Analysis
- max time kernel
150s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
05/11/2026, 07:33
General
- Target 2026-11-04_e6a12c576f51d315336cb5d0b1cced89_elex_ramnit_stop.exe
- Size 1.0MB
- Sample261105-jdpc2stz2q
- SHA256 34ffb16f4bb5a11f5e447cfca269a077702bcc6a7f2ea18b86acfd571335d248
Malware Config
Signatures
- Family: Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
- Modifies firewall policy service 3 TTPs 6 IoCs
- Custom signatureUPX dump on OEP (original entry point) 12 IoCs
- Executes dropped EXE 10 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- AutoIT Executable 7 IoCs
AutoIT scripts compiled to PE executables.
- Drops file in System32 directory 2 IoCs
- UPX packed file 13 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 6 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Program crash 9 IoCs
- Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies Internet Explorer settings 1 TTPs 10 IoCs
- Modifies Internet Explorer start page 1 TTPs 4 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 22 IoCs
- Suspicious behavior: MapViewOfSection 1 TTPs 64 IoCs
- Suspicious use of AdjustPrivilegeToken 13 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of UnmapMainImage 1 TTPs 6 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-04_e6a12c576f51d315336cb5d0b1cced89_elex_ramnit_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-04_e6a12c576f51d315336cb5d0b1cced89_elex_ramnit_stop.exe"1⤵
- Modifies WinLogon for persistence
- Modifies firewall policy service
- Adds Run key to start application
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-11-04_e6a12c576f51d315336cb5d0b1cced89_elex_ramnit_stopmgr.exeC:\Users\Admin\AppData\Local\Temp\2026-11-04_e6a12c576f51d315336cb5d0b1cced89_elex_ramnit_stopmgr.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"3⤵
- Modifies firewall policy service
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5508 -s 2405⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 13084⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3600 -s 10682⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3600 -ip 36001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5508 -ip 55081⤵
-
C:\Windows\explorer.exeExplorer.exe system3_.exe1⤵
-
C:\Users\Admin\Desktop\system3_.exeC:\Users\Admin\Desktop\system3_.exe1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Desktop\system3_mgr.exeC:\Users\Admin\Desktop\system3_mgr.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 692 -s 2485⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5452 -s 3884⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT /delete /yes2⤵
- Executes dropped EXE
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\at.exeAT /delete /yes3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Users\Admin\Desktop\system3_.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 3283⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5440 -s 19042⤵
- Program crash
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Desktop\system3_.exe"C:\Users\Admin\Desktop\system3_.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Desktop\system3_mgr.exeC:\Users\Admin\Desktop\system3_mgr.exe3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4580 -s 2406⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5460 -s 3365⤵
- Program crash
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 692 -ip 6921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 4580 -ip 45801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2936 -ip 29361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 1940 -ip 19401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 5452 -ip 54521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 5460 -ip 54601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 5440 -ip 54401⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Process Injection
2Process Hollowing
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
5Process Injection
2Process Hollowing
1Replay Monitor
Loading Replay Monitor...
Downloads
setting[2].htm
setting[2].htm
2026-11-04_e6a12c576f51d315336cb5d0b1cced89_elex_ramnit_stopmgr.exe
autorun.ini
system3_.exe
cmd.exe
memory/696-15-0x0000000000400000-0x0000000000421000-memory.dmp
memory/696-16-0x0000000000400000-0x0000000000421000-memory.dmp
memory/696-5-0x0000000000400000-0x0000000000421000-memory.dmp
memory/696-14-0x0000000000400000-0x0000000000421000-memory.dmp
memory/696-13-0x0000000000A20000-0x0000000000A21000-memory.dmp
memory/696-7-0x0000000000401000-0x0000000000402000-memory.dmp
memory/696-9-0x0000000000400000-0x0000000000421000-memory.dmp
memory/696-11-0x0000000000400000-0x0000000000421000-memory.dmp
memory/696-10-0x0000000000400000-0x0000000000421000-memory.dmp
memory/696-8-0x0000000000400000-0x0000000000421000-memory.dmp
memory/696-24-0x000000007FE90000-0x000000007FE9C000-memory.dmp
memory/696-25-0x000000007FE90000-0x000000007FE9C000-memory.dmp
memory/1264-77-0x0000000000400000-0x0000000000524000-memory.dmp
memory/1940-94-0x000000007FE90000-0x000000007FE9C000-memory.dmp
memory/1940-91-0x000000007FE90000-0x000000007FE9C000-memory.dmp
memory/1940-106-0x0000000000400000-0x0000000000421000-memory.dmp
memory/1940-102-0x000000007FE90000-0x000000007FE9C000-memory.dmp
memory/1940-32-0x0000000000060000-0x0000000000061000-memory.dmp
memory/1940-93-0x000000007FE90000-0x000000007FE9C000-memory.dmp
memory/1940-92-0x000000007FE90000-0x000000007FE9C000-memory.dmp
memory/1940-31-0x0000000000400000-0x0000000000421000-memory.dmp
memory/2936-95-0x0000000000400000-0x0000000000464000-memory.dmp
memory/2936-90-0x0000000000400000-0x0000000000464000-memory.dmp
memory/3600-19-0x00000000FFE90000-0x00000000FFE9C000-memory.dmp
memory/3600-21-0x0000000000400000-0x0000000000524000-memory.dmp
memory/3600-17-0x00000000FFE90000-0x00000000FFE9C000-memory.dmp
memory/3600-0-0x0000000000400000-0x0000000000524000-memory.dmp
memory/3600-34-0x00000000FFE90000-0x00000000FFE9C000-memory.dmp
memory/3600-64-0x0000000000400000-0x0000000000524000-memory.dmp
memory/3600-18-0x00000000FFE90000-0x00000000FFE9C000-memory.dmp
memory/3600-20-0x0000000000400000-0x0000000000524000-memory.dmp
memory/4572-47-0x0000000000400000-0x0000000000421000-memory.dmp
memory/5260-65-0x0000000000400000-0x0000000000421000-memory.dmp
memory/5440-145-0x0000000000400000-0x0000000000524000-memory.dmp
memory/5452-55-0x0000000002E30000-0x0000000002E31000-memory.dmp
memory/5452-122-0x0000000000400000-0x0000000000421000-memory.dmp
memory/5460-86-0x0000000000400000-0x0000000000421000-memory.dmp
memory/5460-128-0x0000000000400000-0x0000000000421000-memory.dmp
memory/5460-85-0x0000000000A70000-0x0000000000A71000-memory.dmp
memory/5636-58-0x0000000000400000-0x0000000000464000-memory.dmp
memory/5636-88-0x0000000000400000-0x0000000000464000-memory.dmp