Analysis Report zQ32b1FVcL.dll

Overview

General Information

Sample Name:	zQ32b1FVcL.dll
Analysis ID:	338663
MD5:	eed4174c8a96dd7b611d9f109c71e20f
SHA1:	c471724d86fd269a19932280361ca52e1e294f19
SHA256:	e5dc940537146c1c56b8a8f91234484c83223943c13d2fbf354f0cfdec13c258
Tags:	dllGozi
Most interesting Screenshot:

Detection

Ursnif

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Yara detected Ursnif

Writes or reads registry keys via WMI

Writes registry values via WMI

Antivirus or Machine Learning detection for unpacked file

Contains functionality to call native functions

Contains functionality to query CPU information (cpuid)

Detected potential crypto function

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE / OLE file has an invalid certificate

PE file contains sections with non-standard names

PE file contains strange resources

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Signatures

AV Detection:

Found malware configuration

Source: loaddll32.exe.6132.1.memstr

Malware Configuration Extractor: Ursnif {"server": "12", "whoami": "user@320946", "dns": "320946", "version": "250171", "uptime": "266", "crc": "1", "id": "5533", "user": "253fc4ee08f8d2d8cdc8873aab08ddd5", "soft": "2"}

Antivirus or Machine Learning detection for unpacked file

Source: 1.2.loaddll32.exe.cc0000.2.unpack	Avira: Label: TR/Crypt.XPACK.Gen8
Source: 1.2.loaddll32.exe.10000000.4.unpack	Avira: Label: TR/Crypt.XPACK.Gen8

Compliance:

Uses 32bit PE files

Source: zQ32b1FVcL.dll

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL, LINE_NUMS_STRIPPED

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_00CF523C RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,memset,CreateFileA,GetFileTime,FindCloseChangeNotification,StrRChrA,lstrcat,FindFirstFileA,FindFirstFileA,CompareFileTime,CompareFileTime,FindClose,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,StrChrA,memcpy,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,FindClose,HeapFree,HeapFree,

1_2_00CF523C

Source: global traffic	HTTP traffic detected: GET /images/FYBARzKsgpw7r/GeKZtzzc/xoDGsIA1G8WlOKnsrCv_2F5/ejqDaRsnD5/ZD4RH6oQdxqfB9mxw/6WnzZpVL425M/CKmLBjBrvSn/f81OVwTXuZJrQZ/ja96eHVtqviz347i3JPx7/5Q6Nnj7RuUGPOFSU/4_2BMMGnBKrRLtO/P_2FyE_2BfezXukLEe/1gUCCjKEM/NO_2BQ8BNJkX/Zge.avi HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, /Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: begoventa.topConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: begoventa.topConnection: Keep-Alive

Source: msapplication.xml0.16.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x482e4b07,0x01d6e951</date><accdate>0x482e4b07,0x01d6e951</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml0.16.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x482e4b07,0x01d6e951</date><accdate>0x482e4b07,0x01d6e951</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml5.16.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x48330f3c,0x01d6e951</date><accdate>0x48330f3c,0x01d6e951</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml5.16.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x48330f3c,0x01d6e951</date><accdate>0x48330f3c,0x01d6e951</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml7.16.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x483571cf,0x01d6e951</date><accdate>0x483571cf,0x01d6e951</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: msapplication.xml7.16.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x483571cf,0x01d6e951</date><accdate>0x4837d4a4,0x01d6e951</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)

Source: unknown

DNS traffic detected: queries for: babidone.top

Source: {8CB598BC-5544-11EB-90E4-ECF4BB862DED}.dat.24.dr	String found in binary or memory: http://babidone.top/images/tA_2BVY2gpEVQoau7_/2F_2Fif0j/qHSdUWFKPJWkX50svEcy/JM_2Bha3oNIg2DGHFKu/s3R
Source: loaddll32.exe, 00000001.00000002.590862827.0000000001260000.00000002.00000001.sdmp	String found in binary or memory: http://begoventa.top/images/FYBARzKsgpw7r/GeKZtzzc/xoDGsIA1G8WlOKnsrCv_2F5/ejqDaRsnD5/ZD4RH6oQd
Source: {B10F0CC6-5544-11EB-90E4-ECF4BB862DED}.dat.34.dr	String found in binary or memory: http://begoventa.top/images/FYBARzKsgpw7r/GeKZtzzc/xoDGsIA1G8WlOKnsrCv_2F5/ejqDaRsnD5/ZD4RH6oQdxqfB9
Source: zQ32b1FVcL.dll	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: zQ32b1FVcL.dll	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: zQ32b1FVcL.dll	String found in binary or memory: http://ocsp.sectigo.com0
Source: msapplication.xml.16.dr	String found in binary or memory: http://www.amazon.com/
Source: msapplication.xml1.16.dr	String found in binary or memory: http://www.google.com/
Source: msapplication.xml2.16.dr	String found in binary or memory: http://www.live.com/
Source: msapplication.xml3.16.dr	String found in binary or memory: http://www.nytimes.com/
Source: msapplication.xml4.16.dr	String found in binary or memory: http://www.reddit.com/
Source: msapplication.xml5.16.dr	String found in binary or memory: http://www.twitter.com/
Source: msapplication.xml6.16.dr	String found in binary or memory: http://www.wikipedia.com/
Source: msapplication.xml7.16.dr	String found in binary or memory: http://www.youtube.com/
Source: loaddll32.exe, 00000001.00000002.589354244.000000000050B000.00000004.00000020.sdmp	String found in binary or memory: https://babidone.top/images/SD1b2IxKgGl/yu82lOMR21XtBT/D978a7t2zaVGKWj8Jhn4X/WcqZuBMBlmeeUEpv/9Sv89p
Source: zQ32b1FVcL.dll	String found in binary or memory: https://sectigo.com/CPS0D

Source: unknown

Network traffic detected: HTTP traffic on port 49754 -> 443

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected Ursnif

Source: Yara match	File source: 00000001.00000003.303180413.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.303205645.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.302945060.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.303072523.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.303036485.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.302845992.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.591350377.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.303010833.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.303117277.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 6132, type: MEMORY

E-Banking Fraud:

Yara detected Ursnif

Source: Yara match	File source: 00000001.00000003.303180413.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.303205645.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.302945060.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.303072523.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.303036485.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.302845992.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.591350377.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.303010833.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.303117277.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 6132, type: MEMORY

System Summary:

Writes or reads registry keys via WMI

Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetStringValue
Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue

Writes registry values via WMI

Source: C:\Windows\System32\loaddll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\System32\loaddll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\System32\loaddll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue

Contains functionality to call native functions

Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_10001812 NtMapViewOfSection,	1_2_10001812
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_10001DD0 GetProcAddress,NtCreateSection,memset,	1_2_10001DD0
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_100022E5 NtQueryVirtualMemory,	1_2_100022E5
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00CF9932 NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose,	1_2_00CF9932
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00CFB2C1 NtQueryVirtualMemory,	1_2_00CFB2C1

Detected potential crypto function

Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_100020C4	1_2_100020C4
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00CFB09C	1_2_00CFB09C
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00CFEC48	1_2_00CFEC48
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00CFEC41	1_2_00CFEC41
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00CF99FC	1_2_00CF99FC

PE / OLE file has an invalid certificate

Source: zQ32b1FVcL.dll

Static PE information: invalid certificate

PE file contains strange resources

Source: zQ32b1FVcL.dll

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Sample file is different than original file name gathered from version info

Source: zQ32b1FVcL.dll

Binary or memory string: OriginalFilename360SkinView.exeF vs zQ32b1FVcL.dll

Uses 32bit PE files

Source: zQ32b1FVcL.dll

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL, LINE_NUMS_STRIPPED

Source: classification engine

Classification label: mal64.troj.winDLL@13/44@4/3

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_00CF244A CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

1_2_00CF244A

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DFD53763C3DA639732.TMP

Jump to behavior

Source: zQ32b1FVcL.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\zQ32b1FVcL.dll'
Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6388 CREDAT:17410 /prefetch:2
Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:1140 CREDAT:17410 /prefetch:2
Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:3288 CREDAT:17410 /prefetch:2
Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:3984 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6388 CREDAT:17410 /prefetch:2	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:1140 CREDAT:17410 /prefetch:2	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:3288 CREDAT:17410 /prefetch:2	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:3984 CREDAT:17410 /prefetch:2	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Data Obfuscation:

PE file contains sections with non-standard names

Source: zQ32b1FVcL.dll

Static PE information: section name: .data2

Uses code obfuscation techniques (call, push, ret)

Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_100020B3 push ecx; ret	1_2_100020C3
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_10002060 push ecx; ret	1_2_10002069
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00CFACD0 push ecx; ret	1_2_00CFACD9
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00CFB08B push ecx; ret	1_2_00CFB09B
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00C81830 push edx; ret	1_2_00C81934
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00C644CE push edx; ret	1_2_00C644CF
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00C611C0 push eax; iretd	1_2_00C611D6
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00C615D6 push ecx; ret	1_2_00C615D7
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00C63DFA push ecx; retf	1_2_00C63E01
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00C65116 pushad ; ret	1_2_00C65129
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00C63E99 push FFFFFFCFh; retf	1_2_00C63EC7
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00C63A4D push 92BB463Fh; iretd	1_2_00C63A52
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00C643F7 push ss; ret	1_2_00C643F8
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00C63F02 push dword ptr [edi+64h]; iretd	1_2_00C63F0C

Hooking and other Techniques for Hiding and Protection:

Yara detected Ursnif

Source: Yara match	File source: 00000001.00000003.303180413.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.303205645.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.302945060.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.303072523.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.303036485.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.302845992.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.591350377.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.303010833.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.303117277.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 6132, type: MEMORY

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Windows\System32\loaddll32.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

1_2_00CF523C

Source: loaddll32.exe, 00000001.00000002.589296510.00000000004F9000.00000004.00000020.sdmp

Binary or memory string: Hyper-V RAWH

Source: C:\Windows\System32\loaddll32.exe

Memory protected: page execute read | page guard

Jump to behavior

Source: loaddll32.exe, 00000001.00000002.590862827.0000000001260000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: loaddll32.exe, 00000001.00000002.590862827.0000000001260000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: loaddll32.exe, 00000001.00000002.590862827.0000000001260000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: loaddll32.exe, 00000001.00000002.590862827.0000000001260000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Contains functionality to query CPU information (cpuid)

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_00CF5DC6 cpuid

1_2_00CF5DC6

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_100019C7 GetSystemTime,SwitchToThread,Sleep,GetLongPathNameW,GetLongPathNameW,GetLongPathNameW,CreateThread,GetLastError,QueueUserAPC,CloseHandle,GetLastError,TerminateThread,CloseHandle,SetLastError,WaitForSingleObject,GetExitCodeThread,CloseHandle,GetLastError,GetLastError,

1_2_100019C7

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_00CF5DC6 RtlAllocateHeap,GetUserNameW,RtlAllocateHeap,GetUserNameW,HeapFree,GetComputerNameW,GetComputerNameW,RtlAllocateHeap,GetComputerNameW,HeapFree,

1_2_00CF5DC6

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_10001799 CreateEventA,GetVersion,GetCurrentProcessId,OpenProcess,GetLastError,

1_2_10001799

Stealing of Sensitive Information:

Yara detected Ursnif

Source: Yara match	File source: 00000001.00000003.303180413.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.303205645.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.302945060.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.303072523.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.303036485.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.302845992.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.591350377.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.303010833.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.303117277.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 6132, type: MEMORY

Remote Access Functionality:

Yara detected Ursnif

Source: Yara match	File source: 00000001.00000003.303180413.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.303205645.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.302945060.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.303072523.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.303036485.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.302845992.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.591350377.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.303010833.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.303117277.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 6132, type: MEMORY

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.56.255.166	unknown	Romania		213137	INFOCLOUD-SRLMD	false
47.91.89.242	unknown	United States		45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	false

Private

IP
192.168.2.1

Contacted Domains

Name	IP	Active
begoventa.top	47.91.89.242	true
babidone.top	193.56.255.166	true

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://begoventa.top/favicon.ico	false	Avira URL Cloud: safe	unknown
http://begoventa.top/images/FYBARzKsgpw7r/GeKZtzzc/xoDGsIA1G8WlOKnsrCv_2F5/ejqDaRsnD5/ZD4RH6oQdxqfB9mxw/6WnzZpVL425M/CKmLBjBrvSn/f81OVwTXuZJrQZ/ja96eHVtqviz347i3JPx7/5Q6Nnj7RuUGPOFSU/4_2BMMGnBKrRLtO/P_2FyE_2BfezXukLEe/1gUCCjKEM/NO_2BQ8BNJkX/Zge.avi	false	Avira URL Cloud: safe	unknown

AV Detection:

Found malware configuration

Source: loaddll32.exe.6132.1.memstr

Antivirus or Machine Learning detection for unpacked file

Source: 1.2.loaddll32.exe.cc0000.2.unpack	Avira: Label: TR/Crypt.XPACK.Gen8
Source: 1.2.loaddll32.exe.10000000.4.unpack	Avira: Label: TR/Crypt.XPACK.Gen8

Compliance:

Uses 32bit PE files

Source: zQ32b1FVcL.dll

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL, LINE_NUMS_STRIPPED

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

1_2_00CF523C

Source: global traffic	HTTP traffic detected: GET /images/FYBARzKsgpw7r/GeKZtzzc/xoDGsIA1G8WlOKnsrCv_2F5/ejqDaRsnD5/ZD4RH6oQdxqfB9mxw/6WnzZpVL425M/CKmLBjBrvSn/f81OVwTXuZJrQZ/ja96eHVtqviz347i3JPx7/5Q6Nnj7RuUGPOFSU/4_2BMMGnBKrRLtO/P_2FyE_2BfezXukLEe/1gUCCjKEM/NO_2BQ8BNJkX/Zge.avi HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, /Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: begoventa.topConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: begoventa.topConnection: Keep-Alive

Source: msapplication.xml0.16.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x482e4b07,0x01d6e951</date><accdate>0x482e4b07,0x01d6e951</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml0.16.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x482e4b07,0x01d6e951</date><accdate>0x482e4b07,0x01d6e951</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml5.16.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x48330f3c,0x01d6e951</date><accdate>0x48330f3c,0x01d6e951</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml5.16.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x48330f3c,0x01d6e951</date><accdate>0x48330f3c,0x01d6e951</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml7.16.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x483571cf,0x01d6e951</date><accdate>0x483571cf,0x01d6e951</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: msapplication.xml7.16.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x483571cf,0x01d6e951</date><accdate>0x4837d4a4,0x01d6e951</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)

Source: unknown

DNS traffic detected: queries for: babidone.top

Source: {8CB598BC-5544-11EB-90E4-ECF4BB862DED}.dat.24.dr	String found in binary or memory: http://babidone.top/images/tA_2BVY2gpEVQoau7_/2F_2Fif0j/qHSdUWFKPJWkX50svEcy/JM_2Bha3oNIg2DGHFKu/s3R
Source: loaddll32.exe, 00000001.00000002.590862827.0000000001260000.00000002.00000001.sdmp	String found in binary or memory: http://begoventa.top/images/FYBARzKsgpw7r/GeKZtzzc/xoDGsIA1G8WlOKnsrCv_2F5/ejqDaRsnD5/ZD4RH6oQd
Source: {B10F0CC6-5544-11EB-90E4-ECF4BB862DED}.dat.34.dr	String found in binary or memory: http://begoventa.top/images/FYBARzKsgpw7r/GeKZtzzc/xoDGsIA1G8WlOKnsrCv_2F5/ejqDaRsnD5/ZD4RH6oQdxqfB9
Source: zQ32b1FVcL.dll	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: zQ32b1FVcL.dll	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: zQ32b1FVcL.dll	String found in binary or memory: http://ocsp.sectigo.com0
Source: msapplication.xml.16.dr	String found in binary or memory: http://www.amazon.com/
Source: msapplication.xml1.16.dr	String found in binary or memory: http://www.google.com/
Source: msapplication.xml2.16.dr	String found in binary or memory: http://www.live.com/
Source: msapplication.xml3.16.dr	String found in binary or memory: http://www.nytimes.com/
Source: msapplication.xml4.16.dr	String found in binary or memory: http://www.reddit.com/
Source: msapplication.xml5.16.dr	String found in binary or memory: http://www.twitter.com/
Source: msapplication.xml6.16.dr	String found in binary or memory: http://www.wikipedia.com/
Source: msapplication.xml7.16.dr	String found in binary or memory: http://www.youtube.com/
Source: loaddll32.exe, 00000001.00000002.589354244.000000000050B000.00000004.00000020.sdmp	String found in binary or memory: https://babidone.top/images/SD1b2IxKgGl/yu82lOMR21XtBT/D978a7t2zaVGKWj8Jhn4X/WcqZuBMBlmeeUEpv/9Sv89p
Source: zQ32b1FVcL.dll	String found in binary or memory: https://sectigo.com/CPS0D

Source: unknown

Network traffic detected: HTTP traffic on port 49754 -> 443

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected Ursnif

Source: Yara match	File source: 00000001.00000003.303180413.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.303205645.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.302945060.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.303072523.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.303036485.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.302845992.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.591350377.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.303010833.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.303117277.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 6132, type: MEMORY

E-Banking Fraud:

Yara detected Ursnif

Source: Yara match	File source: 00000001.00000003.303180413.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.303205645.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.302945060.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.303072523.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.303036485.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.302845992.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.591350377.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.303010833.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.303117277.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 6132, type: MEMORY

System Summary:

Writes or reads registry keys via WMI

Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetStringValue
Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue

Writes registry values via WMI

Source: C:\Windows\System32\loaddll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\System32\loaddll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\System32\loaddll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue

Contains functionality to call native functions

Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_10001812 NtMapViewOfSection,	1_2_10001812
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_10001DD0 GetProcAddress,NtCreateSection,memset,	1_2_10001DD0
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_100022E5 NtQueryVirtualMemory,	1_2_100022E5
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00CF9932 NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose,	1_2_00CF9932
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00CFB2C1 NtQueryVirtualMemory,	1_2_00CFB2C1

Detected potential crypto function

Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_100020C4	1_2_100020C4
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00CFB09C	1_2_00CFB09C
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00CFEC48	1_2_00CFEC48
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00CFEC41	1_2_00CFEC41
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00CF99FC	1_2_00CF99FC

PE / OLE file has an invalid certificate

Source: zQ32b1FVcL.dll

Static PE information: invalid certificate

PE file contains strange resources

Source: zQ32b1FVcL.dll

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Sample file is different than original file name gathered from version info

Source: zQ32b1FVcL.dll

Binary or memory string: OriginalFilename360SkinView.exeF vs zQ32b1FVcL.dll

Uses 32bit PE files

Source: zQ32b1FVcL.dll

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL, LINE_NUMS_STRIPPED

Source: classification engine

Classification label: mal64.troj.winDLL@13/44@4/3

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_00CF244A CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

1_2_00CF244A

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DFD53763C3DA639732.TMP

Jump to behavior

Source: zQ32b1FVcL.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\zQ32b1FVcL.dll'
Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6388 CREDAT:17410 /prefetch:2
Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:1140 CREDAT:17410 /prefetch:2
Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:3288 CREDAT:17410 /prefetch:2
Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:3984 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6388 CREDAT:17410 /prefetch:2	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:1140 CREDAT:17410 /prefetch:2	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:3288 CREDAT:17410 /prefetch:2	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:3984 CREDAT:17410 /prefetch:2	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Data Obfuscation:

PE file contains sections with non-standard names

Source: zQ32b1FVcL.dll

Static PE information: section name: .data2

Uses code obfuscation techniques (call, push, ret)

Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_100020B3 push ecx; ret	1_2_100020C3
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_10002060 push ecx; ret	1_2_10002069
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00CFACD0 push ecx; ret	1_2_00CFACD9
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00CFB08B push ecx; ret	1_2_00CFB09B
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00C81830 push edx; ret	1_2_00C81934
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00C644CE push edx; ret	1_2_00C644CF
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00C611C0 push eax; iretd	1_2_00C611D6
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00C615D6 push ecx; ret	1_2_00C615D7
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00C63DFA push ecx; retf	1_2_00C63E01
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00C65116 pushad ; ret	1_2_00C65129
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00C63E99 push FFFFFFCFh; retf	1_2_00C63EC7
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00C63A4D push 92BB463Fh; iretd	1_2_00C63A52
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00C643F7 push ss; ret	1_2_00C643F8
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00C63F02 push dword ptr [edi+64h]; iretd	1_2_00C63F0C

Hooking and other Techniques for Hiding and Protection:

Yara detected Ursnif

Source: Yara match	File source: 00000001.00000003.303180413.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.303205645.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.302945060.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.303072523.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.303036485.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.302845992.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.591350377.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.303010833.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.303117277.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 6132, type: MEMORY

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Windows\System32\loaddll32.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

1_2_00CF523C

Source: loaddll32.exe, 00000001.00000002.589296510.00000000004F9000.00000004.00000020.sdmp

Binary or memory string: Hyper-V RAWH

Source: C:\Windows\System32\loaddll32.exe

Memory protected: page execute read | page guard

Jump to behavior

Source: loaddll32.exe, 00000001.00000002.590862827.0000000001260000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: loaddll32.exe, 00000001.00000002.590862827.0000000001260000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: loaddll32.exe, 00000001.00000002.590862827.0000000001260000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: loaddll32.exe, 00000001.00000002.590862827.0000000001260000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Contains functionality to query CPU information (cpuid)

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_00CF5DC6 cpuid

1_2_00CF5DC6

Source: C:\Windows\System32\loaddll32.exe

1_2_100019C7

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_00CF5DC6 RtlAllocateHeap,GetUserNameW,RtlAllocateHeap,GetUserNameW,HeapFree,GetComputerNameW,GetComputerNameW,RtlAllocateHeap,GetComputerNameW,HeapFree,

1_2_00CF5DC6

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_10001799 CreateEventA,GetVersion,GetCurrentProcessId,OpenProcess,GetLastError,

1_2_10001799

Stealing of Sensitive Information:

Yara detected Ursnif

Source: Yara match	File source: 00000001.00000003.303180413.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.303205645.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.302945060.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.303072523.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.303036485.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.302845992.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.591350377.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.303010833.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.303117277.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 6132, type: MEMORY

Remote Access Functionality:

Yara detected Ursnif

Source: Yara match	File source: 00000001.00000003.303180413.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.303205645.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.302945060.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.303072523.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.303036485.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.302845992.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.591350377.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.303010833.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.303117277.0000000003178000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 6132, type: MEMORY

ID:	338663
Product:	CloudBasic
Start time:	18:08:32
Start date:	12.01.2021
Sample:	zQ32b1FVcL.dll
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	eed4174c8a96dd7b611d9f109c71e20f
SHA1:	c471724d86fd269a19932280361ca52e1e294f19
SHA256:	e5dc940537146c1c56b8a8f91234484c83223943c13d2fbf354f0cfdec13c258
Filetype:	Win32 Dynamic Link Library (generic) (1002004/3) 98.12%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{72A6A8A2-5544-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	3AE94EF99BB24395A544FEB78372A9B4	B9BF9F3EAA85022159E875171B7CBA7D78ABF7EA	8D41CC000A6E5405F58CA7D9AE44A4553BE4ADE7FCDDDE419D1D6A64799D9615
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{8CB598BA-5544-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	29C4A3C89669918F62E835D432287FE6	8B7FDC121BBC6CB80E84CD628C5ABF77E78982A1	9BD4CA23B69DEFECB872EB2112597A065EA4F4798349956856038B0FCA4CCF63
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{A2FA2B65-5544-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	D0B87D1E0FB5C60B37D1EDDA7658A862	5B703AF3293216040C41C3030FFB66F9E0A45CD8	7BC698F5CAAE1F21A6174F2B086160F073395E64E35407988957DDD8C64D48EE
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{B10F0CC4-5544-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	29A3292D1A3B0638CB589518AC067AC9	EC81BACBCA78F545996995D9B2A02487A87EF087	FBC81954483148ACF4ABFE5D92FF0A8324D00FEEBB2146C93BC71FF7A706AF08
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{72A6A8A4-5544-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	98EF5675ACFCE587633A4CA29F8A53B6	441CB4E3A543165E2C14C8D9569A967BBCFB7C1D	13FBB6DC3F8B2C0A58E8D5AEE76011B9C061BF3BF6420F1F141C0DB98FDB71B3
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{8CB598BC-5544-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	CA15393407EF61E6646343D4CF05980A	52729C1EFEACC636AB3151D2D5C3B6D42806A5BC	014541CE1CE269C81F7F18CEA7922EDB3BD5FADA19BB0CADAC6F264B832218F1
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{A2FA2B67-5544-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	A1413466758220F73DEED46E91F9756A	5E19A3B8C6362C66E4CD56EB186F05C7A71CB3B8	50A092C1980431F511B130979317818920BA9FA67691B7DC0A8823892F6B3119
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{B10F0CC6-5544-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	24F2A9DDEC3F9966E5B4E0D0553D0C9C	C12245E6657FDC26BE62E45312629459BE08BA14	5A5D80B9ACB62503C5B17BD0EE1D164089DB55C31C652BC861FF6458495C21EE
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-17529550060\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	2C436588E3D6DCF7FE89112328B3E730	4164F8038964A5A9384EF22402A93EDEE75EB21C	08D1B15B701CD6919F93D0E26C9B501DF224789204A85F1CD22B65F72DBFDA8D
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-18270793970\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	18108C1538C400F573ED71BF12A57228	D3AD68F727F86A97FF01D69CD0CD824999B74D32	DF85CE99B84855741812B93F31942C9766FED19D528FC98BE950AA91997D8F45
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-21706820\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	647C1BD469F8A2E152BB8CDE9294BDA2	7CDC043A343B5654844743DE41430C34770684A8	D77AEFB653210521D7EED77736BBCC9DD39B79D3C8B01C3864295CA529701696
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-4759708130\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	CE75127F3FE5FF1F42A6465CB5948887	B750B0E975B083CE241678BC85ABE0C1AFBF057E	C9A450FD56CB3D9039BF84EF161F5D8BD91307396AA7C530666AF811145847C1
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-6757900\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	9C0ED05861F4BEABF0296BCF3CB7A3FC	AB9D6DCB20A34A858CBB692AFFE2B2DF14576B80	EFCFC15BFFB9677764C6DB26CC1E63341E8C816BEA1C8AD394CCFC21566AE0AC
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-8760897390\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	ADA9C3D86BF31E7FFB632FBD5C1472EA	2F2649ADCE55986DFE8BB4214AFB2877C6D6E87D	6CC12B67772FA86AE2203F8D133A7461C812F249ED494BF88AB9DA63F880648B
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20259167780\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	F10D9015D97537E4CC5CA07F9145B361	87D64C880746B28A387A235D0C452AD04695606A	6A4B68122EAAAD5791D23E9EBB567BFEDECE7E59678C06927B79806494D7BE71
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20332743330\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	C7A54905E71A510F14BCF92F140F4B33	EF490F8F776D5EC96F24A812857189DCBB22E26C	700B1C3E36713F75D4780CF4C6B26E96E4FC9C0FE5DABE2E500A8E6DF0DC3D3E
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin8215062560\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	55EA94A0B770ACED3BB3C2E5E706F369	985BB78AC79E5CB7A82A3063C43B690C5C9F897C	0F222996F521DB45250C4E5DC59ADD173AEE6A22B223D50AE850057883A9679A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\NewErrorPageTemplate[1]	UTF-8 Unicode (with BOM) text, with CRLF line terminators	DFEABDE84792228093A5A270352395B6	E41258C9576721025926326F76063C2305586F76	77B138AB5D0A90FF04648C26ADDD5E414CC178165E3B54A4CB3739DA0F58E075
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\down[1]	PNG image data, 15 x 15, 8-bit colormap, non-interlaced	C4F558C4C8B56858F15C09037CD6625A	EE497CC061D6A7A59BB66DEFEA65F9A8145BA240	39E7DE847C9F731EAA72338AD9053217B957859DE27B50B6474EC42971530781
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\errorPageStrings[1]	UTF-8 Unicode (with BOM) text, with CRLF line terminators	D65EC06F21C379C87040B83CC1ABAC6B	208D0A0BB775661758394BE7E4AFB18357E46C8B	A1270E90CEA31B46432EC44731BF4400D22B38EB2855326BF934FE8F1B169A4F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\httpErrorPagesScripts[1]	UTF-8 Unicode (with BOM) text, with CRLF line terminators	9234071287E637F85D721463C488704C	CCA09B1E0FBA38BA29D3972ED8DCECEFDEF8C152	65CC039890C7CEB927CE40F6F199D74E49B8058C3F8A6E22E8F916AD90EA8649
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\NewErrorPageTemplate[1]	UTF-8 Unicode (with BOM) text, with CRLF line terminators	DFEABDE84792228093A5A270352395B6	E41258C9576721025926326F76063C2305586F76	77B138AB5D0A90FF04648C26ADDD5E414CC178165E3B54A4CB3739DA0F58E075
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\dnserror[1]	HTML document, UTF-8 Unicode (with BOM) text, with CRLF line terminators	2DC61EB461DA1436F5D22BCE51425660	E1B79BCAB0F073868079D807FAEC669596DC46C1	ACDEB4966289B6CE46ECC879531F85E9C6F94B718AAB521D38E2E00F7F7F7993
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\errorPageStrings[1]	UTF-8 Unicode (with BOM) text, with CRLF line terminators	D65EC06F21C379C87040B83CC1ABAC6B	208D0A0BB775661758394BE7E4AFB18357E46C8B	A1270E90CEA31B46432EC44731BF4400D22B38EB2855326BF934FE8F1B169A4F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\httpErrorPagesScripts[1]	UTF-8 Unicode (with BOM) text, with CRLF line terminators	9234071287E637F85D721463C488704C	CCA09B1E0FBA38BA29D3972ED8DCECEFDEF8C152	65CC039890C7CEB927CE40F6F199D74E49B8058C3F8A6E22E8F916AD90EA8649
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\down[1]	PNG image data, 15 x 15, 8-bit colormap, non-interlaced	C4F558C4C8B56858F15C09037CD6625A	EE497CC061D6A7A59BB66DEFEA65F9A8145BA240	39E7DE847C9F731EAA72338AD9053217B957859DE27B50B6474EC42971530781
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\httpErrorPagesScripts[1]	UTF-8 Unicode (with BOM) text, with CRLF line terminators	9234071287E637F85D721463C488704C	CCA09B1E0FBA38BA29D3972ED8DCECEFDEF8C152	65CC039890C7CEB927CE40F6F199D74E49B8058C3F8A6E22E8F916AD90EA8649
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\NewErrorPageTemplate[1]	UTF-8 Unicode (with BOM) text, with CRLF line terminators	DFEABDE84792228093A5A270352395B6	E41258C9576721025926326F76063C2305586F76	77B138AB5D0A90FF04648C26ADDD5E414CC178165E3B54A4CB3739DA0F58E075
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\dnserror[1]	HTML document, UTF-8 Unicode (with BOM) text, with CRLF line terminators	2DC61EB461DA1436F5D22BCE51425660	E1B79BCAB0F073868079D807FAEC669596DC46C1	ACDEB4966289B6CE46ECC879531F85E9C6F94B718AAB521D38E2E00F7F7F7993
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\down[1]	PNG image data, 15 x 15, 8-bit colormap, non-interlaced	C4F558C4C8B56858F15C09037CD6625A	EE497CC061D6A7A59BB66DEFEA65F9A8145BA240	39E7DE847C9F731EAA72338AD9053217B957859DE27B50B6474EC42971530781
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\errorPageStrings[1]	UTF-8 Unicode (with BOM) text, with CRLF line terminators	D65EC06F21C379C87040B83CC1ABAC6B	208D0A0BB775661758394BE7E4AFB18357E46C8B	A1270E90CEA31B46432EC44731BF4400D22B38EB2855326BF934FE8F1B169A4F
C:\Users\user\AppData\Local\Temp\JavaDeployReg.log	ASCII text, with CRLF line terminators	219D523BEF62B21E8758584711A71C9D	75AB1ED37C50BDDC84628BB1C1FE774D4510A5D4	539ABC6B5B6970CDBDB99E3C3BF99CFB44A665FA53A6E1F507034C7360E1ECA1
C:\Users\user\AppData\Local\Temp\~DF3766C4D38666A50B.TMP	data	0ABA3E912A00FF12C9BCD751E552C6AC	604B72B119AC4FCC60CC6B78DD06E47674960F59	C389DC44808E3643271BF35C29D43D49870678575B4A72B7B08F0200DBB1BF91
C:\Users\user\AppData\Local\Temp\~DF3E209F7CF6B4A35B.TMP	data	FE4D1D2970B77EDB4C11B5D7FEA12FF8	D564043E854466041B7E0F91012C1DBEFB1E995B	6AF2FEABAA89E67042A1849F9330DF90913C7243439BE76DEF0C11AC4EFF4BEF
C:\Users\user\AppData\Local\Temp\~DF54395E81EA74D2E8.TMP	data	225491E9A52660D327EE010F0FFD7070	6A72F7C91D51326EAED6D42BA5CB3E0716DD71B6	9B683729BC13A1D0180F367471738346BDEAD8BB0D9D6DA99846A0117C3B0549
C:\Users\user\AppData\Local\Temp\~DFB7C0716C27FE0C9F.TMP	data	B891791FD5F7FB01AE66573925AEC2BD	7FC95E18909E2ACFA2E3F8846074B2D85A83997E	9AFD033C6F2B0DA935BAC11CEC48F845491380EF821B590A464FA41EC0D7EA02
C:\Users\user\AppData\Local\Temp\~DFBD53854F4C7AA5DC.TMP	data	08F7E35DD0191E808397C6753BA9350B	002F9021DFA2DB2B1FDBC98BBF0D410B8D325E98	45B116C944E6C20D9B4BB7FBAA70E1DCC5F67AFB5797F3F9A90C29BA407821A6
C:\Users\user\AppData\Local\Temp\~DFD091490AA9F67B44.TMP	data	F5DB7463CA435FA62E7BB0639988AA73	0731532F2086815F0150B6D2E0250621198387AF	85A8380F1BB105DC216E3C58474DB7CDD30E1BE47C8B465AD0F63A47BF86C037
C:\Users\user\AppData\Local\Temp\~DFD53763C3DA639732.TMP	data	1DE5EDAF14E2164927A5AFB0414A7429	66F0984B05D3605DC986A9627E259894165AD2D9	DA384F89996B303CDB54D07F4EC8CAD7F4C358248141D52FB85EBB3B713D7DB7
C:\Users\user\AppData\Local\Temp\~DFEB82DA7A2E1DEEA8.TMP	data	4123E0366D9F6C943DED85A49D8D3883	29ABF3A5CDFBD1EA6903364773994B6CCC64B230	47DDC5051E14E787662AA9D73359FA00A877EECFB0A9E86D23CC3BBB8B8F60B1

Analysis Report zQ32b1FVcL.dll

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs