Analysis Report A5uTdwOwJ1.dll

ID:	410913
Product:	CloudBasic
Start time:	12:56:38
Start date:	11.05.2021
Sample:	A5uTdwOwJ1.dll
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	1752fe2b8419be8241ecd08859a5800f
SHA1:	eb7346a6d5a53ddaf8fd073f266c64d642b40a7d
SHA256:	e81869620b9a18c3702c7be2fcf2e170cbc5c3de1ddbc84ae1fe190b57e917a0
Filetype:	Win32 Dynamic Link Library (generic) (1002004/3) 99.40%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{FA9A4670-B247-11EB-90EB-ECF4BBEA1588}.dat	Microsoft Word Document	B9765F08D46BFC88BBFDCCFC0D775FF6	8160BFAE549AB412C71C7AB0DD67FE046F8BE085	0AA48A18F107E6EA8C938E35497041F02B8389C6F763AC2B43EF55C7C38EBCB2
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{FA9A4672-B247-11EB-90EB-ECF4BBEA1588}.dat	Microsoft Word Document	5EAB8D7BB7320BB13DEB73905A1A53FB	4B28FC7F388C96242071D35AD7E75D928508C311	901D4FD58A650A36B0F17605AF165FDA50C6B9F26C44DBA3C940C0BCE0C0689F
C:\Users\user\AppData\Local\Temp\~DF1B654EC27DD768D2.TMP	data	82A8AF58D95219C47E4A30F27A7C206E	C20BBE085E1EDA657B8E68E513C2A10E3235BE54	F1BAB6976EAEDB52338DE2D26B481D9C33EDA97219D5238FF5A3F3482F2AC385
C:\Users\user\AppData\Local\Temp\~DF7A757557FCA01EC0.TMP	data	857EE0C1FAE8C14013D145E688ECCCE8	E692896F7D7BFF731D73C947851F3C1C1E26FA08	4DA381D3C5014EE7A29C1BF58AA4C4B5BF5225A3AE40A3021A2A2E6976380BD5

AV Detection:

Found malware configuration

Source: 0.3.loaddll32.exe.f9a427.0.raw.unpack

Malware Configuration Extractor: Ursnif {"RSA Public Key": "KujE77ctKyR8x3/dODwZbEsxGmck+FW9384s5u0Kacw8y1gCN+8m2bfjJPovkn+Uzufcdfss+a43eI6oHR1KgWQmvEAO6LK8tJv+Wl7iCBPJP7eef8xKeXht/Mhk1PSj7mHnJ9lcqKMtTteEdSecVvMRtb/WSKVTFfHDva9My7AJ/NbXqHdzCG7znACswLxD", "c2_domain": ["outlook.com/login", "gmail.com", "worunekulo.club", "horunekulo.website"], "botnet": "8877", "server": "12", "serpent_key": "30218409ILPAJDUR", "sleep_time": "10", "CONF_TIMEOUT": "20", "SetWaitableTimer_value": "0", "DGA_count": "10"}

Compliance:

Uses 32bit PE files

Source: A5uTdwOwJ1.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: A5uTdwOwJ1.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Source:

Binary string: c:\die\Oh\ease_Slip\Suffix\fall.pdb source: loaddll32.exe, 00000000.00000002.933350818.000000006D4CB000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000002.934697634.000000006D4CB000.00000002.00020000.sdmp, A5uTdwOwJ1.dll

Spreading:

Contains functionality to enumerate / list files inside a directory

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D4A5AB0 FindFirstFileExW,std::_Timevec::_Timevec,FindNextFileW,		0_2_6D4A5AB0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02B64C3B RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,memset,CreateFileA,GetFileTime,FindCloseChangeNotification,StrRChrA,lstrcat,FindFirstFileA,FindFirstFileA,CompareFileTime,CompareFileTime,FindClose,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,StrChrA,memcpy,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,FindClose,HeapFree,HeapFree,		3_2_02B64C3B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D4A5AB0 FindFirstFileExW,std::_Timevec::_Timevec,FindNextFileW,		3_2_6D4A5AB0

Software Vulnerabilities:

Allocates a big amount of memory (probably used for heap spraying)

Source: iexplore.exe

Memory has grown: Private usage: 0MB later: 5MB

Networking:

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: outlook.com

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected Ursnif

Source: Yara match	File source: 00000003.00000002.933933475.00000000050E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 7076, type: MEMORY

Creates a DirectInput object (often for capturing keystrokes)

Source: loaddll32.exe, 00000000.00000002.932987717.000000000106B000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

Yara detected Ursnif

Source: Yara match	File source: 00000003.00000002.933933475.00000000050E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 7076, type: MEMORY

System Summary:

