ramnit | a741d287614ab9b898a61b3c2145e536b56b2be8987b3c0556efaa033ba2cb7d

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/09/2026, 19:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118__aed17423bce7fc6a0638bce83f9413b5.dll
Size 199KB
Sample260919-ymd11abe55
SHA256 a741d287614ab9b898a61b3c2145e536b56b2be8987b3c0556efaa033ba2cb7d
MD5 aed17423bce7fc6a0638bce83f9413b5
SHA1 3d638bfcf0570a1242bc60468893cc0714de2eaa
SHA512 ad42af3cfc9619264e0ed84717a670130e1b138cfaaeda821893d59dad57095e54e6f0cf231f30a7b1d0db656e35bb97099215e0eff79b7696923d1dde41a80e
SSDEEP 3072:aGBuI6gObyt15Y1xDDHbS7/aSzZJ5h7x4yZIpV/vUgsmfRpbYewOvo86:ayLFmxTW/PdJ5bbIpKomNO36
TLSH
T13014011BF0348056F0A500B114B61F3A6218E7732FDB48928795EB75A7289DBD0E7B6F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

banker discovery ramnit spyware stealer trojan worm

Malware Config

Signatures

Family: Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Executes dropped EXE 1 IoCs

pid	Process
2252	rundll32mgr.exe

Loads dropped DLL 1 IoCs

pid	Process
2252	rundll32mgr.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3920	2252	WerFault.exe	91

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32mgr.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4780 wrote to memory of 2228	4780	rundll32.exe	90
PID 2228 wrote to memory of 2252	2228	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118__aed17423bce7fc6a0638bce83f9413b5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4780
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118__aed17423bce7fc6a0638bce83f9413b5.dll,#1
  2⤵
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2228
- - C:\Windows\SysWOW64\rundll32mgr.exe
    C:\Windows\SysWOW64\rundll32mgr.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2252
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2252 -s 372
      4⤵
      Program crash
      PID:3920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2252 -ip 2252
1⤵
PID:1048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

~TM9A57.tmp

Path C:\Users\Admin\AppData\Local\Temp\~TM9A57.tmp
Size 1.6MB
SHA256 767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
MD5 4f3387277ccbd6d1f21ac5c07fe4ca68
SHA1 e16506f662dc92023bf82def1d621497c8ab5890
SHA512 9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
SSDEEP 24576:qhYK3o0FvOh/e8AuDq8TJqbEPVVdqi90gvuPGO12HoIGTufqN8:2XFvO5egq8TMbEL59JCKSN
TLSH
T14075D45263F84615F6F73B7059B966700E3A7CA5AB38C2DF228015AE4EB1EC08D71763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rundll32mgr.exe

Path C:\Windows\SysWOW64\rundll32mgr.exe
Size 162KB
SHA256 43c91f0a793c2776757ecec287a2d50cbf331d27f08aa559ffc160a417d3d1ae
MD5 33cd65ebd943a41a3b65fa1ccfce067c
SHA1 715d78b89cadbbd517fec3a48f415e1dc00f92bb
SHA512 ea7c5b04eb5dd99ff38f7699cceef49680c094beab01751a92541e56293f7ecc3381aeca9a8863f95b75b548c0d02cf5127eaaf4cc1f784974981fade9ebeaf2
SSDEEP 3072:rHalmLC1QKt43QtJv7v4OzTz3mynWvNXm9fc7XjoiTg0ur3RTeSU:rEk/Kq3KnD3rnW1hlM7eF
TLSH
T18DF302068B5C13E9F01D717761669E38AE09EA98372CDF77F6905297E8813B37B81B04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2228-1-0x0000000010000000-0x0000000010037000-memory.dmp

Download

memory/2252-4-0x0000000000400000-0x0000000000489124-memory.dmp

Download

memory/2252-6-0x00000000005E0000-0x00000000005E2000-memory.dmp

Download

memory/2252-11-0x0000000077062000-0x0000000077064000-memory.dmp

Download

memory/2252-10-0x0000000077062000-0x0000000077063000-memory.dmp

Download

memory/2252-12-0x0000000000400000-0x0000000000489124-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads