ramnit | 0b8c9a303a6431429e1ff08cdfac18fd5564cc8028ca59e735d5e9df15745593 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2f54004f7c1074e201d7c755893aec3f_JaffaCakes118
Size

293KB
Sample

240709-hd8k9atale
MD5

2f54004f7c1074e201d7c755893aec3f
SHA1

49eb89a4d612adb62897ff9272cc7dd80e5327bf
SHA256

0b8c9a303a6431429e1ff08cdfac18fd5564cc8028ca59e735d5e9df15745593
SHA512

9e52d51f8b3ec7f527d51b8fa2c96228992d394596db38ca6b45a40fd0fc381c3b54cea8ab8fb9e2e802728ea3c8c88f597c8936cafc8f4d4acc6483b475eb58
SSDEEP

6144:A26lQFyAn0+mMDhFDIO1kbcG4GBMELGJO:16y/0+dDhMbcfGz

Score

10^/10

ramnit banker defense_evasion evasion persistence spyware stealer trojan worm

Malware Config

Targets

- Target
  
  2f54004f7c1074e201d7c755893aec3f_JaffaCakes118
- Size
  
  293KB
- MD5
  
  2f54004f7c1074e201d7c755893aec3f
- SHA1
  
  49eb89a4d612adb62897ff9272cc7dd80e5327bf
- SHA256
  
  0b8c9a303a6431429e1ff08cdfac18fd5564cc8028ca59e735d5e9df15745593
- SHA512
  
  9e52d51f8b3ec7f527d51b8fa2c96228992d394596db38ca6b45a40fd0fc381c3b54cea8ab8fb9e2e802728ea3c8c88f597c8936cafc8f4d4acc6483b475eb58
- SSDEEP
  
  6144:A26lQFyAn0+mMDhFDIO1kbcG4GBMELGJO:16y/0+dDhMbcfGz
Score

10^/10

ramnit banker defense_evasion evasion persistence spyware stealer trojan worm
- Modifies WinLogon for persistence
  persistence
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- UAC bypass
  evasion trojan
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
  defense_evasion
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Safe Mode Boot

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ramnitbankerdefense_evasionevasionpersistencespywarestealertrojanworm

behavioral2

ramnitbankerspywarestealertrojanworm