Analysis Report 609a460e94791.tiff.dll

ID:	410818
Product:	CloudBasic
Start time:	11:09:21
Start date:	11.05.2021
Sample:	609a460e94791.tiff.dll
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	50a299d1e92d9205e123404c8e05904d
SHA1:	c188272ab757dbbf14e74781fc90fcefe4aeb615
SHA256:	3b56b7298c366a323d28658a455abf0d4e78fa197a43ce13bedab05f26901d34
Filetype:	Win32 Dynamic Link Library (generic) (1002004/3) 99.40%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{7A4756FA-B284-11EB-90E5-ECF4BB2D2496}.dat	Microsoft Word Document	156D3CAF9E8A794ADFC20BEF63EEA127	AF7F7711A0A50AC466904AF1088B915D447CC937	52D1E225E5A48663A4E782CEE505EF4EFCB03B57D86EB1AEAE2BCB514D55FA88
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{7A4756FC-B284-11EB-90E5-ECF4BB2D2496}.dat	Microsoft Word Document	AD45202875B5B3222E4A0FA70E557E36	262462EB28F2EE5AA4AB87168782A3225D7C2766	322B18772F6CEE64ACF8D3DF9A5B5E189FC5C11ED8113396D3E8A080C6F73F57
C:\Users\user\AppData\Local\Temp\JavaDeployReg.log	ASCII text, with CRLF line terminators	D37E17C754DC8265F6B19F375B3B2A7B	DB6EB0959B70CB613479E0C56B4B298F120A12C5	98D3B53E62F7515A00599868EC0299B37D4A3F09B2C864023EC62A52CE8A8356
C:\Users\user\AppData\Local\Temp\~DF6A2029352AAD8EB0.TMP	data	3332CE02133F1A2B17659763DD9F9ED8	2CCFF0E9B9AC268A48483F244C2549AC30046A95	9EB41D80206763DADE5A30133DF5EDEBA27E69BAFDFA96FC9C438933A7B93518
C:\Users\user\AppData\Local\Temp\~DF745550B0ECD73E02.TMP	data	B7796152E2D67FE2A933DE459C627111	ADDA7FFAC9F85AAF9ADD7FFED33C359333CF2017	8FE8BAB0CBA61FF6244059D467FE8A550F96650FA9B247DA1C5C99F64C68AC2E

AV Detection:

Found malware configuration

Source: 4.2.rundll32.exe.4c894a0.3.raw.unpack

Malware Configuration Extractor: Ursnif {"RSA Public Key": "KujE77ctKyR8x3/dODwZbEsxGmck+FW9384s5u0Kacw8y1gCN+8m2bfjJPovkn+Uzufcdfss+a43eI6oHR1KgWQmvEAO6LK8tJv+Wl7iCBPJP7eef8xKeXht/Mhk1PSj7mHnJ9lcqKMtTteEdSecVvMRtb/WSKVTFfHDva9My7AJ/NbXqHdzCG7znACswLxD", "c2_domain": ["outlook.com/login", "gmail.com", "worunekulo.club", "horunekulo.website"], "botnet": "8877", "server": "12", "serpent_key": "30218409ILPAJDUR", "sleep_time": "10", "CONF_TIMEOUT": "20", "SetWaitableTimer_value": "0", "DGA_count": "10"}

Compliance:

Uses 32bit PE files

Source: 609a460e94791.tiff.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: 609a460e94791.tiff.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Source:

Binary string: c:\die\Oh\ease_Slip\Suffix\fall.pdb source: loaddll32.exe, 00000001.00000002.727825463.000000006E20B000.00000002.00020000.sdmp, rundll32.exe, 00000004.00000002.730325292.000000006E20B000.00000002.00020000.sdmp, 609a460e94791.tiff.dll

Spreading:

Contains functionality to enumerate / list files inside a directory

Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E1E5AB0 FindFirstFileExW,std::_Timevec::_Timevec,FindNextFileW,		1_2_6E1E5AB0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02C94C3B RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,memset,CreateFileA,GetFileTime,FindCloseChangeNotification,StrRChrA,lstrcat,FindFirstFileA,FindFirstFileA,CompareFileTime,CompareFileTime,FindClose,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,StrChrA,memcpy,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,FindClose,HeapFree,HeapFree,		4_2_02C94C3B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E1E5AB0 FindFirstFileExW,std::_Timevec::_Timevec,FindNextFileW,		4_2_6E1E5AB0

Networking:

