ramnit | 618be017f3b79e1f119e7cfcc41943ad65b1f4b0fdcc6d788277ec300b0b0316 | Triage

Sharing

General

Target

JaffaCakes118_0cec7c07ef770859d4ce2770d230cd15
Size

138KB
Sample

250122-mvndvssnaw
MD5

0cec7c07ef770859d4ce2770d230cd15
SHA1

624dce8a6a7a4afae18b4514b6c37e947df756d2
SHA256

618be017f3b79e1f119e7cfcc41943ad65b1f4b0fdcc6d788277ec300b0b0316
SHA512

0ea2b0989842b52b1e34e2e0ef5a0e07630b6afe35794a74bd05ac7fdfd26a275bf5fc88ff28bbc87c0b36d4f253b88e0091642f4373165062cce38a0149f12a
SSDEEP

3072:64qG0nUuHuLeKvJMrjRXnucaaHw7Koj4rtQsDmz4oe41KfSBnU:XqG0UEuLenpq4oP

Score

10^/10

ramnit banker defense_evasion discovery persistence spyware stealer trojan worm

Malware Config

Targets

- Target
  
  JaffaCakes118_0cec7c07ef770859d4ce2770d230cd15
- Size
  
  138KB
- MD5
  
  0cec7c07ef770859d4ce2770d230cd15
- SHA1
  
  624dce8a6a7a4afae18b4514b6c37e947df756d2
- SHA256
  
  618be017f3b79e1f119e7cfcc41943ad65b1f4b0fdcc6d788277ec300b0b0316
- SHA512
  
  0ea2b0989842b52b1e34e2e0ef5a0e07630b6afe35794a74bd05ac7fdfd26a275bf5fc88ff28bbc87c0b36d4f253b88e0091642f4373165062cce38a0149f12a
- SSDEEP
  
  3072:64qG0nUuHuLeKvJMrjRXnucaaHw7Koj4rtQsDmz4oe41KfSBnU:XqG0UEuLenpq4oP
Score

10^/10

ramnit banker defense_evasion discovery persistence spyware stealer trojan worm
- Modifies WinLogon for persistence
  persistence
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Ramnit family
  ramnit
- UAC bypass
  defense_evasion trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  defense_evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ramnitbankerdefense_evasiondiscoverypersistencespywarestealertrojanworm

behavioral2

ramnitbankerdefense_evasiondiscoveryspywarestealertrojanworm