ramnit | 7aadcea4b8bf52b14a027ea1cb9149bd85afefff1ae8a3faba8ef891f11daa9f

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2024 02:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_008855f610d146db886f43db80dddd63.dll
Size

269KB
MD5

008855f610d146db886f43db80dddd63
SHA1

bc729c995c23a1867b47a737298c530325521075
SHA256

7aadcea4b8bf52b14a027ea1cb9149bd85afefff1ae8a3faba8ef891f11daa9f
SHA512

f73f0a34610a1d73e11e88936302f672812c5e60183cbb84660e26942f87b9c30c6d684a8a9b4db909b9ccf8d360278716d524c7a910c61cc982deb0b9bcda89
SSDEEP

3072:+CuuNCRs/Pj03pJEEC9ti9pocimFFVW6E1fZim4v5TRRJBYeBTg4vRPW9vc/Bm60:+CIGPj038tAgFMldWNX+PD3o/9aM

Score

10^/10

ramnit banker discovery spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Ramnit family
ramnit

Executes dropped EXE 2 IoCs

pid	Process
1396	rundll32mgr.exe
4336	WaterMark.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1396-13-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1396-16-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4336-29-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1396-14-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1396-10-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1396-8-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1396-7-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1396-6-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4336-38-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4336-37-0x0000000000400000-0x000000000043C000-memory.dmp	upx
behavioral2/memory/4336-40-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4336-41-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\pxA354.tmp	rundll32mgr.exe
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	rundll32mgr.exe
File opened for modification	C:\Program Files (x86)\Microsoft\WaterMark.exe	rundll32mgr.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1748	3316	WerFault.exe	83
4172	3640	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32mgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaterMark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3038761528"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3038761528"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31152936"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3036886558"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31152936"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31152936"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{E081D37D-C71B-11EF-BDBF-EE6C25FCE24B} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "442375776"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31152936"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3036886558"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4336	WaterMark.exe
4336	WaterMark.exe
4336	WaterMark.exe
4336	WaterMark.exe
4336	WaterMark.exe
4336	WaterMark.exe
4336	WaterMark.exe
4336	WaterMark.exe
4336	WaterMark.exe
4336	WaterMark.exe
4336	WaterMark.exe
4336	WaterMark.exe
4336	WaterMark.exe
4336	WaterMark.exe
4336	WaterMark.exe
4336	WaterMark.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4336	WaterMark.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
848	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
848	iexplore.exe
848	iexplore.exe
3372	IEXPLORE.EXE
3372	IEXPLORE.EXE
3372	IEXPLORE.EXE
3372	IEXPLORE.EXE

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1396	rundll32mgr.exe
4336	WaterMark.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 3316	552	rundll32.exe	83
PID 552 wrote to memory of 3316	552	rundll32.exe	83
PID 552 wrote to memory of 3316	552	rundll32.exe	83
PID 3316 wrote to memory of 1396	3316	rundll32.exe	84
PID 3316 wrote to memory of 1396	3316	rundll32.exe	84
PID 3316 wrote to memory of 1396	3316	rundll32.exe	84
PID 1396 wrote to memory of 4336	1396	rundll32mgr.exe	86
PID 1396 wrote to memory of 4336	1396	rundll32mgr.exe	86
PID 1396 wrote to memory of 4336	1396	rundll32mgr.exe	86
PID 4336 wrote to memory of 3640	4336	WaterMark.exe	87
PID 4336 wrote to memory of 3640	4336	WaterMark.exe	87
PID 4336 wrote to memory of 3640	4336	WaterMark.exe	87
PID 4336 wrote to memory of 3640	4336	WaterMark.exe	87
PID 4336 wrote to memory of 3640	4336	WaterMark.exe	87
PID 4336 wrote to memory of 3640	4336	WaterMark.exe	87
PID 4336 wrote to memory of 3640	4336	WaterMark.exe	87
PID 4336 wrote to memory of 3640	4336	WaterMark.exe	87
PID 4336 wrote to memory of 3640	4336	WaterMark.exe	87
PID 4336 wrote to memory of 848	4336	WaterMark.exe	93
PID 4336 wrote to memory of 848	4336	WaterMark.exe	93
PID 4336 wrote to memory of 4204	4336	WaterMark.exe	94
PID 4336 wrote to memory of 4204	4336	WaterMark.exe	94
PID 848 wrote to memory of 3372	848	iexplore.exe	96
PID 848 wrote to memory of 3372	848	iexplore.exe	96
PID 848 wrote to memory of 3372	848	iexplore.exe	96

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_008855f610d146db886f43db80dddd63.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:552
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_008855f610d146db886f43db80dddd63.dll,#1
  2⤵
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3316
- - C:\Windows\SysWOW64\rundll32mgr.exe
    C:\Windows\SysWOW64\rundll32mgr.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of UnmapMainImage
    - Suspicious use of WriteProcessMemory
    PID:1396
  - - C:\Program Files (x86)\Microsoft\WaterMark.exe
      "C:\Program Files (x86)\Microsoft\WaterMark.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of UnmapMainImage
      Suspicious use of WriteProcessMemory
      PID:4336
    - - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        5⤵
        
        PID:3640
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3640 -s 204
        6⤵
        Program crash
        
        PID:4172
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:848
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:848 CREDAT:17410 /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:3372
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        Modifies Internet Explorer settings
        
        PID:4204
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3316 -s 608
    3⤵
    - Program crash
    PID:1748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3316 -ip 3316
1⤵
PID:2184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3640 -ip 3640
1⤵
PID:2488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
e5e877bcc2542ab8629d8f34bafcd7f4

SHA1
8f618efa1584268e9eafd2b01c2a2ac006113c01

SHA256
5e63bcec102963b96b1f7d08ec512431a0ba748f90134dc51a05046296541e9e

SHA512
79153f941ae2cc4a5649ac729f03dd3f98df24d5084e36d14467b2a859e6d63fc4167feac24e7b519a9e179fb243447fe6d09519169b11e3151d5cc467e4c9d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
632ba816e7ed5f98dd31d550ab0acb9b

SHA1
aa1af02021d555b854d68f906eb70f5e432562d3

SHA256
199afc78ce955805545559df5d4b2f1b421cd3452f5b18ccec7c2d39daecaa93

SHA512
b5f2eea8b7007f826af37285e78203ea42550c05f08b84d981ea362be1cb26e7f23982becb542fd944bc8d5f445dc76c5ceb311d448411d8b1ce49bfe9e1f754

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver274A.tmp

Filesize
15KB

MD5
1a545d0052b581fbb2ab4c52133846bc

SHA1
62f3266a9b9925cd6d98658b92adec673cbe3dd3

SHA256
557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

SHA512
bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6IJLDY7V\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
103KB

MD5
41c35c864ab7a4021ed987e25836ca25

SHA1
a30684755bef880a031637023156470b6ab45f44

SHA256
bf4fd6e948069e4db9784519dfff636e522436fc32f8eb15bb4287f8cd6c2127

SHA512
5455f2fe424e3671dec8594a9c86a919455cbad3665e418c885124f6c935e4c753de78677bc5e62389c35a9b372feeb6fcc33a19e8d36ae5f8f020e56b286962

Download Submit
memory/1396-13-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1396-16-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1396-11-0x00000000008B0000-0x00000000008B1000-memory.dmp

Filesize
4KB

Download
memory/1396-4-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1396-14-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1396-10-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1396-8-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1396-7-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1396-6-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3316-1-0x0000000010000000-0x0000000010048000-memory.dmp

Filesize
288KB

Download
memory/3316-35-0x0000000010000000-0x0000000010048000-memory.dmp

Filesize
288KB

Download
memory/3640-33-0x0000000000BD0000-0x0000000000BD1000-memory.dmp

Filesize
4KB

Download
memory/3640-34-0x0000000000BB0000-0x0000000000BB1000-memory.dmp

Filesize
4KB

Download
memory/4336-29-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4336-39-0x00000000778A2000-0x00000000778A3000-memory.dmp

Filesize
4KB

Download
memory/4336-38-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4336-37-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4336-40-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4336-41-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4336-36-0x0000000000070000-0x0000000000071000-memory.dmp

Filesize
4KB

Download
memory/4336-25-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4336-28-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/4336-30-0x00000000778A2000-0x00000000778A3000-memory.dmp

Filesize
4KB

Download