ramnit | 0a07d0604f689d0fc9515e504205d6319383b9f8f2c88d9b016ff1ef529e2ff7

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-12-2024 07:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a07d0604f689d0fc9515e504205d6319383b9f8f2c88d9b016ff1ef529e2ff7.dll
Size

112KB
MD5

2f12368e4bc1bb72fceff8d4c8aafc91
SHA1

91a0d2ee6d39ef598c1f8fd154fceb145e4a0a2e
SHA256

0a07d0604f689d0fc9515e504205d6319383b9f8f2c88d9b016ff1ef529e2ff7
SHA512

c48af5b89f241edc3380f2fc524f7e59f6a764566ce5351dcdff73bff2b9b80bef139f1b552201ce78d7400bab756e59c812a22f2068dbc599f423083d5bd5a3
SSDEEP

1536:fwKq8q9fvGBgjwtjKmbWvPnkEaH9KoMlftStqnvjI997F33W5sf1m:IKkvGB5t2mbX9wt8/5Gmf1m

Score

10^/10

ramnit banker discovery spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Ramnit family
ramnit

Executes dropped EXE 2 IoCs

pid	Process
2552	rundll32Srv.exe
2720	DesktopLayer.exe

Loads dropped DLL 2 IoCs

pid	Process
2640	rundll32.exe
2552	rundll32Srv.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32Srv.exe	rundll32.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000b0000000120f6-2.dat	upx
behavioral1/memory/2552-15-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2720-25-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2552-11-0x0000000000400000-0x000000000042E000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\px47BA.tmp	rundll32Srv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	rundll32Srv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	rundll32Srv.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32Srv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopLayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5E6EDCB1-B793-11EF-A5CD-E699F793024F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "440064772"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2720	DesktopLayer.exe
2720	DesktopLayer.exe
2720	DesktopLayer.exe
2720	DesktopLayer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2588	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2588	iexplore.exe
2588	iexplore.exe
2424	IEXPLORE.EXE
2424	IEXPLORE.EXE
2424	IEXPLORE.EXE
2424	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 2640	2132	rundll32.exe	28
PID 2132 wrote to memory of 2640	2132	rundll32.exe	28
PID 2132 wrote to memory of 2640	2132	rundll32.exe	28
PID 2132 wrote to memory of 2640	2132	rundll32.exe	28
PID 2132 wrote to memory of 2640	2132	rundll32.exe	28
PID 2132 wrote to memory of 2640	2132	rundll32.exe	28
PID 2132 wrote to memory of 2640	2132	rundll32.exe	28
PID 2640 wrote to memory of 2552	2640	rundll32.exe	29
PID 2640 wrote to memory of 2552	2640	rundll32.exe	29
PID 2640 wrote to memory of 2552	2640	rundll32.exe	29
PID 2640 wrote to memory of 2552	2640	rundll32.exe	29
PID 2552 wrote to memory of 2720	2552	rundll32Srv.exe	30
PID 2552 wrote to memory of 2720	2552	rundll32Srv.exe	30
PID 2552 wrote to memory of 2720	2552	rundll32Srv.exe	30
PID 2552 wrote to memory of 2720	2552	rundll32Srv.exe	30
PID 2720 wrote to memory of 2588	2720	DesktopLayer.exe	31
PID 2720 wrote to memory of 2588	2720	DesktopLayer.exe	31
PID 2720 wrote to memory of 2588	2720	DesktopLayer.exe	31
PID 2720 wrote to memory of 2588	2720	DesktopLayer.exe	31
PID 2588 wrote to memory of 2424	2588	iexplore.exe	32
PID 2588 wrote to memory of 2424	2588	iexplore.exe	32
PID 2588 wrote to memory of 2424	2588	iexplore.exe	32
PID 2588 wrote to memory of 2424	2588	iexplore.exe	32

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0a07d0604f689d0fc9515e504205d6319383b9f8f2c88d9b016ff1ef529e2ff7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0a07d0604f689d0fc9515e504205d6319383b9f8f2c88d9b016ff1ef529e2ff7.dll,#1
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2640
- - C:\Windows\SysWOW64\rundll32Srv.exe
    C:\Windows\SysWOW64\rundll32Srv.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2552
  - - C:\Program Files (x86)\Microsoft\DesktopLayer.exe
      "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2720
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2588
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2588 CREDAT:275457 /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
58013ba8c49e8dcd6d072d88d2ff25a5

SHA1
0aaea911acee8d4ff1f00063e02f5c4f5cf690bd

SHA256
04702a64a6552cc4d9862d945fef1b54aba4b2115b934401478b8a2a42dd329a

SHA512
3d864e2178787aee2525478f1d4d74d4a825436e7f469aba44fc51b6f72f06f746c191b25f611ae096be8083822f0f8b6cc2320dff14c917525a48c39dd19215

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
728f4612b0a665e27a49d98e65b6bf74

SHA1
10f52c7af615bb3cc0d9302aea1b98cdd8b20e73

SHA256
342fea00ff0a8f90d9d0e2cd82b95438e7c2fb0afbe2779e40cd4d63410837c5

SHA512
a9bc0ab1a6dfea616079088e8436c7b8a3bb43fc69a2d1d642d6a4d9f758080ec18af86925ceddcdec644130f9262a9840edb7690ce57f56b2ca85c42758ffdf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e470062b757abd408b70c94a571e517

SHA1
c04461252fa1e02395d48c2ea5f2d1dd13dea13a

SHA256
dff35f33caeed5ee57da3fa91ddd38a0dabdbd10b10bc8ba295f5bd7cd1c72d0

SHA512
5ece1b9db069016e764aa1dffdfb903d0133471205a0c898e3d732309cc178b1f2c416b6654c62f4f1f851174801af9fa75fbe2a454de94d80123d986ce699ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9d33bf99e8200274f522dd6826c9983d

SHA1
0f543de8ec9e33d02929aee30a6d91782ae761c7

SHA256
c4f20eaffc48b4f0aca01112ad0709c7c50835eb5a3231cb6271b5470099726d

SHA512
b9aee768eb3499c2263a8fa3c161656c40aaa656ee3f01c768e936da9fed6c616426eb7ef313c3626f1adb42047d80e729ac17fe567ce27f6f3c8242f59812b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
22c2367891a209af978cdb4fa3abb9fb

SHA1
ab9f66f4dcd22c29cbd14aff04bdc22726da573b

SHA256
6dbd6d058b9aac200b437a5bbd87c8b3b98335afb04dc4a53c306dfd5cf14392

SHA512
b40d877a877820150cd1be0686088d3297fdbf618e8d3ae78bfe9f9025ba467347bdb031146783912f41d3a3604a6cd2107d3239ccf6d670b7e77a47dae9f308

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f03974b5bbdd8af0f7869c57635dca8

SHA1
5b15e864347949ac34f3e1adc6f3bbe7f6efe384

SHA256
6eb249c3f42d71dd098ff29cb4f27ab77e7722b72e7da6a6da8363326d06d06c

SHA512
0945b79b6eb8edb522ee87fe93e444db3e4d48b8f1c94f5774be90895b96d0c4b8b19dbdeb663f21063b22a45ea147bc13b8f8adebb22d12556a1d41188de415

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
566c84fc405c55a916c2d29cba75c397

SHA1
579eeb1a5e6572027207e8030247848f4378519b

SHA256
8bc5867851a4dc5ed38c0abbf2350ad745b742645175cfc6bfd1392c4bf8526a

SHA512
2d27cd5e6c1c979d66ed27b7f5c96410a257947260fa1f3c5b77d129687a3d301cff656fd094a4b42f9303cf262a422ec26fdfed321d667ebe6ec2bd0bdd5752

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b302302795f1d49f3985374fb10afc01

SHA1
a326bfc7b04b2f2332497931a1d07f2c405f08fe

SHA256
06058e32c335e8b1b94615ea18f774c1e37768f32d0a3b52043aa1a18b96766e

SHA512
ce967c8ea8b36789950e3e950cc6748afe7065bd9b67fb43eb78b35cb6480a2cc433644783f26274a61aaa2c0421c59147ad33993123059f45f6d840c671616e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
53fc1f3d008f70d5e9611c5b3fa3d161

SHA1
4033ba30d815e37b64b9a7a4830e2c45148d7446

SHA256
99b61f2d35f296538dc564bf91a1991c10e83e1f5ba7d7f468d33ce1a09409d9

SHA512
b34d0d1e99ef94a4470fbf7469ffeaf0d86151b10e33e69d65f0fa17e01a5b470dc23c37b3ec16a4290b87ddc93e5b6051f3d69e808e71c740a4768997a1fad4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
00b58b313ada864e34944951ee9e2048

SHA1
e8f98039de1c1049027ebe71d37de57a054862fd

SHA256
549e143266c5e87a6e9bbf1d0b4cccbe8c1088c5a6736a93995660eb3638cbe6

SHA512
15a61db9c753e843d36a96df7ea98833931a21fb5a9d28cd32fb68291b7bcf995bd2b5d7eb7d4688f0be2ea6258d43bc95de1b50911fd414a8d2509b77dc3eae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7fe07b9b5e2898a950ea395a20259b60

SHA1
08803a596c1992881d52bd4390f8847979ea8753

SHA256
22834b728c4883e87b600dd4289619a33aa99965afb7ae53b6ec15067439ff69

SHA512
7759865590748c5dd9d4590bd831e8360e93e0c230e8d1354d0ecaf447c04bda59d35c018f0cbd890f2bcaa2931aed6c1141541439ea5e0d798a581db43762d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5E59.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5EF8.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
\Windows\SysWOW64\rundll32Srv.exe

Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
memory/2552-18-0x0000000000430000-0x000000000045E000-memory.dmp

Filesize
184KB

Download
memory/2552-11-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2552-14-0x00000000001C0000-0x00000000001CF000-memory.dmp

Filesize
60KB

Download
memory/2552-15-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2640-6-0x0000000000120000-0x0000000000144000-memory.dmp

Filesize
144KB

Download
memory/2640-7-0x0000000000120000-0x0000000000144000-memory.dmp

Filesize
144KB

Download
memory/2640-8-0x0000000000160000-0x000000000018E000-memory.dmp

Filesize
184KB

Download
memory/2640-9-0x0000000000130000-0x0000000000154000-memory.dmp

Filesize
144KB

Download
memory/2640-0-0x0000000000130000-0x0000000000154000-memory.dmp

Filesize
144KB

Download
memory/2640-5-0x0000000000120000-0x0000000000144000-memory.dmp

Filesize
144KB

Download
memory/2720-23-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2720-25-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download