ramnit | ecce415d0974cd67ac46a51c84e22dd81e1151798cd68559cc7da4b225d35050

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
25-06-2024 09:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
Size

350KB
MD5

0d8c7dcb38a6c7acd68888068affea4c
SHA1

e98a1da677454fcbbfc4dd03f1fc2b9554b6c692
SHA256

ecce415d0974cd67ac46a51c84e22dd81e1151798cd68559cc7da4b225d35050
SHA512

74473b1cd96919e2899d54f84d2fca08f6e46476cdcb6fa36034b3e614a7abdfc8a09cfce18fc067ee7e04b420429d23e7a50b5066758689328b8ea18995cf5a
SSDEEP

6144:HR2J0LS6Vymc0FWOp+NtumIjekkvhF1UpK3usidA9pVie:HRm0Oqy/6VIryjekkyYziS9ie

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Executes dropped EXE 1 IoCs

pid	Process
2412	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118mgr.exe

Loads dropped DLL 2 IoCs

pid	Process
2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2960-14-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2960-13-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2960-12-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2960-11-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2960-21-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2412-37-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2960-28-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2960-20-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2960-15-0x0000000000430000-0x0000000000470000-memory.dmp	upx

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\WaterMark.exe	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px7511.tmp	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118mgr.exe
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118mgr.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px7501.tmp	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe

Suspicious behavior: MapViewOfSection 22 IoCs

pid	Process
2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
2412	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118mgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 2412	2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	28
PID 2960 wrote to memory of 2412	2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	28
PID 2960 wrote to memory of 2412	2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	28
PID 2960 wrote to memory of 2412	2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	28
PID 2960 wrote to memory of 368	2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	3
PID 2960 wrote to memory of 368	2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	3
PID 2960 wrote to memory of 368	2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	3
PID 2960 wrote to memory of 368	2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	3
PID 2960 wrote to memory of 368	2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	3
PID 2960 wrote to memory of 368	2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	3
PID 2960 wrote to memory of 368	2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	3
PID 2960 wrote to memory of 384	2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	4
PID 2960 wrote to memory of 384	2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	4
PID 2960 wrote to memory of 384	2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	4
PID 2960 wrote to memory of 384	2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	4
PID 2960 wrote to memory of 384	2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	4
PID 2960 wrote to memory of 384	2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	4
PID 2960 wrote to memory of 384	2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	4
PID 2960 wrote to memory of 420	2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	5
PID 2960 wrote to memory of 420	2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	5
PID 2960 wrote to memory of 420	2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	5
PID 2960 wrote to memory of 420	2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	5
PID 2960 wrote to memory of 420	2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	5
PID 2960 wrote to memory of 420	2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	5
PID 2960 wrote to memory of 420	2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	5
PID 2960 wrote to memory of 468	2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	6
PID 2960 wrote to memory of 468	2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	6
PID 2960 wrote to memory of 468	2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	6
PID 2960 wrote to memory of 468	2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	6
PID 2960 wrote to memory of 468	2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	6
PID 2960 wrote to memory of 468	2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	6
PID 2960 wrote to memory of 468	2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	6
PID 2960 wrote to memory of 476	2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	7
PID 2960 wrote to memory of 476	2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	7
PID 2960 wrote to memory of 476	2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	7
PID 2960 wrote to memory of 476	2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	7
PID 2960 wrote to memory of 476	2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	7
PID 2960 wrote to memory of 476	2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	7
PID 2960 wrote to memory of 476	2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	7
PID 2960 wrote to memory of 484	2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	8
PID 2960 wrote to memory of 484	2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	8
PID 2960 wrote to memory of 484	2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	8
PID 2960 wrote to memory of 484	2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	8
PID 2960 wrote to memory of 484	2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	8
PID 2960 wrote to memory of 484	2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	8
PID 2960 wrote to memory of 484	2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	8
PID 2960 wrote to memory of 584	2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	9
PID 2960 wrote to memory of 584	2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	9
PID 2960 wrote to memory of 584	2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	9
PID 2960 wrote to memory of 584	2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	9
PID 2960 wrote to memory of 584	2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	9
PID 2960 wrote to memory of 584	2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	9
PID 2960 wrote to memory of 584	2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	9
PID 2960 wrote to memory of 660	2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	10
PID 2960 wrote to memory of 660	2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	10
PID 2960 wrote to memory of 660	2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	10
PID 2960 wrote to memory of 660	2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	10
PID 2960 wrote to memory of 660	2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	10
PID 2960 wrote to memory of 660	2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	10
PID 2960 wrote to memory of 660	2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	10
PID 2960 wrote to memory of 728	2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	11
PID 2960 wrote to memory of 728	2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	11
PID 2960 wrote to memory of 728	2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	11
PID 2960 wrote to memory of 728	2960	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	11

