ramnit | 656b84e70239b06d37888d7fcf15cea21100f65389dd5e83361d4c0a3747efd2

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/10/2026, 16:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-02_20a05a3cc523dc5382dcbbce5651e6a7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 523KB
Sample261003-tln3cssbrc
SHA256 656b84e70239b06d37888d7fcf15cea21100f65389dd5e83361d4c0a3747efd2
MD5 20a05a3cc523dc5382dcbbce5651e6a7
SHA1 47771ebd5cb7420c8113e982ef829aeddab8343b
SHA512 e52ce31613a16653b21dcda255a6ad62f39ca8c38a1c560b5ae4ef43c9d76cf59d1d1b538322ee22f852e0f13b96a0a0f8b9c694803aeaf3171935ec9a3eb3be
SSDEEP 12288:R7q4hxhQQtqBotsyed7zfOoNhyG5yW9NN9dSF8RN8jN:RWO8BotsfVfxp1SF8RN8N
TLSH
T1E7B4DF11B380C032D46715764167C7B18A7ABC3667399A8BBBD53EBC5F353E0AB2530A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

banker defense_evasion discovery ramnit spyware stealer trojan upx worm

Malware Config

Signatures

Family: Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral1/memory/3768-14-0x00000000004B0000-0x00000000004DA000-memory.dmp	UPX
behavioral1/memory/3768-24-0x0000000000400000-0x000000000042A000-memory.dmp	UPX

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
4768	~DF8D0.tmp

Executes dropped EXE 4 IoCs

pid	Process
4768	~DF8D0.tmp
3768	2026-10-02_20a05a3cc523dc5382dcbbce5651e6a7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5204	cupate.exe
6008	~~tmpxF3C0027.exe

Loads dropped DLL 1 IoCs

pid	Process
3768	2026-10-02_20a05a3cc523dc5382dcbbce5651e6a7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\~~tmpxF3C0027.exe	cupate.exe
File created	C:\Windows\SysWOW64\~~tmpxF3C0027.exec	cupate.exe
File opened for modification	C:\Windows\SysWOW64\cupate.exe	~~tmpxF3C0027.exe
File created	C:\Windows\SysWOW64\cupate.exe	~DF8D0.tmp
File opened for modification	C:\Windows\SysWOW64\cupate.exe	~DF8D0.tmp

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3768-24-0x0000000000400000-0x000000000042A000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1272	3768	WerFault.exe	91

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	~~tmpxF3C0027.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	~~tmpxF3C0027.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-02_20a05a3cc523dc5382dcbbce5651e6a7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	~DF8D0.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cupate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-02_20a05a3cc523dc5382dcbbce5651e6a7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
6008	~~tmpxF3C0027.exe
6008	~~tmpxF3C0027.exe
6008	~~tmpxF3C0027.exe
6008	~~tmpxF3C0027.exe
6008	~~tmpxF3C0027.exe
6008	~~tmpxF3C0027.exe
6008	~~tmpxF3C0027.exe
6008	~~tmpxF3C0027.exe
6008	~~tmpxF3C0027.exe
6008	~~tmpxF3C0027.exe
6008	~~tmpxF3C0027.exe
6008	~~tmpxF3C0027.exe
6008	~~tmpxF3C0027.exe
6008	~~tmpxF3C0027.exe
6008	~~tmpxF3C0027.exe
6008	~~tmpxF3C0027.exe
6008	~~tmpxF3C0027.exe
6008	~~tmpxF3C0027.exe
6008	~~tmpxF3C0027.exe
6008	~~tmpxF3C0027.exe
6008	~~tmpxF3C0027.exe
6008	~~tmpxF3C0027.exe
6008	~~tmpxF3C0027.exe
6008	~~tmpxF3C0027.exe
6008	~~tmpxF3C0027.exe
6008	~~tmpxF3C0027.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3720 wrote to memory of 4768	3720	2026-10-02_20a05a3cc523dc5382dcbbce5651e6a7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	87
PID 4768 wrote to memory of 3768	4768	~DF8D0.tmp	91
PID 4768 wrote to memory of 5204	4768	~DF8D0.tmp	92
PID 5204 wrote to memory of 6008	5204	cupate.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-10-02_20a05a3cc523dc5382dcbbce5651e6a7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-02_20a05a3cc523dc5382dcbbce5651e6a7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3720
- C:\Users\Admin\AppData\Local\Temp\~DF8D0.tmp
  C:\Users\Admin\AppData\Local\Temp\~DF8D0.tmp _$PID:308 _$EXE:C:\Users\Admin\AppData\Local\Temp\2026-10-02_20a05a3cc523dc5382dcbbce5651e6a7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe _$CMDLINE:
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4768
- - C:\Users\Admin\AppData\Local\Temp\2026-10-02_20a05a3cc523dc5382dcbbce5651e6a7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
    C:\Users\Admin\AppData\Local\Temp\2026-10-02_20a05a3cc523dc5382dcbbce5651e6a7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:3768
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3768 -s 496
      4⤵
      Program crash
      PID:1272
- - C:\Windows\SysWOW64\cupate.exe
    cupate.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5204
  - - C:\Windows\SysWOW64\~~tmpxF3C0027.exe
      C:\Windows\SysWOW64\~~tmpxF3C0027.exe C:\Windows\SysWOW64\cupate.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:6008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3768 -ip 3768
1⤵
PID:3340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-10-02_20a05a3cc523dc5382dcbbce5651e6a7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_20a05a3cc523dc5382dcbbce5651e6a7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 106KB
SHA256 f34e5af97ccb3574f7d5343246138daf979bfd1f9c37590e9a41f6420ddb3bb6
MD5 fe36fb1073e6f8fa14d7250501a29aaf
SHA1 6c7e01278362797dabcff3e666b68227cb9af10f
SHA512 8584c008c5780352f634c37b7f46543a26280b57577b675f6e72185bfc1d95f771d210d799d704eceaba509ebfd2796fb43829495d5b2a568c741ad2d44f882f
SSDEEP 3072:nr6W2wIcju6IIXlNPQmTh907Y6lP/8qkrHKI:r6gI4u6lXnxh65QN
TLSH
T14DB3F13DDE0EB470CD5AEA32CCD108128017B3F3EAB95A091E522DD45D2AA761F15BF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~DF8D0.tmp

Path C:\Users\Admin\AppData\Local\Temp\~DF8D0.tmp
Size 523KB
SHA256 656b84e70239b06d37888d7fcf15cea21100f65389dd5e83361d4c0a3747efd2
MD5 20a05a3cc523dc5382dcbbce5651e6a7
SHA1 47771ebd5cb7420c8113e982ef829aeddab8343b
SHA512 e52ce31613a16653b21dcda255a6ad62f39ca8c38a1c560b5ae4ef43c9d76cf59d1d1b538322ee22f852e0f13b96a0a0f8b9c694803aeaf3171935ec9a3eb3be
SSDEEP 12288:R7q4hxhQQtqBotsyed7zfOoNhyG5yW9NN9dSF8RN8jN:RWO8BotsfVfxp1SF8RN8N
TLSH
T1E7B4DF11B380C032D46715764167C7B18A7ABC3667399A8BBBD53EBC5F353E0AB2530A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~TMEBC.tmp

Path C:\Users\Admin\AppData\Local\Temp\~TMEBC.tmp
Size 1.6MB
SHA256 767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
MD5 4f3387277ccbd6d1f21ac5c07fe4ca68
SHA1 e16506f662dc92023bf82def1d621497c8ab5890
SHA512 9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
SSDEEP 24576:qhYK3o0FvOh/e8AuDq8TJqbEPVVdqi90gvuPGO12HoIGTufqN8:2XFvO5egq8TMbEL59JCKSN
TLSH
T14075D45263F84615F6F73B7059B966700E3A7CA5AB38C2DF228015AE4EB1EC08D71763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cupate.exe

Path C:\Windows\SysWOW64\cupate.exe
Size 275KB
SHA256 402a8e7c29135edeed5936c7b5d3524f095bdab37658999fc3fa636b6b38e027
MD5 3165b7472a9dd45cde49538561cba59f
SHA1 23eda5538d21e678e32919bf61330be6a7b85866
SHA512 b6eadf8420c6057ba860546d49787358800889c829c4dfefde84aaac46d9bf91f5836f8d0ca248383d828a869eb86c44a36a9fea2abe263515abaab0cef7e3d9
SSDEEP 6144:YOy2BoNPeogLyfosoJsAdSjZoJ1r+sOodIe9meyG5yW9NN9L8:YqBotsyed7zfOoNhyG5yW9NN9Y
TLSH
T1B354BF017381D473D05300BA522BC7B28EBAB835272969C7FBC51EB95F653E1F62630A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~~tmpxF3C0027.exe

Path C:\Windows\SysWOW64\~~tmpxF3C0027.exe
Size 107KB
SHA256 b3d6d4bbef083a5eb7186c9de74cbe6faed9f13998844dd74fe5683ae1d09db5
MD5 f772bf95dc562925d7fdcd0d1490422c
SHA1 c81514b21c7d368fd058a21775f91810a7c7545b
SHA512 38473df03544d4a067304f4936a60c8b83df1fb507a2abac95ee7b95a7934b3ff8a56bf9cf1a2f8eded5a9a35f484322016b0fbed21e66b55f2276d3e2f9f841
SSDEEP 3072:F7HUf6tjRZuV5Y7MCKGh93oDC0Qw6u4cF:F7Bt9ZLRKC9YQ6
TLSH
T188B37C4AB36400F9C843C67ACDD16666FB72B4161772538F0B1899A65F233B1FD2E712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~~tmpxF3C0027.exec

Path C:\Windows\SysWOW64\~~tmpxF3C0027.exec
Size 1KB
SHA256 bcc1df9a8cfe6458b8cfb02f7921d83458217f7d12dd4711b3a2f1a9c5ffe730
MD5 9b43b55f3fcf5b64309a9ceaa82d98c1
SHA1 39c0086a2fa6965efc6c1fd4c93da0ce67b77477
SHA512 81a106c499aebbf33ce6e924f8e91af701cae2b8dfa24e5acc278fa38d2df880aa9895c405d45bd3ae712919b7f2a44efb254f0e7083df773210db873252f7bd
TLSH
T1B731DAF6A2445720DD2447B09D7DECC849B6650674BA1B094DB4D70B381BAF492F458D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3768-14-0x00000000004B0000-0x00000000004DA000-memory.dmp

Download

memory/3768-20-0x0000000077092000-0x0000000077094000-memory.dmp

Download

memory/3768-19-0x0000000077092000-0x0000000077093000-memory.dmp

Download

memory/3768-24-0x0000000000400000-0x000000000042A000-memory.dmp

Download