ramnit | f7a84da4c7b62341792dba8083827f0b573e0c1aabf5f7786fab2215c82372e8

General

Target

fdcb8216e9c6763907ccf52effdebd9f_JaffaCakes118.exe
Size

226KB
MD5

fdcb8216e9c6763907ccf52effdebd9f
SHA1

94a6b4810b321ee70bd7540fbe58d26cde1e07ef
SHA256

f7a84da4c7b62341792dba8083827f0b573e0c1aabf5f7786fab2215c82372e8
SHA512

0e32a961cccbc214dd3eaf32cc5c3fe80eacc291919544fce1dd5e6a6a48d1334c28ce62cfc7f4490ad3d082fdc46eab9fa954cf5d169bcc539ca98e88ef043f
SSDEEP

6144:4h5kT3r2Dnua7TK3XCk6+oGMJEEoPNbsTUfL36AK:4Hkj0ECkkGmEDUUfL3HK

Score

10^/10

ramnit banker discovery persistence spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	fdcb8216e9c6763907ccf52effdebd9f_JaffaCakes118.exe

Deletes itself 1 IoCs

pid	Process
624	lsass.exe

Executes dropped EXE 4 IoCs

pid	Process
3580	fdcb8216e9c6763907ccf52effdebd9f_JaffaCakes118mgr.exe
4092	lsass.exe
2232	lsassmgr.exe
624	lsass.exe

Loads dropped DLL 2 IoCs

pid	Process
3580	fdcb8216e9c6763907ccf52effdebd9f_JaffaCakes118mgr.exe
2232	lsassmgr.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RTHDBPL = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fdcb8216e9c6763907ccf52effdebd9f_JaffaCakes118.exe"	fdcb8216e9c6763907ccf52effdebd9f_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RTHDBPL = "C:\\Users\\Admin\\AppData\\Roaming\\SystemProc\\lsass.exe"	lsass.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1524 set thread context of 3600	1524	fdcb8216e9c6763907ccf52effdebd9f_JaffaCakes118.exe	83
PID 4092 set thread context of 624	4092	lsass.exe	89

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1524-0-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral2/memory/3600-9-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/memory/3580-11-0x0000000000400000-0x0000000000460000-memory.dmp	upx
behavioral2/memory/3600-14-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/memory/3600-20-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/memory/3600-13-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/memory/3600-12-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/memory/3600-7-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/memory/1524-22-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral2/files/0x00080000000234e5-28.dat	upx
behavioral2/memory/3600-84-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/memory/624-106-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/memory/4092-111-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral2/memory/624-105-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/memory/624-104-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/memory/624-103-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/memory/624-96-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/memory/624-95-0x0000000000400000-0x0000000000422000-memory.dmp	upx

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Mozilla Firefox\extensions\{9CE11043-9A15-4207-A565-0C94C42D590D}\install.rdf	fdcb8216e9c6763907ccf52effdebd9f_JaffaCakes118.exe
File created	C:\Program Files (x86)\Mozilla Firefox\extensions\{9CE11043-9A15-4207-A565-0C94C42D590D}\chrome.manifest	fdcb8216e9c6763907ccf52effdebd9f_JaffaCakes118.exe
File created	C:\Program Files (x86)\Mozilla Firefox\extensions\{9CE11043-9A15-4207-A565-0C94C42D590D}\chrome\content\timer.xul	fdcb8216e9c6763907ccf52effdebd9f_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Mozilla Firefox\extensions\{9CE11043-9A15-4207-A565-0C94C42D590D}\install.rdf	lsass.exe
File opened for modification	C:\Program Files (x86)\Mozilla Firefox\extensions\{9CE11043-9A15-4207-A565-0C94C42D590D}\chrome.manifest	lsass.exe
File opened for modification	C:\Program Files (x86)\Mozilla Firefox\extensions\{9CE11043-9A15-4207-A565-0C94C42D590D}\chrome\content\timer.xul	lsass.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2856	3580	WerFault.exe	82
2060	2232	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdcb8216e9c6763907ccf52effdebd9f_JaffaCakes118mgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdcb8216e9c6763907ccf52effdebd9f_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsassmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdcb8216e9c6763907ccf52effdebd9f_JaffaCakes118.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	fdcb8216e9c6763907ccf52effdebd9f_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1524	fdcb8216e9c6763907ccf52effdebd9f_JaffaCakes118.exe
4092	lsass.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 3580	1524	fdcb8216e9c6763907ccf52effdebd9f_JaffaCakes118.exe	82
PID 1524 wrote to memory of 3580	1524	fdcb8216e9c6763907ccf52effdebd9f_JaffaCakes118.exe	82
PID 1524 wrote to memory of 3580	1524	fdcb8216e9c6763907ccf52effdebd9f_JaffaCakes118.exe	82
PID 1524 wrote to memory of 3600	1524	fdcb8216e9c6763907ccf52effdebd9f_JaffaCakes118.exe	83
PID 1524 wrote to memory of 3600	1524	fdcb8216e9c6763907ccf52effdebd9f_JaffaCakes118.exe	83
PID 1524 wrote to memory of 3600	1524	fdcb8216e9c6763907ccf52effdebd9f_JaffaCakes118.exe	83
PID 1524 wrote to memory of 3600	1524	fdcb8216e9c6763907ccf52effdebd9f_JaffaCakes118.exe	83
PID 1524 wrote to memory of 3600	1524	fdcb8216e9c6763907ccf52effdebd9f_JaffaCakes118.exe	83
PID 1524 wrote to memory of 3600	1524	fdcb8216e9c6763907ccf52effdebd9f_JaffaCakes118.exe	83
PID 1524 wrote to memory of 3600	1524	fdcb8216e9c6763907ccf52effdebd9f_JaffaCakes118.exe	83
PID 1524 wrote to memory of 3600	1524	fdcb8216e9c6763907ccf52effdebd9f_JaffaCakes118.exe	83
PID 3600 wrote to memory of 4092	3600	fdcb8216e9c6763907ccf52effdebd9f_JaffaCakes118.exe	87
PID 3600 wrote to memory of 4092	3600	fdcb8216e9c6763907ccf52effdebd9f_JaffaCakes118.exe	87
PID 3600 wrote to memory of 4092	3600	fdcb8216e9c6763907ccf52effdebd9f_JaffaCakes118.exe	87
PID 4092 wrote to memory of 2232	4092	lsass.exe	88
PID 4092 wrote to memory of 2232	4092	lsass.exe	88
PID 4092 wrote to memory of 2232	4092	lsass.exe	88
PID 4092 wrote to memory of 624	4092	lsass.exe	89
PID 4092 wrote to memory of 624	4092	lsass.exe	89
PID 4092 wrote to memory of 624	4092	lsass.exe	89
PID 4092 wrote to memory of 624	4092	lsass.exe	89
PID 4092 wrote to memory of 624	4092	lsass.exe	89
PID 4092 wrote to memory of 624	4092	lsass.exe	89
PID 4092 wrote to memory of 624	4092	lsass.exe	89
PID 4092 wrote to memory of 624	4092	lsass.exe	89

C:\Users\Admin\AppData\Local\Temp\fdcb8216e9c6763907ccf52effdebd9f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fdcb8216e9c6763907ccf52effdebd9f_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Users\Admin\AppData\Local\Temp\fdcb8216e9c6763907ccf52effdebd9f_JaffaCakes118mgr.exe
  C:\Users\Admin\AppData\Local\Temp\fdcb8216e9c6763907ccf52effdebd9f_JaffaCakes118mgr.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3580
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 10168
    3⤵
    - Program crash
    PID:2856
- C:\Users\Admin\AppData\Local\Temp\fdcb8216e9c6763907ccf52effdebd9f_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\fdcb8216e9c6763907ccf52effdebd9f_JaffaCakes118.exe
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3600
- - C:\Users\Admin\AppData\Roaming\SystemProc\lsass.exe
    "C:\Users\Admin\AppData\Roaming\SystemProc\lsass.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4092
  - - C:\Users\Admin\AppData\Roaming\SystemProc\lsassmgr.exe
      C:\Users\Admin\AppData\Roaming\SystemProc\lsassmgr.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:2232
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 10168
        5⤵
        Program crash
        
        PID:2060
  - - C:\Users\Admin\AppData\Roaming\SystemProc\lsass.exe
      C:\Users\Admin\AppData\Roaming\SystemProc\lsass.exe
      4⤵
      Deletes itself
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      PID:624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3580 -ip 3580
1⤵
PID:4876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2232 -ip 2232
1⤵
PID:4244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Mozilla Firefox\extensions\{9CE11043-9A15-4207-A565-0C94C42D590D}\chrome.manifest

Filesize
151B

MD5
2fa89bb5ec500c62cc40d5a46a6a8cd3

SHA1
ab2c5fed92fb203ff7ca8b3353a9e086377afebd

SHA256
bbcea744c5edfaf49d50a046051338c2fc75fd12247ae5997b9967fe3f454543

SHA512
41299af72f3f78bd1d82423e36272bcde20441254402b5776537de2d5061d125f80f65bbee07bf5d1609003a784f85caf0e4cadbf91782737ea4aa58a0c51e59

Download Submit
C:\Program Files (x86)\Mozilla Firefox\extensions\{9CE11043-9A15-4207-A565-0C94C42D590D}\chrome\content\timer.xul

Filesize
1KB

MD5
888536379d53c4a65132ce4732bd35bc

SHA1
4f92d7d3f9b4ad25bd63310ef6cacda73e5212e5

SHA256
bd2361e7e843948b144686f021e0b08c88d41d4305365b88119f68685a9f9e55

SHA512
f2c1022d0a094f1ba8940661d2cba128ec0df3de5159c309f6703e3db7fba49310e70553ea88c5c7dd561d74796cac0a78b077a790f0e287897d51f301900380

Download Submit
C:\Program Files (x86)\Mozilla Firefox\extensions\{9CE11043-9A15-4207-A565-0C94C42D590D}\install.rdf

Filesize
773B

MD5
f3551a2c70b1a421f0ddf9306d92a1a0

SHA1
0dd06c1df1152d7e89eb01651c7fa705f1a40b68

SHA256
e963dd65572b7d222abeae3e4829aaa771705ed81d5698262b57453b8e71967c

SHA512
abfbe2583cfd003f63140fcd1a32c30923fc0be92e0d57f2207e2788f165f5f27003ea7d08ed5ca9b3cf47c27ee162ca5145dd23cfc85d30a062352210be0098

Download Submit
C:\Users\Admin\AppData\Local\Temp\fdcb8216e9c6763907ccf52effdebd9f_JaffaCakes118mgr.exe

Filesize
145KB

MD5
e48d2ddcc94662f0f2c9b755ff3cdbbf

SHA1
e8f2ac27485f14f71de0ca89cab37d13cfbef312

SHA256
5515536ad41cbb569c64a68afe33357a496fac3951fa13ee61d235d9ebe4aceb

SHA512
e49f9546620713440b1f7b7ada543334d4ee9cdd908ce90a040c0670cc80299b32de45e46dc78d79aeec85cfadbb7a0a87835444919b39324b3644e02476ccaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\~TMAE80.tmp

Filesize
1.6MB

MD5
4f3387277ccbd6d1f21ac5c07fe4ca68

SHA1
e16506f662dc92023bf82def1d621497c8ab5890

SHA256
767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

SHA512
9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

Download Submit
C:\Users\Admin\AppData\Roaming\SystemProc\lsass.exe

Filesize
226KB

MD5
fdcb8216e9c6763907ccf52effdebd9f

SHA1
94a6b4810b321ee70bd7540fbe58d26cde1e07ef

SHA256
f7a84da4c7b62341792dba8083827f0b573e0c1aabf5f7786fab2215c82372e8

SHA512
0e32a961cccbc214dd3eaf32cc5c3fe80eacc291919544fce1dd5e6a6a48d1334c28ce62cfc7f4490ad3d082fdc46eab9fa954cf5d169bcc539ca98e88ef043f

Download Submit
memory/624-106-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/624-95-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/624-96-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/624-103-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/624-104-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/624-105-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1524-22-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1524-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3580-11-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/3600-84-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/3600-7-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/3600-12-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/3600-13-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/3600-20-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/3600-14-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/3600-9-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4092-111-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads