ramnit | 7e64c10736070aee732ab70806a3dab56a1b7dbf47c787b6b4b6758a18581059

General

Target

JaffaCakes118_610267c030485123ae08269ff7177520.dll
Size

312KB
MD5

610267c030485123ae08269ff7177520
SHA1

034fad9125a4a8ae24e80877bc2a52b7ac5521ba
SHA256

7e64c10736070aee732ab70806a3dab56a1b7dbf47c787b6b4b6758a18581059
SHA512

49954f97d69e78279ab10e38378914064110ce7483077e5219bd29b544641db49bc5b71a1a3001bef6b498390c8b1ec3aabb1698bdddb293a58d3d2e633bd637
SSDEEP

6144:pN755D+dC8SvqQpaxQOBJJ+wGnrtrYHyVDK+ow:nl8qAJ+dnxrYSVUw

Score

10^/10

ramnit banker discovery spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Ramnit family
ramnit

Executes dropped EXE 1 IoCs

pid	Process
1068	rundll32mgr.exe

Loads dropped DLL 1 IoCs

pid	Process
1068	rundll32mgr.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1068-14-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1068-16-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1068-10-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1068-13-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1068-9-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1068-8-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1068-7-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1068-23-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1664	1068	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32mgr.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1068	rundll32mgr.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 2184	4876	rundll32.exe	82
PID 4876 wrote to memory of 2184	4876	rundll32.exe	82
PID 4876 wrote to memory of 2184	4876	rundll32.exe	82
PID 2184 wrote to memory of 1068	2184	rundll32.exe	83
PID 2184 wrote to memory of 1068	2184	rundll32.exe	83
PID 2184 wrote to memory of 1068	2184	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_610267c030485123ae08269ff7177520.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_610267c030485123ae08269ff7177520.dll,#1
  2⤵
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2184
- - C:\Windows\SysWOW64\rundll32mgr.exe
    C:\Windows\SysWOW64\rundll32mgr.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of UnmapMainImage
    PID:1068
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1068 -s 360
      4⤵
      Program crash
      PID:1664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1068 -ip 1068
1⤵
PID:3688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~TM8993.tmp

Filesize
1.6MB

MD5
4f3387277ccbd6d1f21ac5c07fe4ca68

SHA1
e16506f662dc92023bf82def1d621497c8ab5890

SHA256
767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

SHA512
9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

Download Submit
C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
84KB

MD5
a6ee7aab6b8f8268bf9eb763949d5c8b

SHA1
4600e17eb8fa4a11170aaa2c54d98126e58290e0

SHA256
9030a2ec813b5a70b898aacd81378c941bc5f62e78cc1a958f93106ede81228c

SHA512
00569ed578d3f0b535b0c17dc131131e4aaf73b8b5235c70fcf8de649e8a942f48a013e8c687c6abab05a8f7516dabed41309da6ce7c9eb26992183e4794afb8

Download Submit
memory/1068-20-0x0000000077382000-0x0000000077383000-memory.dmp

Filesize
4KB

Download
memory/1068-19-0x0000000077382000-0x0000000077384000-memory.dmp

Filesize
8KB

Download
memory/1068-14-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1068-16-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1068-10-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1068-5-0x0000000000401000-0x0000000000405000-memory.dmp

Filesize
16KB

Download
memory/1068-23-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1068-11-0x00000000012A0000-0x00000000012A1000-memory.dmp

Filesize
4KB

Download
memory/1068-13-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1068-9-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1068-8-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1068-7-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1068-6-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1068-22-0x0000000000401000-0x0000000000405000-memory.dmp

Filesize
16KB

Download
memory/2184-1-0x0000000010000000-0x0000000010052000-memory.dmp

Filesize
328KB

Download

Analysis

Sharing