ramnit | e029495bc7faa2bd3402d58c418b25acc7644fb136d517c04f1d54df8391f4a2

Analysis

max time kernel
107s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2024 18:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e029495bc7faa2bd3402d58c418b25acc7644fb136d517c04f1d54df8391f4a2N.exe
Size

204KB
MD5

01bc91f4f37d84c72a6fd882c9084170
SHA1

3bb95b79646e9acbdb7b869c1b3d3f2b0a110496
SHA256

e029495bc7faa2bd3402d58c418b25acc7644fb136d517c04f1d54df8391f4a2
SHA512

529c5a3a13b93a5bee2c56f562275b4ed25dff3541fcd533cc9b9a109f75058abe9e710aec83f2ca06f14a318fb7c3f9430ca0b409e4fd351cf5e16a7db64b6d
SSDEEP

3072:ex2smNha00myg3m4zGMejNGBSNLM8snYr3ZV3DFoTYS39YLCpg1kAz2mLa:FNhKmErjPVM8snQ3z3DD89YL06JvL

Score

10^/10

ramnit banker discovery spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Ramnit family
ramnit

Executes dropped EXE 2 IoCs

pid	Process
2268	e029495bc7faa2bd3402d58c418b25acc7644fb136d517c04f1d54df8391f4a2NSrv.exe
2428	DesktopLayer.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2268-7-0x0000000000400000-0x0000000000415000-memory.dmp	upx
behavioral2/memory/2428-14-0x0000000000400000-0x0000000000415000-memory.dmp	upx
behavioral2/memory/2428-19-0x0000000000400000-0x0000000000415000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\px7BA8.tmp	e029495bc7faa2bd3402d58c418b25acc7644fb136d517c04f1d54df8391f4a2NSrv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	e029495bc7faa2bd3402d58c418b25acc7644fb136d517c04f1d54df8391f4a2NSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	e029495bc7faa2bd3402d58c418b25acc7644fb136d517c04f1d54df8391f4a2NSrv.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4792	4740	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopLayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e029495bc7faa2bd3402d58c418b25acc7644fb136d517c04f1d54df8391f4a2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e029495bc7faa2bd3402d58c418b25acc7644fb136d517c04f1d54df8391f4a2NSrv.exe

Modifies Internet Explorer settings 1 TTPs 32 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31151869"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1843439505"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1843439505"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1840314283"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31151869"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "441917374"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31151869"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1840314283"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{926A46B2-C2F0-11EF-BDBF-D6A59BC41F9D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31151869"	IEXPLORE.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2428	DesktopLayer.exe
2428	DesktopLayer.exe
2428	DesktopLayer.exe
2428	DesktopLayer.exe
2428	DesktopLayer.exe
2428	DesktopLayer.exe
2428	DesktopLayer.exe
2428	DesktopLayer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
388	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
388	iexplore.exe
388	iexplore.exe
4712	IEXPLORE.EXE
4712	IEXPLORE.EXE
4712	IEXPLORE.EXE
4712	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 2268	4812	e029495bc7faa2bd3402d58c418b25acc7644fb136d517c04f1d54df8391f4a2N.exe	85
PID 4812 wrote to memory of 2268	4812	e029495bc7faa2bd3402d58c418b25acc7644fb136d517c04f1d54df8391f4a2N.exe	85
PID 4812 wrote to memory of 2268	4812	e029495bc7faa2bd3402d58c418b25acc7644fb136d517c04f1d54df8391f4a2N.exe	85
PID 2268 wrote to memory of 2428	2268	e029495bc7faa2bd3402d58c418b25acc7644fb136d517c04f1d54df8391f4a2NSrv.exe	86
PID 2268 wrote to memory of 2428	2268	e029495bc7faa2bd3402d58c418b25acc7644fb136d517c04f1d54df8391f4a2NSrv.exe	86
PID 2268 wrote to memory of 2428	2268	e029495bc7faa2bd3402d58c418b25acc7644fb136d517c04f1d54df8391f4a2NSrv.exe	86
PID 2428 wrote to memory of 4740	2428	DesktopLayer.exe	87
PID 2428 wrote to memory of 4740	2428	DesktopLayer.exe	87
PID 2428 wrote to memory of 4740	2428	DesktopLayer.exe	87
PID 2428 wrote to memory of 4740	2428	DesktopLayer.exe	87
PID 2428 wrote to memory of 4740	2428	DesktopLayer.exe	87
PID 2428 wrote to memory of 4740	2428	DesktopLayer.exe	87
PID 2428 wrote to memory of 4740	2428	DesktopLayer.exe	87
PID 2428 wrote to memory of 4740	2428	DesktopLayer.exe	87
PID 2428 wrote to memory of 4740	2428	DesktopLayer.exe	87
PID 2428 wrote to memory of 388	2428	DesktopLayer.exe	91
PID 2428 wrote to memory of 388	2428	DesktopLayer.exe	91
PID 388 wrote to memory of 4712	388	iexplore.exe	93
PID 388 wrote to memory of 4712	388	iexplore.exe	93
PID 388 wrote to memory of 4712	388	iexplore.exe	93

C:\Users\Admin\AppData\Local\Temp\e029495bc7faa2bd3402d58c418b25acc7644fb136d517c04f1d54df8391f4a2N.exe
"C:\Users\Admin\AppData\Local\Temp\e029495bc7faa2bd3402d58c418b25acc7644fb136d517c04f1d54df8391f4a2N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Users\Admin\AppData\Local\Temp\e029495bc7faa2bd3402d58c418b25acc7644fb136d517c04f1d54df8391f4a2NSrv.exe
  C:\Users\Admin\AppData\Local\Temp\e029495bc7faa2bd3402d58c418b25acc7644fb136d517c04f1d54df8391f4a2NSrv.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2268
- - C:\Program Files (x86)\Microsoft\DesktopLayer.exe
    "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2428
  - - C:\Windows\SysWOW64\svchost.exe
      C:\Windows\system32\svchost.exe
      4⤵
      PID:4740
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4740 -s 208
        5⤵
        Program crash
        
        PID:4792
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:388
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:388 CREDAT:17410 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:4712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4740 -ip 4740
1⤵
PID:3804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
4KB

MD5
77b20b5cd41bc6bb475cca3f91ae6e3c

SHA1
9e98ace72bd2ab931341427a856ef4cea6faf806

SHA256
5511a9b9f9144ed7bde4ccb074733b7c564d918d2a8b10d391afc6be5b3b1509

SHA512
3537da5e7f3aba3dafe6a86e9511aba20b7a3d34f30aea6cc11feef7768bd63c0c85679c49e99c3291bd1b552ded2c6973b6c2f7f6d731bcfacecab218e72fd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
73d8dd7eaa8896905e31f1960f51ece1

SHA1
164e031603e75d95091220c5ff0d695547f6d3ae

SHA256
9ff75ab638fe252bd0d04aea3f0ce38270ffc8df5db9399f9ea45aaef196dddc

SHA512
4879585482992d7ea3ee02775b74592b06daab32a63dc7700dd4da40c45a524f3bcfc2beff928a85563f09ad0438be5b3e458bc3d0cd08ad146d416fec014a04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
340B

MD5
f802fbc8d39b4bfd2a03660869ec4d4f

SHA1
3d61cbcdd869d4ce950a17f190e0aeb0a41afb80

SHA256
8441e5f205ee21a2c08b615d8abda4ccef2c2d128c319329aa578da5c319f1bd

SHA512
d3c5b31b85ebb58bc798f440365b169e54396501b8b49404b35d19d32af68492c448dd6a6832414a96e29f62c5926ef277ebd4f1b064983d3e144e197278f1c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
ce8192246ee0ccc8fcce88fc391ba9cb

SHA1
c9430e03571129c7d264e0c057dab5d238336af4

SHA256
3150a48580f49b3402e143a802d2998ed70456a295ddf2e8e0fe5852e4e60209

SHA512
51949cdbe28261e14e2f832f3f911f5148502643644da15ae5cbd733a84a9f2b3c86274b11dad3eda8125ea1928ccd0aa3850ed9a50652aeeaf12833e0d399fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver2C5A.tmp

Filesize
15KB

MD5
1a545d0052b581fbb2ab4c52133846bc

SHA1
62f3266a9b9925cd6d98658b92adec673cbe3dd3

SHA256
557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

SHA512
bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6IJLDY7V\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\e029495bc7faa2bd3402d58c418b25acc7644fb136d517c04f1d54df8391f4a2NSrv.exe

Filesize
52KB

MD5
a3e0fcd3f20ce9325284213684768a40

SHA1
1d523885a94c71659135bb1091e7b2e30a0e8a1b

SHA256
542fe44cc87cc6ab352994f51bcaa179a63c18e342a1e5b4beaad3225fae132f

SHA512
35ecd3fa6aabac8dca3922932e49b9bd11c82f2606dc391d1dc2b39bde110bab6dde941d30004670dc86e9cb8c29209374e09e955f4a975fa183393f89f61143

Download Submit
memory/2268-6-0x00000000004F0000-0x0000000000505000-memory.dmp

Filesize
84KB

Download
memory/2268-7-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2428-19-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2428-20-0x0000000077562000-0x0000000077563000-memory.dmp

Filesize
4KB

Download
memory/2428-13-0x0000000000480000-0x0000000000481000-memory.dmp

Filesize
4KB

Download
memory/2428-14-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4740-17-0x0000000000E10000-0x0000000000E11000-memory.dmp

Filesize
4KB

Download
memory/4740-16-0x0000000000E30000-0x0000000000E31000-memory.dmp

Filesize
4KB

Download
memory/4812-0-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4812-5-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download