ramnit | a741d287614ab9b898a61b3c2145e536b56b2be8987b3c0556efaa033ba2cb7d

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/09/2026, 19:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118__aed17423bce7fc6a0638bce83f9413b5.dll
Size 199KB
Sample260919-ymd11abe55
SHA256 a741d287614ab9b898a61b3c2145e536b56b2be8987b3c0556efaa033ba2cb7d
MD5 aed17423bce7fc6a0638bce83f9413b5
SHA1 3d638bfcf0570a1242bc60468893cc0714de2eaa
SHA512 ad42af3cfc9619264e0ed84717a670130e1b138cfaaeda821893d59dad57095e54e6f0cf231f30a7b1d0db656e35bb97099215e0eff79b7696923d1dde41a80e
SSDEEP 3072:aGBuI6gObyt15Y1xDDHbS7/aSzZJ5h7x4yZIpV/vUgsmfRpbYewOvo86:ayLFmxTW/PdJ5bbIpKomNO36
TLSH
T13014011BF0348056F0A500B114B61F3A6218E7732FDB48928795EB75A7289DBD0E7B6F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

banker discovery ramnit spyware stealer trojan worm

Malware Config

Signatures

Family: Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Executes dropped EXE 1 IoCs

pid	Process
5256	rundll32mgr.exe

Loads dropped DLL 1 IoCs

pid	Process
5256	rundll32mgr.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4560	5256	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32mgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 1168	756	rundll32.exe	88
PID 1168 wrote to memory of 5256	1168	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118__aed17423bce7fc6a0638bce83f9413b5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:756
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118__aed17423bce7fc6a0638bce83f9413b5.dll,#1
  2⤵
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1168
- - C:\Windows\SysWOW64\rundll32mgr.exe
    C:\Windows\SysWOW64\rundll32mgr.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:5256
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5256 -s 528
      4⤵
      Program crash
      PID:4560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5256 -ip 5256
1⤵
PID:5764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

~TME27B.tmp

Path C:\Users\Admin\AppData\Local\Temp\~TME27B.tmp
Size 1.7MB
SHA256 45369a39532d605353ca49d2c2c901853cd5181e84b64fbfbfdb19d5fe60539d
MD5 a49bad7718978035494a1ba8f445753c
SHA1 2975908be9449bd695a57d192850626f2519b838
SHA512 04c53db2b9768e619bd24cd55ac87cac0ef5b6164345f18c57c950e5704efa98d4f60767c4a15ff88f5df562f3ff16b250d92ca1b9244086b403fba25c69eea8
SSDEEP 24576:mJVny4SiGGB49pFrjWpbqne6fuYQSX+UIXzbqF/j/2AqfsqLrDZaXIIDA6eW:D4SGODe6fuNs+UWzKj+AbqcXUW
TLSH
T15C85B35163E94215F6F73B7059BD26340E7A7CA5AB78C2DF128411AE8EB0EC08D717A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rundll32mgr.exe

Path C:\Windows\SysWOW64\rundll32mgr.exe
Size 162KB
SHA256 43c91f0a793c2776757ecec287a2d50cbf331d27f08aa559ffc160a417d3d1ae
MD5 33cd65ebd943a41a3b65fa1ccfce067c
SHA1 715d78b89cadbbd517fec3a48f415e1dc00f92bb
SHA512 ea7c5b04eb5dd99ff38f7699cceef49680c094beab01751a92541e56293f7ecc3381aeca9a8863f95b75b548c0d02cf5127eaaf4cc1f784974981fade9ebeaf2
SSDEEP 3072:rHalmLC1QKt43QtJv7v4OzTz3mynWvNXm9fc7XjoiTg0ur3RTeSU:rEk/Kq3KnD3rnW1hlM7eF
TLSH
T18DF302068B5C13E9F01D717761669E38AE09EA98372CDF77F6905297E8813B37B81B04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1168-1-0x0000000010000000-0x0000000010037000-memory.dmp

Download

memory/5256-5-0x0000000000400000-0x0000000000489124-memory.dmp

Download

memory/5256-7-0x0000000000A60000-0x0000000000A62000-memory.dmp

Download

memory/5256-9-0x0000000077508000-0x0000000077509000-memory.dmp

Download

memory/5256-10-0x0000000000400000-0x0000000000489124-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads