Ramnit

Sample and other info:
https://www.hybrid-analysis.com/sample/8be30a1c015b36cea789f830466362f64fc6589238e24343816decef6ba3394a?environmentId=100
https://packettotal.com/cgi-bin/view-analysis.cgi?id=1ac871b3cf3197d0fd26dc7acf0a3668
https://threatintel.proofpoint.com/sid/2018558

After execution dumps itself into:
C:\Users\<username>\AppDate\Local\<rnddir>\<rnd>.exe
C:\Users\<username>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\<rnd>.exe

After reboot:
Injects into svchost.exe
Fires off to several DGA domains (ET sid 2018558)
Modifies several registry settings, pretty much nukes MS Security Center
Sets a TRUE flag (am I installed?)
Set userinit as another method of persistence (by my count I see 3...this thing REALLY wants to run..)
Watchdogs svchost and will restart if terminated