ramnit | 656b84e70239b06d37888d7fcf15cea21100f65389dd5e83361d4c0a3747efd2

Analysis

max time kernel
148s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 16:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-02_20a05a3cc523dc5382dcbbce5651e6a7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 523KB
Sample261003-tln3cssbrc
SHA256 656b84e70239b06d37888d7fcf15cea21100f65389dd5e83361d4c0a3747efd2
MD5 20a05a3cc523dc5382dcbbce5651e6a7
SHA1 47771ebd5cb7420c8113e982ef829aeddab8343b
SHA512 e52ce31613a16653b21dcda255a6ad62f39ca8c38a1c560b5ae4ef43c9d76cf59d1d1b538322ee22f852e0f13b96a0a0f8b9c694803aeaf3171935ec9a3eb3be
SSDEEP 12288:R7q4hxhQQtqBotsyed7zfOoNhyG5yW9NN9dSF8RN8jN:RWO8BotsfVfxp1SF8RN8N
TLSH
T1E7B4DF11B380C032D46715764167C7B18A7ABC3667399A8BBBD53EBC5F353E0AB2530A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

banker defense_evasion discovery ramnit spyware stealer trojan upx worm

Malware Config

Signatures

Family: Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral2/memory/968-9-0x00000000021A0000-0x00000000021CA000-memory.dmp	UPX
behavioral2/memory/968-21-0x0000000000400000-0x000000000042A000-memory.dmp	UPX

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
5408	~DF7229.tmp

Executes dropped EXE 4 IoCs

pid	Process
5408	~DF7229.tmp
968	2026-10-02_20a05a3cc523dc5382dcbbce5651e6a7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4472	cupate.exe
4120	~~tmpxF3C0027.exe

Loads dropped DLL 1 IoCs

pid	Process
968	2026-10-02_20a05a3cc523dc5382dcbbce5651e6a7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\cupate.exe	~DF7229.tmp
File opened for modification	C:\Windows\SysWOW64\cupate.exe	~DF7229.tmp
File created	C:\Windows\SysWOW64\~~tmpxF3C0027.exe	cupate.exe
File created	C:\Windows\SysWOW64\~~tmpxF3C0027.exec	cupate.exe
File opened for modification	C:\Windows\SysWOW64\cupate.exe	~~tmpxF3C0027.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/968-21-0x0000000000400000-0x000000000042A000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4796	968	WerFault.exe	91

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	~~tmpxF3C0027.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	~~tmpxF3C0027.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-02_20a05a3cc523dc5382dcbbce5651e6a7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	~DF7229.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-02_20a05a3cc523dc5382dcbbce5651e6a7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cupate.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
4120	~~tmpxF3C0027.exe
4120	~~tmpxF3C0027.exe
4120	~~tmpxF3C0027.exe
4120	~~tmpxF3C0027.exe
4120	~~tmpxF3C0027.exe
4120	~~tmpxF3C0027.exe
4120	~~tmpxF3C0027.exe
4120	~~tmpxF3C0027.exe
4120	~~tmpxF3C0027.exe
4120	~~tmpxF3C0027.exe
4120	~~tmpxF3C0027.exe
4120	~~tmpxF3C0027.exe
4120	~~tmpxF3C0027.exe
4120	~~tmpxF3C0027.exe
4120	~~tmpxF3C0027.exe
4120	~~tmpxF3C0027.exe
4120	~~tmpxF3C0027.exe
4120	~~tmpxF3C0027.exe
4120	~~tmpxF3C0027.exe
4120	~~tmpxF3C0027.exe
4120	~~tmpxF3C0027.exe
4120	~~tmpxF3C0027.exe
4120	~~tmpxF3C0027.exe
4120	~~tmpxF3C0027.exe
4120	~~tmpxF3C0027.exe
4120	~~tmpxF3C0027.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5940 wrote to memory of 5408	5940	2026-10-02_20a05a3cc523dc5382dcbbce5651e6a7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 5408 wrote to memory of 968	5408	~DF7229.tmp	91
PID 5408 wrote to memory of 4472	5408	~DF7229.tmp	92
PID 4472 wrote to memory of 4120	4472	cupate.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-10-02_20a05a3cc523dc5382dcbbce5651e6a7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-02_20a05a3cc523dc5382dcbbce5651e6a7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5940
- C:\Users\Admin\AppData\Local\Temp\~DF7229.tmp
  C:\Users\Admin\AppData\Local\Temp\~DF7229.tmp _$PID:352 _$EXE:C:\Users\Admin\AppData\Local\Temp\2026-10-02_20a05a3cc523dc5382dcbbce5651e6a7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe _$CMDLINE:
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5408
- - C:\Users\Admin\AppData\Local\Temp\2026-10-02_20a05a3cc523dc5382dcbbce5651e6a7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
    C:\Users\Admin\AppData\Local\Temp\2026-10-02_20a05a3cc523dc5382dcbbce5651e6a7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:968
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 968 -s 552
      4⤵
      Program crash
      PID:4796
- - C:\Windows\SysWOW64\cupate.exe
    cupate.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4472
  - - C:\Windows\SysWOW64\~~tmpxF3C0027.exe
      C:\Windows\SysWOW64\~~tmpxF3C0027.exe C:\Windows\SysWOW64\cupate.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:4120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 968 -ip 968
1⤵
PID:6060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-10-02_20a05a3cc523dc5382dcbbce5651e6a7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_20a05a3cc523dc5382dcbbce5651e6a7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 106KB
SHA256 f34e5af97ccb3574f7d5343246138daf979bfd1f9c37590e9a41f6420ddb3bb6
MD5 fe36fb1073e6f8fa14d7250501a29aaf
SHA1 6c7e01278362797dabcff3e666b68227cb9af10f
SHA512 8584c008c5780352f634c37b7f46543a26280b57577b675f6e72185bfc1d95f771d210d799d704eceaba509ebfd2796fb43829495d5b2a568c741ad2d44f882f
SSDEEP 3072:nr6W2wIcju6IIXlNPQmTh907Y6lP/8qkrHKI:r6gI4u6lXnxh65QN
TLSH
T14DB3F13DDE0EB470CD5AEA32CCD108128017B3F3EAB95A091E522DD45D2AA761F15BF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~DF7229.tmp

Path C:\Users\Admin\AppData\Local\Temp\~DF7229.tmp
Size 523KB
SHA256 656b84e70239b06d37888d7fcf15cea21100f65389dd5e83361d4c0a3747efd2
MD5 20a05a3cc523dc5382dcbbce5651e6a7
SHA1 47771ebd5cb7420c8113e982ef829aeddab8343b
SHA512 e52ce31613a16653b21dcda255a6ad62f39ca8c38a1c560b5ae4ef43c9d76cf59d1d1b538322ee22f852e0f13b96a0a0f8b9c694803aeaf3171935ec9a3eb3be
SSDEEP 12288:R7q4hxhQQtqBotsyed7zfOoNhyG5yW9NN9dSF8RN8jN:RWO8BotsfVfxp1SF8RN8N
TLSH
T1E7B4DF11B380C032D46715764167C7B18A7ABC3667399A8BBBD53EBC5F353E0AB2530A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~TM7872.tmp

Path C:\Users\Admin\AppData\Local\Temp\~TM7872.tmp
Size 1.7MB
SHA256 45369a39532d605353ca49d2c2c901853cd5181e84b64fbfbfdb19d5fe60539d
MD5 a49bad7718978035494a1ba8f445753c
SHA1 2975908be9449bd695a57d192850626f2519b838
SHA512 04c53db2b9768e619bd24cd55ac87cac0ef5b6164345f18c57c950e5704efa98d4f60767c4a15ff88f5df562f3ff16b250d92ca1b9244086b403fba25c69eea8
SSDEEP 24576:mJVny4SiGGB49pFrjWpbqne6fuYQSX+UIXzbqF/j/2AqfsqLrDZaXIIDA6eW:D4SGODe6fuNs+UWzKj+AbqcXUW
TLSH
T15C85B35163E94215F6F73B7059BD26340E7A7CA5AB78C2DF128411AE8EB0EC08D717A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cupate.exe

Path C:\Windows\SysWOW64\cupate.exe
Size 275KB
SHA256 402a8e7c29135edeed5936c7b5d3524f095bdab37658999fc3fa636b6b38e027
MD5 3165b7472a9dd45cde49538561cba59f
SHA1 23eda5538d21e678e32919bf61330be6a7b85866
SHA512 b6eadf8420c6057ba860546d49787358800889c829c4dfefde84aaac46d9bf91f5836f8d0ca248383d828a869eb86c44a36a9fea2abe263515abaab0cef7e3d9
SSDEEP 6144:YOy2BoNPeogLyfosoJsAdSjZoJ1r+sOodIe9meyG5yW9NN9L8:YqBotsyed7zfOoNhyG5yW9NN9Y
TLSH
T1B354BF017381D473D05300BA522BC7B28EBAB835272969C7FBC51EB95F653E1F62630A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~~tmpxF3C0027.exe

Path C:\Windows\SysWOW64\~~tmpxF3C0027.exe
Size 107KB
SHA256 b3d6d4bbef083a5eb7186c9de74cbe6faed9f13998844dd74fe5683ae1d09db5
MD5 f772bf95dc562925d7fdcd0d1490422c
SHA1 c81514b21c7d368fd058a21775f91810a7c7545b
SHA512 38473df03544d4a067304f4936a60c8b83df1fb507a2abac95ee7b95a7934b3ff8a56bf9cf1a2f8eded5a9a35f484322016b0fbed21e66b55f2276d3e2f9f841
SSDEEP 3072:F7HUf6tjRZuV5Y7MCKGh93oDC0Qw6u4cF:F7Bt9ZLRKC9YQ6
TLSH
T188B37C4AB36400F9C843C67ACDD16666FB72B4161772538F0B1899A65F233B1FD2E712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~~tmpxF3C0027.exec

Path C:\Windows\SysWOW64\~~tmpxF3C0027.exec
Size 1KB
SHA256 bcc1df9a8cfe6458b8cfb02f7921d83458217f7d12dd4711b3a2f1a9c5ffe730
MD5 9b43b55f3fcf5b64309a9ceaa82d98c1
SHA1 39c0086a2fa6965efc6c1fd4c93da0ce67b77477
SHA512 81a106c499aebbf33ce6e924f8e91af701cae2b8dfa24e5acc278fa38d2df880aa9895c405d45bd3ae712919b7f2a44efb254f0e7083df773210db873252f7bd
TLSH
T1B731DAF6A2445720DD2447B09D7DECC849B6650674BA1B094DB4D70B381BAF492F458D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/968-9-0x00000000021A0000-0x00000000021CA000-memory.dmp

Download

memory/968-13-0x0000000077178000-0x0000000077179000-memory.dmp

Download

memory/968-21-0x0000000000400000-0x000000000042A000-memory.dmp

Download