Writes registry values via WMI

Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue

Contains functionality to call native functions

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D4323A5 NtQueryVirtualMemory,		0_2_6D4323A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D4315F1 GetProcAddress,NtCreateSection,memset,		3_2_6D4315F1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D431F14 NtMapViewOfSection,		3_2_6D431F14
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D4323A5 NtQueryVirtualMemory,		3_2_6D4323A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02B61168 NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose,		3_2_02B61168
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02B6B2F1 NtQueryVirtualMemory,		3_2_02B6B2F1

Detected potential crypto function

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D432184		0_2_6D432184
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D432184		3_2_6D432184
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02B6B0CC		3_2_02B6B0CC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02B6696A		3_2_02B6696A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02B61B6A		3_2_02B61B6A

Sample file is different than original file name gathered from version info

Source: A5uTdwOwJ1.dll

Binary or memory string: OriginalFilenamefall.dll8 vs A5uTdwOwJ1.dll

Uses 32bit PE files

Source: A5uTdwOwJ1.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Classification label

Source: classification engine

Classification label: mal60.troj.winDLL@14/4@3/0

Contains functionality to enum processes or threads

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_02B67F56 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

3_2_02B67F56

Creates files inside the user directory

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{FA9A4670-B247-11EB-90EB-ECF4BBEA1588}.dat

Jump to behavior

Creates temporary files

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DF7A757557FCA01EC0.TMP

Jump to behavior

PE file has an executable .text section and no other executable section

Source: A5uTdwOwJ1.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads ini files

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Reads software policies

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Runs a DLL by calling functions

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\A5uTdwOwJ1.dll,Hundredpopulate@@8

Spawns processes

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\A5uTdwOwJ1.dll'
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\A5uTdwOwJ1.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\A5uTdwOwJ1.dll,Hundredpopulate@@8
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\A5uTdwOwJ1.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\A5uTdwOwJ1.dll,Mark@@12
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\A5uTdwOwJ1.dll,Seefit@@8
Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4640 CREDAT:17410 /prefetch:2
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\A5uTdwOwJ1.dll',#1			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\A5uTdwOwJ1.dll,Hundredpopulate@@8			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\A5uTdwOwJ1.dll,Mark@@12			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\A5uTdwOwJ1.dll,Seefit@@8			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\A5uTdwOwJ1.dll',#1			Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4640 CREDAT:17410 /prefetch:2			Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Found GUI installer (many successful clicks)

Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

PE file contains a mix of data directories often seen in goodware

Source: A5uTdwOwJ1.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: A5uTdwOwJ1.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: A5uTdwOwJ1.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: A5uTdwOwJ1.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: A5uTdwOwJ1.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: A5uTdwOwJ1.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: A5uTdwOwJ1.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

PE file contains a debug data directory

Source: A5uTdwOwJ1.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Binary contains paths to debug symbols

Source:

Binary string: c:\die\Oh\ease_Slip\Suffix\fall.pdb source: loaddll32.exe, 00000000.00000002.933350818.000000006D4CB000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000002.934697634.000000006D4CB000.00000002.00020000.sdmp, A5uTdwOwJ1.dll

PE file contains a valid data directory to section mapping

Source: A5uTdwOwJ1.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: A5uTdwOwJ1.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: A5uTdwOwJ1.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: A5uTdwOwJ1.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: A5uTdwOwJ1.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation:

Contains functionality to dynamically determine API calls

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6D4317FA LoadLibraryA,GetProcAddress,

0_2_6D4317FA

PE file contains an invalid checksum

Source: A5uTdwOwJ1.dll

Static PE information: real checksum: 0xdacb0 should be: 0xd9de3

Uses code obfuscation techniques (call, push, ret)

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D432173 push ecx; ret		0_2_6D432183
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D432120 push ecx; ret		0_2_6D432129
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D5006DB push ebp; retf 0000h		0_2_6D5006DC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D432173 push ecx; ret		3_2_6D432183
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D432120 push ecx; ret		3_2_6D432129
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02B6B0BB push ecx; ret		3_2_02B6B0CB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02B6AD00 push ecx; ret		3_2_02B6AD09
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D5006DB push ebp; retf 0000h		3_2_6D5006DC

Hooking and other Techniques for Hiding and Protection:

Yara detected Ursnif

Source: Yara match	File source: 00000003.00000002.933933475.00000000050E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 7076, type: MEMORY

Extensive use of GetProcAddress (often used to hide API calls)

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6D4611D0 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6D4611D0

Disables application error messsages (SetErrorMode)

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\System32\loaddll32.exe	Last function: Thread delayed
Source: C:\Windows\System32\loaddll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed

Contains functionality to enumerate / list files inside a directory

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D4A5AB0 FindFirstFileExW,std::_Timevec::_Timevec,FindNextFileW,		0_2_6D4A5AB0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02B64C3B RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,memset,CreateFileA,GetFileTime,FindCloseChangeNotification,StrRChrA,lstrcat,FindFirstFileA,FindFirstFileA,CompareFileTime,CompareFileTime,FindClose,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,StrChrA,memcpy,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,FindClose,HeapFree,HeapFree,		3_2_02B64C3B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D4A5AB0 FindFirstFileExW,std::_Timevec::_Timevec,FindNextFileW,		3_2_6D4A5AB0

Anti Debugging:

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6D474F60 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6D474F60

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6D4A0480 __invoke_watson_if_error,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,__aligned_msize,__invoke_watson_if_error,__aligned_msize,__invoke_watson_if_error,__aligned_msize,__invoke_watson_if_error,__aligned_msize,__invoke_watson_if_error,__aligned_msize,__invoke_watson_if_error,__aligned_msize,__invoke_watson_if_error,__aligned_msize,__invoke_watson_if_error,__cftoe,__aligned_msize,__invoke_watson_if_error,GetFileType,WriteConsoleW,GetLastError,__cftoe,WriteFile,WriteFile,OutputDebugStringW,__invoke_watson_if_error,__CrtDbgReportWV,

0_2_6D4A0480

Contains functionality to dynamically determine API calls

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6D4317FA LoadLibraryA,GetProcAddress,

0_2_6D4317FA

Contains functionality to read the PEB

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D4A4D80 mov ecx, dword ptr fs:[00000030h]		0_2_6D4A4D80
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D4A4CE0 mov ecx, dword ptr fs:[00000030h]		0_2_6D4A4CE0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D4A4E20 mov ecx, dword ptr fs:[00000030h]		0_2_6D4A4E20
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D477960 mov eax, dword ptr fs:[00000030h]		0_2_6D477960
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D4FC536 mov eax, dword ptr fs:[00000030h]		0_2_6D4FC536
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D4FC46C mov eax, dword ptr fs:[00000030h]		0_2_6D4FC46C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D4FC073 push dword ptr fs:[00000030h]		0_2_6D4FC073
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D4A4D80 mov ecx, dword ptr fs:[00000030h]		3_2_6D4A4D80
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D4A4CE0 mov ecx, dword ptr fs:[00000030h]		3_2_6D4A4CE0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D4A4E20 mov ecx, dword ptr fs:[00000030h]		3_2_6D4A4E20
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D477960 mov eax, dword ptr fs:[00000030h]		3_2_6D477960
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D4FC536 mov eax, dword ptr fs:[00000030h]		3_2_6D4FC536
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D4FC46C mov eax, dword ptr fs:[00000030h]		3_2_6D4FC46C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D4FC073 push dword ptr fs:[00000030h]		3_2_6D4FC073

Contains functionality to register its own exception handler

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D474F60 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6D474F60
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D4636C0 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6D4636C0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D463990 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6D463990
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D4638F0 SetUnhandledExceptionFilter,		0_2_6D4638F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D474F60 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		3_2_6D474F60
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D4636C0 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		3_2_6D4636C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D463990 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		3_2_6D463990
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D4638F0 SetUnhandledExceptionFilter,		3_2_6D4638F0

HIPS / PFW / Operating System Protection Evasion:

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\A5uTdwOwJ1.dll',#1

Jump to behavior

May try to detect the Windows Explorer process (often used for injection)

Source: loaddll32.exe, 00000000.00000002.933070548.0000000001620000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.933475448.0000000002FF0000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: loaddll32.exe, 00000000.00000002.933070548.0000000001620000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.933475448.0000000002FF0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: loaddll32.exe, 00000000.00000002.933070548.0000000001620000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.933475448.0000000002FF0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: loaddll32.exe, 00000000.00000002.933070548.0000000001620000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.933475448.0000000002FF0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Contains functionality to query CPU information (cpuid)

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_02B62D6E cpuid

3_2_02B62D6E

Contains functionality to query local / system time

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6D431237 SetThreadPriority,GetSystemTime,SwitchToThread,Sleep,GetLongPathNameW,GetLongPathNameW,GetLongPathNameW,GetLastError,WaitForSingleObject,GetExitCodeThread,CloseHandle,GetLastError,GetLastError,

0_2_6D431237

Contains functionality to query the account / user name

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_02B62D6E RtlAllocateHeap,GetUserNameW,RtlAllocateHeap,GetUserNameW,HeapFree,GetComputerNameW,GetComputerNameW,RtlAllocateHeap,GetComputerNameW,HeapFree,

3_2_02B62D6E

Contains functionality to query windows version

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6D431CDD CreateEventA,GetVersion,GetCurrentProcessId,OpenProcess,GetLastError,

0_2_6D431CDD

Stealing of Sensitive Information:

Yara detected Ursnif

Source: Yara match	File source: 00000003.00000002.933933475.00000000050E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 7076, type: MEMORY

Remote Access Functionality:

Yara detected Ursnif

Source: Yara match	File source: 00000003.00000002.933933475.00000000050E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 7076, type: MEMORY