ramnit | 370c05d4a964c065dfaead8edcf8f92cd1b47763468b30c72f7cc0828fd98bd9

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27/12/2024, 21:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

370c05d4a964c065dfaead8edcf8f92cd1b47763468b30c72f7cc0828fd98bd9.exe
Size

317KB
MD5

86b9a18ddc6f28dcbb3b785a63c2a15f
SHA1

3ba6b07f47e506284e61f32e4e16053750c347fa
SHA256

370c05d4a964c065dfaead8edcf8f92cd1b47763468b30c72f7cc0828fd98bd9
SHA512

e5448e3e7058f43d961c3635a92e18ed2663e6755613cef6b2139b9236f1e254c6ac0e0e1d846c4dc0b8093eb0e7616882a6f79441735f50e86ee920fb87c165
SSDEEP

3072:hnnAQVG/LytaKItS/fiLKS+f5Aq7i3xJlbOzZtBkwomF+sZ/8n1wwoboBgtdDq1U:pOTeHI8HiL7+f5u9bO72woc+cMDBgDDL

Score

10^/10

ramnit banker discovery spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Ramnit family
ramnit

Executes dropped EXE 1 IoCs

pid	Process
776	370c05d4a964c065dfaead8edcf8f92cd1b47763468b30c72f7cc0828fd98bd9mgr.exe

Loads dropped DLL 2 IoCs

pid	Process
2672	370c05d4a964c065dfaead8edcf8f92cd1b47763468b30c72f7cc0828fd98bd9.exe
776	370c05d4a964c065dfaead8edcf8f92cd1b47763468b30c72f7cc0828fd98bd9mgr.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/776-11-0x0000000000400000-0x0000000000432000-memory.dmp	upx
behavioral2/memory/2672-10-0x0000000000400000-0x000000000045A000-memory.dmp	upx

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2680	776	WerFault.exe	82
2136	2672	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	370c05d4a964c065dfaead8edcf8f92cd1b47763468b30c72f7cc0828fd98bd9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	370c05d4a964c065dfaead8edcf8f92cd1b47763468b30c72f7cc0828fd98bd9mgr.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 776	2672	370c05d4a964c065dfaead8edcf8f92cd1b47763468b30c72f7cc0828fd98bd9.exe	82
PID 2672 wrote to memory of 776	2672	370c05d4a964c065dfaead8edcf8f92cd1b47763468b30c72f7cc0828fd98bd9.exe	82
PID 2672 wrote to memory of 776	2672	370c05d4a964c065dfaead8edcf8f92cd1b47763468b30c72f7cc0828fd98bd9.exe	82

C:\Users\Admin\AppData\Local\Temp\370c05d4a964c065dfaead8edcf8f92cd1b47763468b30c72f7cc0828fd98bd9.exe
"C:\Users\Admin\AppData\Local\Temp\370c05d4a964c065dfaead8edcf8f92cd1b47763468b30c72f7cc0828fd98bd9.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Users\Admin\AppData\Local\Temp\370c05d4a964c065dfaead8edcf8f92cd1b47763468b30c72f7cc0828fd98bd9mgr.exe
  C:\Users\Admin\AppData\Local\Temp\370c05d4a964c065dfaead8edcf8f92cd1b47763468b30c72f7cc0828fd98bd9mgr.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:776
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 776 -s 488
    3⤵
    - Program crash
    PID:2680
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 512
  2⤵
  - Program crash
  PID:2136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2672 -ip 2672
1⤵
PID:1572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 776 -ip 776
1⤵
PID:2436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\370c05d4a964c065dfaead8edcf8f92cd1b47763468b30c72f7cc0828fd98bd9mgr.exe

Filesize
157KB

MD5
8d1c06f5bb33463baeeec351714e3afa

SHA1
a0a2e8508d277499d22b4026dd111f05713e1994

SHA256
6a284a8d778f40ce3636fd6c9d55a7e4252ecfdd975267b335c8ea282c639f56

SHA512
d86f2b934f4975de111d7cc76f2d05d622de70421ce57f921ac21bc78c4f04c26f0ac9972d1ee94beabaa38939c362c7610d42fe0fd9b3445f643bfb3f34881f

Download Submit
C:\Users\Admin\AppData\Local\Temp\~TMCF75.tmp

Filesize
1.6MB

MD5
4f3387277ccbd6d1f21ac5c07fe4ca68

SHA1
e16506f662dc92023bf82def1d621497c8ab5890

SHA256
767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

SHA512
9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

Download Submit
memory/776-5-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/776-11-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/776-9-0x0000000000650000-0x0000000000682000-memory.dmp

Filesize
200KB

Download
memory/2672-0-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/2672-10-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/2672-7-0x0000000002240000-0x000000000229A000-memory.dmp

Filesize
360KB

Download