ramnit | 8a863ed8898995a8c9a4b5ecc144cec4294292d4a520311786157ee432d682ac

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/06/2026, 23:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-08_2dc148902308e1d5518d2a7cad4048df_amadey_darkgate_elex_ramnit_smoke-loader.exe
Size 1.8MB
Sample260608-3vsxcaht6m
SHA256 8a863ed8898995a8c9a4b5ecc144cec4294292d4a520311786157ee432d682ac
MD5 2dc148902308e1d5518d2a7cad4048df
SHA1 f5d141d0722c32d1d46fdbca3bfd39dcc272b43d
SHA512 edb89b687fba0d99ef108db23a5d6566f92001d28e59d68bdd597be0f963f7d78147acea13501cb86b807667edde13de44b0c4af190dc36dd58e5ca42f202467
SSDEEP 49152:D+QKNyaZAYUALnSvdIp47Vi+lREoHqyUIwOjc+OgHhITZXtCQpj3xAq:DENyaZAYUA2v047Vi+fEoHqyl9FHhITj
TLSH
T14C956C2175B1C07BC53E2134D5496BF9E2ABEE30DA35024322D17EBC3A764925B2C76B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

banker discovery ramnit spyware stealer trojan upx worm

Malware Config

Signatures

Family: Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Custom signature

UPX dump on OEP (original entry point) 3 IoCs

resource	yara_rule
behavioral2/files/0x002100000002b2ef-3.dat	UPX
behavioral2/memory/1224-4-0x0000000000400000-0x000000000042E000-memory.dmp	UPX
behavioral2/memory/1048-7-0x00000000003C0000-0x00000000005A5000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

pid	Process
1224	2026-06-08_2dc148902308e1d5518d2a7cad4048df_amadey_darkgate_elex_ramnit_smoke-loaderSrv.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x002100000002b2ef-3.dat	upx
behavioral2/memory/1224-4-0x0000000000400000-0x000000000042E000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3384	1224	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-08_2dc148902308e1d5518d2a7cad4048df_amadey_darkgate_elex_ramnit_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-08_2dc148902308e1d5518d2a7cad4048df_amadey_darkgate_elex_ramnit_smoke-loaderSrv.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1048	2026-06-08_2dc148902308e1d5518d2a7cad4048df_amadey_darkgate_elex_ramnit_smoke-loader.exe
1048	2026-06-08_2dc148902308e1d5518d2a7cad4048df_amadey_darkgate_elex_ramnit_smoke-loader.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 1224	1048	2026-06-08_2dc148902308e1d5518d2a7cad4048df_amadey_darkgate_elex_ramnit_smoke-loader.exe	81

C:\Users\Admin\AppData\Local\Temp\2026-06-08_2dc148902308e1d5518d2a7cad4048df_amadey_darkgate_elex_ramnit_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-08_2dc148902308e1d5518d2a7cad4048df_amadey_darkgate_elex_ramnit_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Users\Admin\AppData\Local\Temp\2026-06-08_2dc148902308e1d5518d2a7cad4048df_amadey_darkgate_elex_ramnit_smoke-loaderSrv.exe
  C:\Users\Admin\AppData\Local\Temp\2026-06-08_2dc148902308e1d5518d2a7cad4048df_amadey_darkgate_elex_ramnit_smoke-loaderSrv.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1224
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1224 -s 324
    3⤵
    - Program crash
    PID:3384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1224 -ip 1224
1⤵
PID:588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-06-08_2dc148902308e1d5518d2a7cad4048df_amadey_darkgate_elex_ramnit_smoke-loaderSrv.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-06-08_2dc148902308e1d5518d2a7cad4048df_amadey_darkgate_elex_ramnit_smoke-loaderSrv.exe
Size 55KB
SHA256 fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
MD5 ff5e1f27193ce51eec318714ef038bef
SHA1 b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA512 c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
SSDEEP 1536:Q+hzRsibKplyXTq8OGRnsPFG+RODTb7MXL5uXZnzE:bROzoTq0+RO7IwnY
TLSH
T1EA43F2C6AE1903A2DF75053314E4C6B4CBA43C558B737A9EFA50002BFF89463A817F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1048-1-0x00000000003C0000-0x00000000005A5000-memory.dmp

Download

memory/1048-7-0x00000000003C0000-0x00000000005A5000-memory.dmp

Download

memory/1224-5-0x0000000000660000-0x000000000066F000-memory.dmp

Download

memory/1224-4-0x0000000000400000-0x000000000042E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads