ramnit | 5df350657eedcff52b60a9aa497fa19cffefe140b54ba9b23fa299111fdbf1fe

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 20:16

Target

0f61ca8106f401101ef017bd831372f8_JaffaCakes118.dll
Size

292KB
MD5

0f61ca8106f401101ef017bd831372f8
SHA1

4bed4d81cb96041910ce33964df18b8b28779e08
SHA256

5df350657eedcff52b60a9aa497fa19cffefe140b54ba9b23fa299111fdbf1fe
SHA512

efccf0e5821cded5f9c9adea1692f0196204e6eacf57fd4425cf966a7a73e6ac6e94ac8d05003132331edaa331371c96bf0c387e4932a9624fc8c7889b12a8b9
SSDEEP

6144:V0D3yTjQbErlrUJV6RhxNQBDOi5uHStL6XZW8b:GD3Kj5rlaIRqwHStLEIW

Score

10^/10

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Executes dropped EXE 1 IoCs

pid	Process
2952	rundll32mgr.exe

Loads dropped DLL 4 IoCs

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2952-12-0x0000000000400000-0x000000000047F000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 1952	2880	rundll32.exe	28
PID 2880 wrote to memory of 1952	2880	rundll32.exe	28
PID 2880 wrote to memory of 1952	2880	rundll32.exe	28
PID 2880 wrote to memory of 1952	2880	rundll32.exe	28
PID 2880 wrote to memory of 1952	2880	rundll32.exe	28
PID 2880 wrote to memory of 1952	2880	rundll32.exe	28
PID 2880 wrote to memory of 1952	2880	rundll32.exe	28
PID 1952 wrote to memory of 2952	1952	rundll32.exe	29
PID 1952 wrote to memory of 2952	1952	rundll32.exe	29
PID 1952 wrote to memory of 2952	1952	rundll32.exe	29
PID 1952 wrote to memory of 2952	1952	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f61ca8106f401101ef017bd831372f8_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f61ca8106f401101ef017bd831372f8_JaffaCakes118.dll,#1
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1952
- - C:\Windows\SysWOW64\rundll32mgr.exe
    C:\Windows\SysWOW64\rundll32mgr.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2952
  - - C:\Users\Admin\AppData\Local\Temp\tdrwkngw.exe
      C:\Users\Admin\AppData\Local\Temp\tdrwkngw.exe
      4⤵
      PID:2248

\Users\Admin\AppData\Local\Temp\~TM11CC.tmp

Filesize
1.2MB

MD5
d124f55b9393c976963407dff51ffa79

SHA1
2c7bbedd79791bfb866898c85b504186db610b5d

SHA256
ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef

SHA512
278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06

Download Submit
\Users\Admin\AppData\Local\Temp\~TM122B.tmp

Filesize
1.1MB

MD5
9b98d47916ead4f69ef51b56b0c2323c

SHA1
290a80b4ded0efc0fd00816f373fcea81a521330

SHA256
96e0ae104c9662d0d20fdf59844c2d18334e5847b6c4fc7f8ce4b3b87f39887b

SHA512
68b67021f228d8d71df4deb0b6388558b2f935a6aa466a12199cd37ada47ee588ea407b278d190d3a498b0ef3f5f1a2573a469b7ea5561ab2e7055c45565fe94

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
160KB

MD5
51a7b8e6dde65bdc6db16675e8e4efb2

SHA1
04be1eef924fe57a3a2f9a93dd1458283366242f

SHA256
a9c5a28460510e5a620bb2683361b899928730b34534e5774c0221081c15d4ce

SHA512
ee7fcc988ae337548e04595f574f1c68d3f2e80020d4e7be6a9dea967ad18f3262c8eced03e6ee914d248e4a51e58190ad9a761f7ad97dda7aee8531511306e2

Download Submit
memory/1952-1-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/1952-2-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/2952-11-0x0000000001FA0000-0x0000000002090000-memory.dmp

Filesize
960KB

Download
memory/2952-12-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download