ramnit | 311c9bde638057fc78ec710f52d5ad0fa36d171942e68bcbcb68457640c6caae

Analysis

max time kernel
134s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240910-en
resource tags

arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2024, 02:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1173f3f4ac013c5df66e81f021ae88f0_JaffaCakes118.exe
Size 248KB
Sample241004-cw2b1azbmp
SHA256 311c9bde638057fc78ec710f52d5ad0fa36d171942e68bcbcb68457640c6caae
MD5 1173f3f4ac013c5df66e81f021ae88f0
SHA1 33b1e9bb4f513ad40bb7da661aea0e3fbafacf45
SHA512 481bc9041ad3c655cacad7146853960e1b9ee0cac12dd6f579101339ad65e9a5ef1b147cc95ffffc2bfcd24d6cdfb33e30b0dc657342d2b61406adc4aa9fc9d2
SSDEEP 6144:z8vLbNYSKXgyooSy8ATt5dUsZrZXG0GP+Rg1f6oeAVONjaTLsthm:I+SKXgHoSot0wdXG7+RgniNdrm
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ramnit banker discovery spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Executes dropped EXE 1 IoCs

pid	Process
2212	1173f3f4ac013c5df66e81f021ae88f0_JaffaCakes118mgr.exe

Loads dropped DLL 1 IoCs

pid	Process
2212	1173f3f4ac013c5df66e81f021ae88f0_JaffaCakes118mgr.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2224-0-0x0000000000400000-0x0000000000463000-memory.dmp	upx
behavioral2/memory/2224-15-0x0000000000400000-0x0000000000463000-memory.dmp	upx
behavioral2/memory/2224-16-0x0000000000400000-0x0000000000463000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3952	2212	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1173f3f4ac013c5df66e81f021ae88f0_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1173f3f4ac013c5df66e81f021ae88f0_JaffaCakes118mgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2224	1173f3f4ac013c5df66e81f021ae88f0_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2212	2224	1173f3f4ac013c5df66e81f021ae88f0_JaffaCakes118.exe	84
PID 2224 wrote to memory of 2212	2224	1173f3f4ac013c5df66e81f021ae88f0_JaffaCakes118.exe	84
PID 2224 wrote to memory of 2212	2224	1173f3f4ac013c5df66e81f021ae88f0_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\1173f3f4ac013c5df66e81f021ae88f0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1173f3f4ac013c5df66e81f021ae88f0_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Users\Admin\AppData\Local\Temp\1173f3f4ac013c5df66e81f021ae88f0_JaffaCakes118mgr.exe
  C:\Users\Admin\AppData\Local\Temp\1173f3f4ac013c5df66e81f021ae88f0_JaffaCakes118mgr.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2212
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 376
    3⤵
    - Program crash
    PID:3952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2212 -ip 2212
1⤵
PID:3568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1173f3f4ac013c5df66e81f021ae88f0_JaffaCakes118mgr.exe

Path C:\Users\Admin\AppData\Local\Temp\1173f3f4ac013c5df66e81f021ae88f0_JaffaCakes118mgr.exe
Size 153KB
SHA256 760d5dffc9839deeff5346c38ab39be2b67deb8d7b87c9a290d78133f2ec4bd0
MD5 e84cad1ecbe3a05244060b9f546b2632
SHA1 46db86aa7f8f90de9a26dd61c22fe64701d2aa5d
SHA512 47383ec8ecbd285aedfa787386f9412a6e857dbdb385f17187aa8f81ec3429051649a3931bc0788c992050706108b9507a1257100658baeb16add2a0aec094e9
SSDEEP 3072:DjKw5VgbUtY7sT1Meg1re9/YfH4Fv8iV/3X2sHpEcLhpCNuCqLRkFXb/ymIKk++b:Dj9LAsZ5RYfivmsHpV2Nu0u7b
MD5 SHA1 SHA512 SSDEEP

Submit Download

~TMD793.tmp

Path C:\Users\Admin\AppData\Local\Temp\~TMD793.tmp
Size 1.6MB
SHA256 767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
MD5 4f3387277ccbd6d1f21ac5c07fe4ca68
SHA1 e16506f662dc92023bf82def1d621497c8ab5890
SHA512 9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
SSDEEP 24576:qhYK3o0FvOh/e8AuDq8TJqbEPVVdqi90gvuPGO12HoIGTufqN8:2XFvO5egq8TMbEL59JCKSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2212-5-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/2212-7-0x00000000005B0000-0x00000000005B2000-memory.dmp

Download

memory/2212-13-0x00000000772B2000-0x00000000772B3000-memory.dmp

Download

memory/2212-12-0x00000000772B2000-0x00000000772B4000-memory.dmp

Download

memory/2212-14-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/2224-0-0x0000000000400000-0x0000000000463000-memory.dmp

Download

memory/2224-15-0x0000000000400000-0x0000000000463000-memory.dmp

Download

memory/2224-16-0x0000000000400000-0x0000000000463000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads