Analysis Report 609a460e94791.tiff.dll

ID:	410818
Product:	CloudBasic
Start time:	11:01:34
Start date:	11.05.2021
Sample:	609a460e94791.tiff.dll
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	50a299d1e92d9205e123404c8e05904d
SHA1:	c188272ab757dbbf14e74781fc90fcefe4aeb615
SHA256:	3b56b7298c366a323d28658a455abf0d4e78fa197a43ce13bedab05f26901d34
Filetype:	Win32 Dynamic Link Library (generic) (1002004/3) 99.40%

Name	Type	MD5	SHA1	SHA256

AV Detection:

Found malware configuration

Source: 3.3.rundll32.exe.2c0a427.0.raw.unpack

Malware Configuration Extractor: Ursnif {"RSA Public Key": "KujE77ctKyR8x3/dODwZbEsxGmck+FW9384s5u0Kacw8y1gCN+8m2bfjJPovkn+Uzufcdfss+a43eI6oHR1KgWQmvEAO6LK8tJv+Wl7iCBPJP7eef8xKeXht/Mhk1PSj7mHnJ9lcqKMtTteEdSecVvMRtb/WSKVTFfHDva9My7AJ/NbXqHdzCG7znACswLxD", "c2_domain": ["outlook.com/login", "gmail.com", "worunekulo.club", "horunekulo.website"], "botnet": "8877", "server": "12", "serpent_key": "30218409ILPAJDUR", "sleep_time": "10", "CONF_TIMEOUT": "20", "SetWaitableTimer_value": "0", "DGA_count": "10"}

Compliance:

Uses 32bit PE files

Source: 609a460e94791.tiff.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: 609a460e94791.tiff.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Source:

Binary string: c:\die\Oh\ease_Slip\Suffix\fall.pdb source: loaddll32.exe, 00000000.00000002.591062302.000000006E1FB000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000002.592702264.000000006E1FB000.00000002.00020000.sdmp, 609a460e94791.tiff.dll

Spreading:

Contains functionality to enumerate / list files inside a directory

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E1D5AB0 FindFirstFileExW,std::_Timevec::_Timevec,FindNextFileW,		0_2_6E1D5AB0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E1D5AB0 FindFirstFileExW,std::_Timevec::_Timevec,FindNextFileW,		3_2_6E1D5AB0

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected Ursnif

Source: Yara match	File source: 00000003.00000002.590568897.0000000005168000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 1752, type: MEMORY

E-Banking Fraud:

Yara detected Ursnif

Source: Yara match	File source: 00000003.00000002.590568897.0000000005168000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 1752, type: MEMORY

System Summary:

Writes registry values via WMI

Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue

Contains functionality to call native functions

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E1623A5 NtQueryVirtualMemory,		0_2_6E1623A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E161F14 NtMapViewOfSection,		3_2_6E161F14
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E1615F1 GetProcAddress,NtCreateSection,memset,		3_2_6E1615F1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E1623A5 NtQueryVirtualMemory,		3_2_6E1623A5

Detected potential crypto function

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E162184		0_2_6E162184
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E162184		3_2_6E162184

Sample file is different than original file name gathered from version info

Source: 609a460e94791.tiff.dll

Binary or memory string: OriginalFilenamefall.dll8 vs 609a460e94791.tiff.dll

Uses 32bit PE files

Source: 609a460e94791.tiff.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Classification label

Source: classification engine

Classification label: mal60.troj.winDLL@12/0@0/0

PE file has an executable .text section and no other executable section

Source: 609a460e94791.tiff.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads software policies

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Runs a DLL by calling functions

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\609a460e94791.tiff.dll,Hundredpopulate@@8

Spawns processes

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\609a460e94791.tiff.dll'
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\609a460e94791.tiff.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\609a460e94791.tiff.dll,Hundredpopulate@@8
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\609a460e94791.tiff.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\609a460e94791.tiff.dll,Mark@@12
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\609a460e94791.tiff.dll,Seefit@@8
Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\609a460e94791.tiff.dll',#1			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\609a460e94791.tiff.dll,Hundredpopulate@@8			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\609a460e94791.tiff.dll,Mark@@12			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\609a460e94791.tiff.dll,Seefit@@8			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\609a460e94791.tiff.dll',#1			Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Found GUI installer (many successful clicks)

Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK

PE file contains a mix of data directories often seen in goodware

Source: 609a460e94791.tiff.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 609a460e94791.tiff.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 609a460e94791.tiff.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 609a460e94791.tiff.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 609a460e94791.tiff.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 609a460e94791.tiff.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: 609a460e94791.tiff.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

PE file contains a debug data directory

Source: 609a460e94791.tiff.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Binary contains paths to debug symbols

Source:

Binary string: c:\die\Oh\ease_Slip\Suffix\fall.pdb source: loaddll32.exe, 00000000.00000002.591062302.000000006E1FB000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000002.592702264.000000006E1FB000.00000002.00020000.sdmp, 609a460e94791.tiff.dll

PE file contains a valid data directory to section mapping

Source: 609a460e94791.tiff.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 609a460e94791.tiff.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 609a460e94791.tiff.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 609a460e94791.tiff.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 609a460e94791.tiff.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation:

Contains functionality to dynamically determine API calls

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E1617FA LoadLibraryA,GetProcAddress,

0_2_6E1617FA

PE file contains an invalid checksum

Source: 609a460e94791.tiff.dll

Static PE information: real checksum: 0xdacb0 should be: 0xd1c24

Uses code obfuscation techniques (call, push, ret)

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E162120 push ecx; ret		0_2_6E162129
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E162173 push ecx; ret		0_2_6E162183
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E2306DB push ebp; retf 0000h		0_2_6E2306DC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E162120 push ecx; ret		3_2_6E162129
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E162173 push ecx; ret		3_2_6E162183
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E2306DB push ebp; retf 0000h		3_2_6E2306DC

Hooking and other Techniques for Hiding and Protection:

Yara detected Ursnif

Source: Yara match	File source: 00000003.00000002.590568897.0000000005168000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 1752, type: MEMORY

Extensive use of GetProcAddress (often used to hide API calls)

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E1911D0 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6E1911D0

Disables application error messsages (SetErrorMode)

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Program does not show much activity (idle)

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\System32\loaddll32.exe	Last function: Thread delayed
Source: C:\Windows\System32\loaddll32.exe	Last function: Thread delayed

Contains functionality to enumerate / list files inside a directory

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E1D5AB0 FindFirstFileExW,std::_Timevec::_Timevec,FindNextFileW,		0_2_6E1D5AB0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E1D5AB0 FindFirstFileExW,std::_Timevec::_Timevec,FindNextFileW,		3_2_6E1D5AB0

Anti Debugging:

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E1936C0 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6E1936C0

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E1D0480 __invoke_watson_if_error,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,__aligned_msize,__invoke_watson_if_error,__aligned_msize,__invoke_watson_if_error,__aligned_msize,__invoke_watson_if_error,__aligned_msize,__invoke_watson_if_error,__aligned_msize,__invoke_watson_if_error,__aligned_msize,__invoke_watson_if_error,__aligned_msize,__invoke_watson_if_error,__cftoe,__aligned_msize,__invoke_watson_if_error,GetFileType,WriteConsoleW,GetLastError,__cftoe,WriteFile,WriteFile,OutputDebugStringW,__invoke_watson_if_error,__CrtDbgReportWV,

0_2_6E1D0480

Contains functionality to dynamically determine API calls

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E1617FA LoadLibraryA,GetProcAddress,

0_2_6E1617FA

Contains functionality to read the PEB

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E1D4E20 mov ecx, dword ptr fs:[00000030h]		0_2_6E1D4E20
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E1D4CE0 mov ecx, dword ptr fs:[00000030h]		0_2_6E1D4CE0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E1D4D80 mov ecx, dword ptr fs:[00000030h]		0_2_6E1D4D80
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E1A7960 mov eax, dword ptr fs:[00000030h]		0_2_6E1A7960
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E22C536 mov eax, dword ptr fs:[00000030h]		0_2_6E22C536
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E22C46C mov eax, dword ptr fs:[00000030h]		0_2_6E22C46C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E22C073 push dword ptr fs:[00000030h]		0_2_6E22C073
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E1D4E20 mov ecx, dword ptr fs:[00000030h]		3_2_6E1D4E20
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E1D4CE0 mov ecx, dword ptr fs:[00000030h]		3_2_6E1D4CE0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E1D4D80 mov ecx, dword ptr fs:[00000030h]		3_2_6E1D4D80
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E1A7960 mov eax, dword ptr fs:[00000030h]		3_2_6E1A7960
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E22C536 mov eax, dword ptr fs:[00000030h]		3_2_6E22C536
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E22C46C mov eax, dword ptr fs:[00000030h]		3_2_6E22C46C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E22C073 push dword ptr fs:[00000030h]		3_2_6E22C073

Program does not show much activity (idle)

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Contains functionality to register its own exception handler

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E1936C0 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6E1936C0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E1A4F60 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6E1A4F60
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E1938F0 SetUnhandledExceptionFilter,		0_2_6E1938F0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E193990 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6E193990
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E1936C0 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		3_2_6E1936C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E1A4F60 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		3_2_6E1A4F60
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E1938F0 SetUnhandledExceptionFilter,		3_2_6E1938F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E193990 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		3_2_6E193990

HIPS / PFW / Operating System Protection Evasion:

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\609a460e94791.tiff.dll',#1

Jump to behavior

May try to detect the Windows Explorer process (often used for injection)

Source: loaddll32.exe, 00000000.00000002.590298181.00000000011E0000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.590108031.0000000003240000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: loaddll32.exe, 00000000.00000002.590298181.00000000011E0000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.590108031.0000000003240000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: loaddll32.exe, 00000000.00000002.590298181.00000000011E0000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.590108031.0000000003240000.00000002.00000001.sdmp	Binary or memory string: &Program Manager
Source: loaddll32.exe, 00000000.00000002.590298181.00000000011E0000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.590108031.0000000003240000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Contains functionality to query local / system time

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E161237 SetThreadPriority,GetSystemTime,SwitchToThread,Sleep,GetLongPathNameW,GetLongPathNameW,GetLongPathNameW,GetLastError,WaitForSingleObject,GetExitCodeThread,CloseHandle,GetLastError,GetLastError,

0_2_6E161237

Contains functionality to query windows version

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E161CDD CreateEventA,GetVersion,GetCurrentProcessId,OpenProcess,GetLastError,

0_2_6E161CDD

Stealing of Sensitive Information:

Yara detected Ursnif

Source: Yara match	File source: 00000003.00000002.590568897.0000000005168000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 1752, type: MEMORY

Remote Access Functionality:

Yara detected Ursnif

Source: Yara match	File source: 00000003.00000002.590568897.0000000005168000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 1752, type: MEMORY