400000-0x0000000000421000-memory.dmp	UPX
behavioral2/memory/6120-13-0x0000000000400000-0x0000000000421000-memory.dmp	UPX
behavioral2/memory/4608-31-0x0000000000400000-0x000000000044A000-memory.dmp	UPX
behavioral2/memory/4608-29-0x0000000000400000-0x0000000000421000-memory.dmp	UPX
behavioral2/memory/6120-16-0x0000000000400000-0x0000000000421000-memory.dmp	UPX
behavioral2/memory/6120-12-0x0000000000400000-0x0000000000421000-memory.dmp	UPX
behavioral2/memory/6120-10-0x0000000000400000-0x0000000000421000-memory.dmp	UPX
behavioral2/memory/4608-40-0x0000000000400000-0x0000000000421000-memory.dmp	UPX

Executes dropped EXE 2 IoCs

Processes:

rundll32mgr.exeWaterMark.exe

pid process

6120 rundll32mgr.exe
4608 WaterMark.exe

pid	process
6120	rundll32mgr.exe
4608	WaterMark.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/6120-7-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/6120-8-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/6120-13-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4608-31-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral2/memory/4608-29-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/6120-16-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/6120-12-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/6120-6-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/6120-10-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4608-40-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe

description	ioc	process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

Drops file in Program Files directory 3 IoCs

Processes:

rundll32mgr.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft\WaterMark.exe	rundll32mgr.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px4287.tmp	rundll32mgr.exe
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	rundll32mgr.exe

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

2748 3908 WerFault.exe rundll32.exe
3580 1948 WerFault.exe svchost.exe

pid	pid_target	process	target process
2748	3908	WerFault.exe	rundll32.exe
3580	1948	WerFault.exe	svchost.exe

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{B10B7BD9-2A0B-11EF-9519-C2BABBD8D0A3} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424503396"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{B10DDDB0-2A0B-11EF-9519-C2BABBD8D0A3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

WaterMark.exe

pid	process
4608	WaterMark.exe
4608	WaterMark.exe
4608	WaterMark.exe
4608	WaterMark.exe
4608	WaterMark.exe
4608	WaterMark.exe
4608	WaterMark.exe
4608	WaterMark.exe
4608	WaterMark.exe
4608	WaterMark.exe
4608	WaterMark.exe
4608	WaterMark.exe
4608	WaterMark.exe
4608	WaterMark.exe
4608	WaterMark.exe
4608	WaterMark.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WaterMark.exe

description pid process

Token: SeDebugPrivilege 4608 WaterMark.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

iexplore.exeiexplore.exe

pid process

1196 iexplore.exe
3528 iexplore.exe

description	pid	process
Token: SeDebugPrivilege	4608	WaterMark.exe

pid	process
1196	iexplore.exe
3528	iexplore.exe

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

iexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXE

pid	process
3528	iexplore.exe
3528	iexplore.exe
1196	iexplore.exe
1196	iexplore.exe
368	IEXPLORE.EXE
368	IEXPLORE.EXE
1712	IEXPLORE.EXE
1712	IEXPLORE.EXE
368	IEXPLORE.EXE
368	IEXPLORE.EXE

Suspicious use of UnmapMainImage 2 IoCs

Processes:

rundll32mgr.exeWaterMark.exe

pid process

6120 rundll32mgr.exe
4608 WaterMark.exe

pid	process
6120	rundll32mgr.exe
4608	WaterMark.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

rundll32.exerundll32.exerundll32mgr.exeWaterMark.exeiexplore.exeiexplore.exe

description	pid	process	target process
PID 2156 wrote to memory of 3908	2156	rundll32.exe	rundll32.exe
PID 2156 wrote to memory of 3908	2156	rundll32.exe	rundll32.exe
PID 2156 wrote to memory of 3908	2156	rundll32.exe	rundll32.exe
PID 3908 wrote to memory of 6120	3908	rundll32.exe	rundll32mgr.exe
PID 3908 wrote to memory of 6120	3908	rundll32.exe	rundll32mgr.exe
PID 3908 wrote to memory of 6120	3908	rundll32.exe	rundll32mgr.exe
PID 6120 wrote to memory of 4608	6120	rundll32mgr.exe	WaterMark.exe
PID 6120 wrote to memory of 4608	6120	rundll32mgr.exe	WaterMark.exe
PID 6120 wrote to memory of 4608	6120	rundll32mgr.exe	WaterMark.exe
PID 4608 wrote to memory of 1948	4608	WaterMark.exe	svchost.exe
PID 4608 wrote to memory of 1948	4608	WaterMark.exe	svchost.exe
PID 4608 wrote to memory of 1948	4608	WaterMark.exe	svchost.exe
PID 4608 wrote to memory of 1948	4608	WaterMark.exe	svchost.exe
PID 4608 wrote to memory of 1948	4608	WaterMark.exe	svchost.exe
PID 4608 wrote to memory of 1948	4608	WaterMark.exe	svchost.exe
PID 4608 wrote to memory of 1948	4608	WaterMark.exe	svchost.exe
PID 4608 wrote to memory of 1948	4608	WaterMark.exe	svchost.exe
PID 4608 wrote to memory of 1948	4608	WaterMark.exe	svchost.exe
PID 4608 wrote to memory of 1196	4608	WaterMark.exe	iexplore.exe
PID 4608 wrote to memory of 1196	4608	WaterMark.exe	iexplore.exe
PID 4608 wrote to memory of 3528	4608	WaterMark.exe	iexplore.exe
PID 4608 wrote to memory of 3528	4608	WaterMark.exe	iexplore.exe
PID 1196 wrote to memory of 368	1196	iexplore.exe	IEXPLORE.EXE
PID 1196 wrote to memory of 368	1196	iexplore.exe	IEXPLORE.EXE
PID 1196 wrote to memory of 368	1196	iexplore.exe	IEXPLORE.EXE
PID 3528 wrote to memory of 1712	3528	iexplore.exe	IEXPLORE.EXE
PID 3528 wrote to memory of 1712	3528	iexplore.exe	IEXPLORE.EXE
PID 3528 wrote to memory of 1712	3528	iexplore.exe	IEXPLORE.EXE

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dfa9a4c3f187e3c4a6204c2a6cb545e629864c2424ae106da9d0a9ada8eb5542.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2156

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dfa9a4c3f187e3c4a6204c2a6cb545e629864c2424ae106da9d0a9ada8eb5542.dll,#1
2⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3908

C:\Windows\SysWOW64\rundll32mgr.exe
C:\Windows\SysWOW64\rundll32mgr.exe
3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:6120

C:\Program Files (x86)\Microsoft\WaterMark.exe
"C:\Program Files (x86)\Microsoft\WaterMark.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4608

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
5⤵
PID:1948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 204
6⤵
- Program crash
PID:3580

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1196

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1196 CREDAT:17410 /prefetch:2
6⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:368

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3528

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3528 CREDAT:17410 /prefetch:2
6⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 608
3⤵
- Program crash
PID:2748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3908 -ip 3908
1⤵
PID:3500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1948 -ip 1948
1⤵
PID:2648

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{B10B7BD9-2A0B-11EF-9519-C2BABBD8D0A3}.dat
Filesize
5KB

MD5
478dafbec8fef34a9ce66f47389e213b

SHA1
e67a54bda3827f13a30a41c1264786c467128f48

SHA256
81d4c8253b45711d9e760df8cc11c4fb118d4ee4b3bc65e0914fe1eea7817383

SHA512
e009487f00d6181f754a2b12ae37ab690ef16d88d091c6ab81a5ded70beb983924f5978f9236a1fad9b8a567086a10cd9f41fad26841026b9f2fa15cfe0b17b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{B10DDDB0-2A0B-11EF-9519-C2BABBD8D0A3}.dat
Filesize
3KB

MD5
892278f063f6151ee13a348aceb173c1

SHA1
20b1284d1ea4c0b0784eeed23174820516fde0b6

SHA256
4f31cf43dc2b705ce68da55be4369f0b2e7a3b20203e036361435bb766c3665d

SHA512
09fa31bb81fb17a70f4a19f2a43a19e30bf66af4f392a34c4e5c9309fafcf38485e84dab39ae327639bfb9a4b3020fb35d8ec0bcb31412ec231a6e797e8871b0

Download Submit
C:\Windows\SysWOW64\rundll32mgr.exe
Filesize
123KB

MD5
41cdf1d40aff3f71114ea210307b6a1c

SHA1
8d5237ed7a29003af5b857edd85f7f54a91f600c

SHA256
00ba79fa51af9b735ebbded72313232d83956c922e206362f9b71411772162b7

SHA512
fdcba01191a345416f17fb4024255f97af135824f1ce57bb8456d74fbfd0e37f89500aeb92c19c4add62e6cb416c57cd06b2aee310fabb91e468852ca062ff0e

Download Submit
memory/1948-33-0x0000000000730000-0x0000000000731000-memory.dmp

Filesize
4KB

Download
memory/1948-34-0x0000000000710000-0x0000000000711000-memory.dmp

Filesize
4KB

Download
memory/3908-1-0x0000000010000000-0x0000000010081000-memory.dmp

Filesize
516KB

Download
memory/3908-35-0x0000000010000000-0x0000000010081000-memory.dmp

Filesize
516KB

Download
memory/4608-40-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4608-31-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/4608-30-0x0000000077372000-0x0000000077373000-memory.dmp

Filesize
4KB

Download
memory/4608-29-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4608-27-0x0000000000430000-0x0000000000431000-memory.dmp

Filesize
4KB

Download
memory/4608-37-0x0000000077372000-0x0000000077373000-memory.dmp

Filesize
4KB

Download
memory/4608-36-0x0000000000070000-0x0000000000071000-memory.dmp

Filesize
4KB

Download
memory/6120-13-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/6120-6-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/6120-10-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/6120-11-0x00000000008D0000-0x00000000008D1000-memory.dmp

Filesize
4KB

Download
memory/6120-12-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/6120-16-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/6120-8-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/6120-7-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/6120-5-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads