ramnit | 13e58d658f60e2de88d14d0221574184e3fb05c6a3739b375dc925f854e98446

General

Target

JaffaCakes118_85be3282af2c3dfa323060ce72793ac6.exe
Size

121KB
MD5

85be3282af2c3dfa323060ce72793ac6
SHA1

d29a37657731304eaef892b92321969a4c04e967
SHA256

13e58d658f60e2de88d14d0221574184e3fb05c6a3739b375dc925f854e98446
SHA512

884616246e34db583d36c4e7c1f873008a08d581b7643e542cfbde62b6422ac501eb90f0b402cee378034045dd276ffafbd1e47086d50aea23485b9c5c2db39d
SSDEEP

3072:SHk0dbcfrBamAh8fIWPLzJI0YpvcgHnpLRAAjxOT0QvX72a0:eglaIJ+0/EnpNAh1

Score

10^/10

ramnit banker discovery persistence spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Ramnit family
ramnit

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\mbr\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\mbr.sys"	JaffaCakes118_85be3282af2c3dfa323060ce72793ac6.exe

Executes dropped EXE 2 IoCs

pid	Process
3040	JaffaCakes118_85be3282af2c3dfa323060ce72793ac6Srv.exe
1712	DesktopLayer.exe

Loads dropped DLL 4 IoCs

pid	Process
2412	JaffaCakes118_85be3282af2c3dfa323060ce72793ac6.exe
2412	JaffaCakes118_85be3282af2c3dfa323060ce72793ac6.exe
3040	JaffaCakes118_85be3282af2c3dfa323060ce72793ac6Srv.exe
3040	JaffaCakes118_85be3282af2c3dfa323060ce72793ac6Srv.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2412-0-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral1/files/0x0007000000012117-2.dat	upx
behavioral1/memory/2412-11-0x0000000000220000-0x0000000000247000-memory.dmp	upx
behavioral1/memory/3040-13-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral1/memory/2412-22-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral1/memory/3040-21-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral1/memory/1712-33-0x0000000000400000-0x0000000000427000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	JaffaCakes118_85be3282af2c3dfa323060ce72793ac6Srv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxA860.tmp	JaffaCakes118_85be3282af2c3dfa323060ce72793ac6Srv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	JaffaCakes118_85be3282af2c3dfa323060ce72793ac6Srv.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopLayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_85be3282af2c3dfa323060ce72793ac6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_85be3282af2c3dfa323060ce72793ac6Srv.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
2412	JaffaCakes118_85be3282af2c3dfa323060ce72793ac6.exe
2412	JaffaCakes118_85be3282af2c3dfa323060ce72793ac6.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	2412	JaffaCakes118_85be3282af2c3dfa323060ce72793ac6.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 3040	2412	JaffaCakes118_85be3282af2c3dfa323060ce72793ac6.exe	31
PID 2412 wrote to memory of 3040	2412	JaffaCakes118_85be3282af2c3dfa323060ce72793ac6.exe	31
PID 2412 wrote to memory of 3040	2412	JaffaCakes118_85be3282af2c3dfa323060ce72793ac6.exe	31
PID 2412 wrote to memory of 3040	2412	JaffaCakes118_85be3282af2c3dfa323060ce72793ac6.exe	31
PID 3040 wrote to memory of 1712	3040	JaffaCakes118_85be3282af2c3dfa323060ce72793ac6Srv.exe	32
PID 3040 wrote to memory of 1712	3040	JaffaCakes118_85be3282af2c3dfa323060ce72793ac6Srv.exe	32
PID 3040 wrote to memory of 1712	3040	JaffaCakes118_85be3282af2c3dfa323060ce72793ac6Srv.exe	32
PID 3040 wrote to memory of 1712	3040	JaffaCakes118_85be3282af2c3dfa323060ce72793ac6Srv.exe	32

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_85be3282af2c3dfa323060ce72793ac6.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_85be3282af2c3dfa323060ce72793ac6.exe"
1⤵
- Sets service image path in registry
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_85be3282af2c3dfa323060ce72793ac6Srv.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_85be3282af2c3dfa323060ce72793ac6Srv.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3040
- - C:\Program Files (x86)\Microsoft\DesktopLayer.exe
    "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\JaffaCakes118_85be3282af2c3dfa323060ce72793ac6Srv.exe

Filesize
44KB

MD5
51c71035085cb0908c328f7293fc29dd

SHA1
95b33a8577af1b5ab5da9642339171b725d66092

SHA256
298d19983b57ac5a4a2cdc9268c93f3fba92fe91fded56ba26733dfc4cb000a8

SHA512
b6ee3b70db28bed135957adbe0af6f8c9fc84e517567ca120aa6e09b2eba8967fe20110a615a3fc7496eed3d51ae33395b8d4b5b8067421ea71f48428aaacdea

Download Submit
memory/1712-33-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2412-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2412-11-0x0000000000220000-0x0000000000247000-memory.dmp

Filesize
156KB

Download
memory/2412-12-0x0000000000220000-0x0000000000247000-memory.dmp

Filesize
156KB

Download
memory/2412-22-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3040-15-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/3040-13-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/3040-21-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/3040-31-0x0000000000250000-0x0000000000277000-memory.dmp

Filesize
156KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads