ramnit | e88eea09dfa23811d640563e67d8dfa2797586fbcf576ef4d00cd656a8aa0d2c

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03-01-2025 04:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe
Size

677KB
MD5

6a36f8e0ab0f1800fa8e709c3579c701
SHA1

0781fed6442ea99eda0710e709979e9b3440fa49
SHA256

e88eea09dfa23811d640563e67d8dfa2797586fbcf576ef4d00cd656a8aa0d2c
SHA512

8536671a239984ef0e01a31e9fc5a27ca2e8c78e62ede5d30c98cb66aa2dfbfa87558b7930ebe0d0b5b359072f5365c3010a6a58c8f103435f4c2fd68f34ecf1
SSDEEP

6144:9+xDVG0BpTwisyJA2xxJPnvxE5WAU/zlfpcIK1XEBwrK8p3WfdfFUaXsu1Qbckyf:oa0BQaZFQW1lhcIo0SrK8pGfdNB8ui/4

Score

10^/10

ramnit banker discovery spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Ramnit family
ramnit

Executes dropped EXE 1 IoCs

pid	Process
2360	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701mgr.exe

Loads dropped DLL 2 IoCs

pid	Process
2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe
2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2520-26-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2360-36-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2520-34-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2520-24-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2520-23-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2360-13-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2360-12-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2360-11-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\pxE34D.tmp	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe
File opened for modification	C:\Program Files (x86)\Microsoft\WaterMark.exe	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxE35D.tmp	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701mgr.exe
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701mgr.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701mgr.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe

Suspicious behavior: MapViewOfSection 25 IoCs

pid	Process
2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe
2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe
2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe
2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe
2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe
2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe
2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe
2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe
2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe
2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe
2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe
2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe
2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe
2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe
2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe
2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe
2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe
2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe
2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe
2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe
2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe
2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe
2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe
2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe
2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2360	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701mgr.exe
2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 2360	2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe	31
PID 2520 wrote to memory of 2360	2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe	31
PID 2520 wrote to memory of 2360	2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe	31
PID 2520 wrote to memory of 2360	2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe	31
PID 2520 wrote to memory of 384	2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe	3
PID 2520 wrote to memory of 384	2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe	3
PID 2520 wrote to memory of 384	2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe	3
PID 2520 wrote to memory of 384	2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe	3
PID 2520 wrote to memory of 384	2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe	3
PID 2520 wrote to memory of 384	2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe	3
PID 2520 wrote to memory of 384	2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe	3
PID 2520 wrote to memory of 396	2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe	4
PID 2520 wrote to memory of 396	2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe	4
PID 2520 wrote to memory of 396	2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe	4
PID 2520 wrote to memory of 396	2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe	4
PID 2520 wrote to memory of 396	2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe	4
PID 2520 wrote to memory of 396	2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe	4
PID 2520 wrote to memory of 396	2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe	4
PID 2520 wrote to memory of 432	2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe	5
PID 2520 wrote to memory of 432	2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe	5
PID 2520 wrote to memory of 432	2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe	5
PID 2520 wrote to memory of 432	2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe	5
PID 2520 wrote to memory of 432	2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe	5
PID 2520 wrote to memory of 432	2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe	5
PID 2520 wrote to memory of 432	2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe	5
PID 2520 wrote to memory of 476	2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe	6
PID 2520 wrote to memory of 476	2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe	6
PID 2520 wrote to memory of 476	2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe	6
PID 2520 wrote to memory of 476	2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe	6
PID 2520 wrote to memory of 476	2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe	6
PID 2520 wrote to memory of 476	2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe	6
PID 2520 wrote to memory of 476	2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe	6
PID 2520 wrote to memory of 492	2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe	7
PID 2520 wrote to memory of 492	2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe	7
PID 2520 wrote to memory of 492	2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe	7
PID 2520 wrote to memory of 492	2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe	7
PID 2520 wrote to memory of 492	2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe	7
PID 2520 wrote to memory of 492	2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe	7
PID 2520 wrote to memory of 492	2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe	7
PID 2520 wrote to memory of 500	2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe	8
PID 2520 wrote to memory of 500	2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe	8
PID 2520 wrote to memory of 500	2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe	8
PID 2520 wrote to memory of 500	2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe	8
PID 2520 wrote to memory of 500	2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe	8
PID 2520 wrote to memory of 500	2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe	8
PID 2520 wrote to memory of 500	2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe	8
PID 2520 wrote to memory of 608	2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe	9
PID 2520 wrote to memory of 608	2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe	9
PID 2520 wrote to memory of 608	2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe	9
PID 2520 wrote to memory of 608	2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe	9
PID 2520 wrote to memory of 608	2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe	9
PID 2520 wrote to memory of 608	2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe	9
PID 2520 wrote to memory of 608	2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe	9
PID 2520 wrote to memory of 692	2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe	10
PID 2520 wrote to memory of 692	2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe	10
PID 2520 wrote to memory of 692	2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe	10
PID 2520 wrote to memory of 692	2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe	10
PID 2520 wrote to memory of 692	2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe	10
PID 2520 wrote to memory of 692	2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe	10
PID 2520 wrote to memory of 692	2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe	10
PID 2520 wrote to memory of 772	2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe	11
PID 2520 wrote to memory of 772	2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe	11
PID 2520 wrote to memory of 772	2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe	11
PID 2520 wrote to memory of 772	2520	JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe	11

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:384
- C:\Windows\system32\services.exe
  C:\Windows\system32\services.exe
  2⤵
  PID:476
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    3⤵
    PID:608
  - - C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
      4⤵
      PID:1424
  - - C:\Windows\system32\wbem\wmiprvse.exe
      C:\Windows\system32\wbem\wmiprvse.exe
      4⤵
      PID:1296
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    3⤵
    PID:692
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    3⤵
    PID:772
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    3⤵
    PID:828
  - - C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      4⤵
      PID:1172
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    3⤵
    PID:872
  - - \\?\C:\Windows\system32\wbem\WMIADAP.EXE
      wmiadap.exe /F /T /R
      4⤵
      PID:2068
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService
    3⤵
    PID:980
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    3⤵
    PID:296
- - C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    3⤵
    PID:308
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    3⤵
    PID:1072
- - C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    3⤵
    PID:1096
- - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
    "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
    3⤵
    PID:880
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    3⤵
    PID:2284
- - C:\Windows\system32\sppsvc.exe
    C:\Windows\system32\sppsvc.exe
    3⤵
    PID:1796
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:492
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:500

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:396

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:432

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1208
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:2520
- - C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701mgr.exe
    C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701mgr.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of UnmapMainImage
    PID:2360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRAM FILES (X86)\MICROSOFT\WATERMARK.EXE

Filesize
677KB

MD5
6a36f8e0ab0f1800fa8e709c3579c701

SHA1
0781fed6442ea99eda0710e709979e9b3440fa49

SHA256
e88eea09dfa23811d640563e67d8dfa2797586fbcf576ef4d00cd656a8aa0d2c

SHA512
8536671a239984ef0e01a31e9fc5a27ca2e8c78e62ede5d30c98cb66aa2dfbfa87558b7930ebe0d0b5b359072f5365c3010a6a58c8f103435f4c2fd68f34ecf1

Download Submit
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6a36f8e0ab0f1800fa8e709c3579c701mgr.exe

Filesize
337KB

MD5
5a5da9ea8fb136a64b023ecb9600a55d

SHA1
012ec36b9241e7b8d4eeb128350632475624652c

SHA256
63f2016ba6dab473044d2fb9c69a327b7c6c2f55295b9db9acfa1dd424ad9e4b

SHA512
4a58015a486a53f6113e1a061b24bd787e06da253eada381c94f48838d3168dda0078e24bb9cdfe3997d78bf4c472dcd9ca535e880163c96929a1cdfba2157f2

Download Submit
memory/2360-17-0x000000007EFA0000-0x000000007EFAC000-memory.dmp

Filesize
48KB

Download
memory/2360-18-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/2360-11-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2360-37-0x000000007EFA0000-0x000000007EFAC000-memory.dmp

Filesize
48KB

Download
memory/2360-36-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2360-12-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2360-13-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2360-10-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2520-24-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2520-23-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2520-0-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2520-16-0x0000000077420000-0x0000000077421000-memory.dmp

Filesize
4KB

Download
memory/2520-15-0x000000007741F000-0x0000000077420000-memory.dmp

Filesize
4KB

Download
memory/2520-8-0x0000000000380000-0x00000000003DF000-memory.dmp

Filesize
380KB

Download
memory/2520-34-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2520-26-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download