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 40.97.161.50 40.97.161.50

Downloads files from webservers via HTTP

Source: global traffic

HTTP traffic detected: GET /login/greed/gx9NI4Ybpp/8F85m84ndjn4UwJSZ/KFY_2BxmUPMy/coa0QUktAbb/vjBaicl7yvyNDs/NaAVAq9mPnbNTlKz1AUy2/5aIKWQiZNRBNaijS/Tt5Vo5dnaNIMeJI/Piqfb55cpfCEI8CpHK/_2FWICMIW/YUkQnOfGVld1SPd1rTnm/w0s_2F9NNcplFjkZ_2F/ufX9zF863VCJiOMFbmL1SV/K4t8NhPa8Lg/cl7PdmL.gfk HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: outlook.comConnection: Keep-Alive

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: outlook.com

URLs found in memory or binary data

Source: ~DF6A2029352AAD8EB0.TMP.18.dr, {7A4756FC-B284-11EB-90E5-ECF4BB2D2496}.dat.18.dr

String found in binary or memory: https://outlook.office365.com/login/greed/gx9NI4Ybpp/8F85m84ndjn4UwJSZ/KFY_2BxmUPMy/coa0QUktAbb/vjBa

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected Ursnif

Source: Yara match	File source: 00000001.00000003.662417377.0000000003EA8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.681209868.0000000005148000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.724251151.0000000003EA8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.662378098.0000000003EA8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.662456772.0000000003EA8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.681069818.0000000005148000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.662317153.0000000003EA8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.681166678.0000000005148000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.662182472.0000000003EA8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.662498468.0000000003EA8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.681184112.0000000005148000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.681198469.0000000005148000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.662484640.0000000003EA8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.681099453.0000000005148000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.681146524.0000000005148000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.662019943.0000000003EA8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.681124435.0000000005148000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.725706595.0000000005148000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 6660, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 6700, type: MEMORY

Creates a DirectInput object (often for capturing keystrokes)

Source: loaddll32.exe, 00000001.00000002.722729913.00000000016AB000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

Yara detected Ursnif

Source: Yara match	File source: 00000001.00000003.662417377.0000000003EA8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.681209868.0000000005148000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.724251151.0000000003EA8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.662378098.0000000003EA8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.662456772.0000000003EA8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.681069818.0000000005148000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.662317153.0000000003EA8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.681166678.0000000005148000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.662182472.0000000003EA8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.662498468.0000000003EA8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.681184112.0000000005148000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.681198469.0000000005148000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.662484640.0000000003EA8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.681099453.0000000005148000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.681146524.0000000005148000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.662019943.0000000003EA8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.681124435.0000000005148000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.725706595.0000000005148000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 6660, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 6700, type: MEMORY

System Summary:

Writes or reads registry keys via WMI

Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetStringValue
Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue

Writes registry values via WMI

Source: C:\Windows\System32\loaddll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\System32\loaddll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\System32\loaddll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue

Contains functionality to call native functions

Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E171F14 NtMapViewOfSection,		1_2_6E171F14
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E1715F1 GetProcAddress,NtCreateSection,memset,		1_2_6E1715F1
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E1723A5 NtQueryVirtualMemory,		1_2_6E1723A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02C91168 NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose,		4_2_02C91168
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02C9B2F1 NtQueryVirtualMemory,		4_2_02C9B2F1

Detected potential crypto function

Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E172184		1_2_6E172184
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02C9B0CC		4_2_02C9B0CC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02C9696A		4_2_02C9696A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02C91B6A		4_2_02C91B6A

Sample file is different than original file name gathered from version info

Source: 609a460e94791.tiff.dll

Binary or memory string: OriginalFilenamefall.dll8 vs 609a460e94791.tiff.dll

Uses 32bit PE files

Source: 609a460e94791.tiff.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Classification label

Source: classification engine

Classification label: mal64.troj.winDLL@14/5@3/3

Contains functionality to enum processes or threads

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_02C97F56 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

4_2_02C97F56

Creates files inside the user directory

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{7A4756FA-B284-11EB-90E5-ECF4BB2D2496}.dat

Jump to behavior

Creates temporary files

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DF745550B0ECD73E02.TMP

Jump to behavior

PE file has an executable .text section and no other executable section

Source: 609a460e94791.tiff.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads ini files

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Reads software policies

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Runs a DLL by calling functions

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\609a460e94791.tiff.dll,Hundredpopulate@@8

Spawns processes

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\609a460e94791.tiff.dll'
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\609a460e94791.tiff.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\609a460e94791.tiff.dll,Hundredpopulate@@8
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\609a460e94791.tiff.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\609a460e94791.tiff.dll,Mark@@12
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\609a460e94791.tiff.dll,Seefit@@8
Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5436 CREDAT:17410 /prefetch:2
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\609a460e94791.tiff.dll',#1			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\609a460e94791.tiff.dll,Hundredpopulate@@8			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\609a460e94791.tiff.dll,Mark@@12			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\609a460e94791.tiff.dll,Seefit@@8			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\609a460e94791.tiff.dll',#1			Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5436 CREDAT:17410 /prefetch:2			Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Windows\System32\loaddll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Found GUI installer (many successful clicks)

Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

PE file contains a mix of data directories often seen in goodware

Source: 609a460e94791.tiff.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 609a460e94791.tiff.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 609a460e94791.tiff.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 609a460e94791.tiff.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 609a460e94791.tiff.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 609a460e94791.tiff.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: 609a460e94791.tiff.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

PE file contains a debug data directory

Source: 609a460e94791.tiff.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Binary contains paths to debug symbols

Source:

Binary string: c:\die\Oh\ease_Slip\Suffix\fall.pdb source: loaddll32.exe, 00000001.00000002.727825463.000000006E20B000.00000002.00020000.sdmp, rundll32.exe, 00000004.00000002.730325292.000000006E20B000.00000002.00020000.sdmp, 609a460e94791.tiff.dll

PE file contains a valid data directory to section mapping

Source: 609a460e94791.tiff.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 609a460e94791.tiff.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 609a460e94791.tiff.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 609a460e94791.tiff.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 609a460e94791.tiff.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation:

Contains functionality to dynamically determine API calls

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_6E1717FA LoadLibraryA,GetProcAddress,

1_2_6E1717FA

PE file contains an invalid checksum

Source: 609a460e94791.tiff.dll

Static PE information: real checksum: 0xdacb0 should be: 0xd1c24

Uses code obfuscation techniques (call, push, ret)

Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E172120 push ecx; ret		1_2_6E172129
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E172173 push ecx; ret		1_2_6E172183
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E2406DB push ebp; retf 0000h		1_2_6E2406DC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02C9B0BB push ecx; ret		4_2_02C9B0CB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02C9AD00 push ecx; ret		4_2_02C9AD09
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E2406DB push ebp; retf 0000h		4_2_6E2406DC

Hooking and other Techniques for Hiding and Protection:

Yara detected Ursnif

Source: Yara match	File source: 00000001.00000003.662417377.0000000003EA8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.681209868.0000000005148000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.724251151.0000000003EA8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.662378098.0000000003EA8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.662456772.0000000003EA8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.681069818.0000000005148000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.662317153.0000000003EA8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.681166678.0000000005148000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.662182472.0000000003EA8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.662498468.0000000003EA8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.681184112.0000000005148000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.681198469.0000000005148000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.662484640.0000000003EA8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.681099453.0000000005148000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.681146524.0000000005148000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.662019943.0000000003EA8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.681124435.0000000005148000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.725706595.0000000005148000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 6660, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 6700, type: MEMORY

Extensive use of GetProcAddress (often used to hide API calls)

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_6E1A11D0 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_6E1A11D0

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Windows\System32\loaddll32.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Disables application error messsages (SetErrorMode)

Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Contains functionality to enumerate / list files inside a directory

Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E1E5AB0 FindFirstFileExW,std::_Timevec::_Timevec,FindNextFileW,		1_2_6E1E5AB0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02C94C3B RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,memset,CreateFileA,GetFileTime,FindCloseChangeNotification,StrRChrA,lstrcat,FindFirstFileA,FindFirstFileA,CompareFileTime,CompareFileTime,FindClose,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,StrChrA,memcpy,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,FindClose,HeapFree,HeapFree,		4_2_02C94C3B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E1E5AB0 FindFirstFileExW,std::_Timevec::_Timevec,FindNextFileW,		4_2_6E1E5AB0

Anti Debugging:

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_6E1A36C0 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

1_2_6E1A36C0

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_6E1E0480 __invoke_watson_if_error,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,__aligned_msize,__invoke_watson_if_error,__aligned_msize,__invoke_watson_if_error,__aligned_msize,__invoke_watson_if_error,__aligned_msize,__invoke_watson_if_error,__aligned_msize,__invoke_watson_if_error,__aligned_msize,__invoke_watson_if_error,__aligned_msize,__invoke_watson_if_error,__cftoe,__aligned_msize,__invoke_watson_if_error,GetFileType,WriteConsoleW,GetLastError,__cftoe,WriteFile,WriteFile,OutputDebugStringW,__invoke_watson_if_error,__CrtDbgReportWV,

1_2_6E1E0480

Contains functionality to dynamically determine API calls

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_6E1717FA LoadLibraryA,GetProcAddress,

1_2_6E1717FA

Contains functionality to read the PEB

Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E1E4E20 mov ecx, dword ptr fs:[00000030h]		1_2_6E1E4E20
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E1E4CE0 mov ecx, dword ptr fs:[00000030h]		1_2_6E1E4CE0
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E1E4D80 mov ecx, dword ptr fs:[00000030h]		1_2_6E1E4D80
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E1B7960 mov eax, dword ptr fs:[00000030h]		1_2_6E1B7960
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E23C536 mov eax, dword ptr fs:[00000030h]		1_2_6E23C536
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E23C46C mov eax, dword ptr fs:[00000030h]		1_2_6E23C46C
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E23C073 push dword ptr fs:[00000030h]		1_2_6E23C073
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E1E4E20 mov ecx, dword ptr fs:[00000030h]		4_2_6E1E4E20
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E1E4CE0 mov ecx, dword ptr fs:[00000030h]		4_2_6E1E4CE0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E1E4D80 mov ecx, dword ptr fs:[00000030h]		4_2_6E1E4D80
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E1B7960 mov eax, dword ptr fs:[00000030h]		4_2_6E1B7960
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E23C536 mov eax, dword ptr fs:[00000030h]		4_2_6E23C536
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E23C46C mov eax, dword ptr fs:[00000030h]		4_2_6E23C46C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E23C073 push dword ptr fs:[00000030h]		4_2_6E23C073

Contains functionality to register its own exception handler

Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E1A36C0 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		1_2_6E1A36C0
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E1B4F60 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		1_2_6E1B4F60
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E1A38F0 SetUnhandledExceptionFilter,		1_2_6E1A38F0
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E1A3990 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		1_2_6E1A3990
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E1A36C0 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		4_2_6E1A36C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E1B4F60 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		4_2_6E1B4F60
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E1A38F0 SetUnhandledExceptionFilter,		4_2_6E1A38F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E1A3990 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		4_2_6E1A3990

HIPS / PFW / Operating System Protection Evasion:

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\609a460e94791.tiff.dll',#1

Jump to behavior

May try to detect the Windows Explorer process (often used for injection)

Source: loaddll32.exe, 00000001.00000002.723307341.0000000001CF0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.724383239.00000000031B0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: loaddll32.exe, 00000001.00000002.723307341.0000000001CF0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.724383239.00000000031B0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: loaddll32.exe, 00000001.00000002.723307341.0000000001CF0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.724383239.00000000031B0000.00000002.00000001.sdmp	Binary or memory string: &Program Manager
Source: loaddll32.exe, 00000001.00000002.723307341.0000000001CF0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.724383239.00000000031B0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Contains functionality to query CPU information (cpuid)

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_02C92D6E cpuid

4_2_02C92D6E

Contains functionality to query local / system time

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_6E171237 SetThreadPriority,GetSystemTime,SwitchToThread,Sleep,GetLongPathNameW,GetLongPathNameW,GetLongPathNameW,GetLastError,WaitForSingleObject,GetExitCodeThread,CloseHandle,GetLastError,GetLastError,

1_2_6E171237

Contains functionality to query the account / user name

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_02C92D6E RtlAllocateHeap,GetUserNameW,RtlAllocateHeap,GetUserNameW,HeapFree,GetComputerNameW,GetComputerNameW,RtlAllocateHeap,GetComputerNameW,HeapFree,

4_2_02C92D6E

Contains functionality to query windows version

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_6E171CDD CreateEventA,GetVersion,GetCurrentProcessId,OpenProcess,GetLastError,

1_2_6E171CDD

Stealing of Sensitive Information:

Yara detected Ursnif

Source: Yara match	File source: 00000001.00000003.662417377.0000000003EA8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.681209868.0000000005148000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.724251151.0000000003EA8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.662378098.0000000003EA8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.662456772.0000000003EA8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.681069818.0000000005148000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.662317153.0000000003EA8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.681166678.0000000005148000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.662182472.0000000003EA8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.662498468.0000000003EA8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.681184112.0000000005148000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.681198469.0000000005148000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.662484640.0000000003EA8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.681099453.0000000005148000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.681146524.0000000005148000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.662019943.0000000003EA8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.681124435.0000000005148000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.725706595.0000000005148000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 6660, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 6700, type: MEMORY

Remote Access Functionality:

Yara detected Ursnif

Source: Yara match	File source: 00000001.00000003.662417377.0000000003EA8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.681209868.0000000005148000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.724251151.0000000003EA8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.662378098.0000000003EA8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.662456772.0000000003EA8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.681069818.0000000005148000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.662317153.0000000003EA8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.681166678.0000000005148000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.662182472.0000000003EA8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.662498468.0000000003EA8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.681184112.0000000005148000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.681198469.0000000005148000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.662484640.0000000003EA8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.681099453.0000000005148000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.681146524.0000000005148000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.662019943.0000000003EA8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.681124435.0000000005148000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.725706595.0000000005148000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 6660, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 6700, type: MEMORY