ramnit | 60b5937fd9823fd6d455eee7e58e0cd4381e21a4876b7b66d63d7d1aa634e01f

Analysis

max time kernel
92s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11/12/2024, 12:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

60b5937fd9823fd6d455eee7e58e0cd4381e21a4876b7b66d63d7d1aa634e01f.dll
Size

68KB
MD5

f8b21ad55249d741ab4b3df5acd8ef9b
SHA1

92ca7ecac1ed0d7e65df28982d9483668cba0b07
SHA256

60b5937fd9823fd6d455eee7e58e0cd4381e21a4876b7b66d63d7d1aa634e01f
SHA512

0a9fbd9b7c9cf1396fac100da1ecafb66af98b211aecc28a909e86b25c94d6be8a845e933594a9fddaf4db4caf228b8ca6ea6b1e0de773326e78059409826e7f
SSDEEP

1536:MLNd/Pk7btaoX7DypKr0wNcYIUSS9eRuBElw0iZs3i+:GNhY5aora80mcYI7x/lwXs3z

Score

10^/10

ramnit banker discovery spyware stealer trojan worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Ramnit family
ramnit

Drops startup file 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rlqxpiod.exe	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
336	4432	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 4432	1628	rundll32.exe	82
PID 1628 wrote to memory of 4432	1628	rundll32.exe	82
PID 1628 wrote to memory of 4432	1628	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\60b5937fd9823fd6d455eee7e58e0cd4381e21a4876b7b66d63d7d1aa634e01f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\60b5937fd9823fd6d455eee7e58e0cd4381e21a4876b7b66d63d7d1aa634e01f.dll,#1
  2⤵
  - Drops startup file
  - System Location Discovery: System Language Discovery
  PID:4432
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4432 -s 624
    3⤵
    - Program crash
    PID:336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4432 -ip 4432
1⤵
PID:3408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4432-0-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download