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:368
- C:\Windows\system32\services.exe
  C:\Windows\system32\services.exe
  2⤵
  PID:468
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    3⤵
    PID:584
  - - C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
      4⤵
      PID:804
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    3⤵
    PID:660
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    3⤵
    PID:728
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    3⤵
    PID:796
  - - C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      4⤵
      PID:1152
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    3⤵
    PID:824
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService
    3⤵
    PID:976
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    3⤵
    PID:272
- - C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    3⤵
    PID:112
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    3⤵
    PID:1056
- - C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    3⤵
    PID:1096
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    3⤵
    PID:2360
- - C:\Windows\system32\sppsvc.exe
    C:\Windows\system32\sppsvc.exe
    3⤵
    PID:2052
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:476
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:484

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:384

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1192
- C:\Users\Admin\AppData\Local\Temp\0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:2960
- - C:\Users\Admin\AppData\Local\Temp\0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118mgr.exe
    C:\Users\Admin\AppData\Local\Temp\0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118mgr.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious use of UnmapMainImage
    PID:2412

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRAM FILES (X86)\MICROSOFT\WATERMARK.EXE

Filesize
350KB

MD5
0d8c7dcb38a6c7acd68888068affea4c

SHA1
e98a1da677454fcbbfc4dd03f1fc2b9554b6c692

SHA256
ecce415d0974cd67ac46a51c84e22dd81e1151798cd68559cc7da4b225d35050

SHA512
74473b1cd96919e2899d54f84d2fca08f6e46476cdcb6fa36034b3e614a7abdfc8a09cfce18fc067ee7e04b420429d23e7a50b5066758689328b8ea18995cf5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118mgr.exe

Filesize
174KB

MD5
8779e16628d36aa1e10bba1bab317b91

SHA1
64828826d7b3732146859fb4ce59fedc9f2afd46

SHA256
e6def756bcb57ce2924031f2470b7f7dc221154be65942951e4f9abc29702e66

SHA512
9fe00af2f4ef24d3cf4e5343f79806763265bb734bcd19c4f514b573eb86eb291b4690ce5613dac06976be0b6d24af7da5ee2045a6c0530e2faa85a4df31a7aa

Download Submit
memory/2412-38-0x000000007EFA0000-0x000000007EFAC000-memory.dmp

Filesize
48KB

Download
memory/2412-36-0x0000000000416000-0x0000000000420000-memory.dmp

Filesize
40KB

Download
memory/2412-16-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2412-37-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2960-11-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2960-29-0x0000000000416000-0x0000000000420000-memory.dmp

Filesize
40KB

Download
memory/2960-21-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2960-9-0x0000000000360000-0x0000000000398000-memory.dmp

Filesize
224KB

Download
memory/2960-1-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/2960-12-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2960-30-0x0000000000401000-0x0000000000416000-memory.dmp

Filesize
84KB

Download
memory/2960-8-0x0000000000360000-0x0000000000398000-memory.dmp

Filesize
224KB

Download
memory/2960-28-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2960-20-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2960-19-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/2960-18-0x0000000076F30000-0x0000000076F31000-memory.dmp

Filesize
4KB

Download
memory/2960-17-0x0000000076F2F000-0x0000000076F30000-memory.dmp

Filesize
4KB

Download
memory/2960-13-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2960-14-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2960-15-0x0000000000430000-0x0000000000470000-memory.dmp

Filesize
256KB

Download