Analysis Report kZcCqvNtWa.dll

ID:	412159
Product:	CloudBasic
Start time:	13:00:39
Start date:	12.05.2021
Sample:	kZcCqvNtWa.dll
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	b9b732dbc6f94c79b5767eb98ebd899a
SHA1:	984a3ba5d4fe06265ce23cec82bda6a63b2bb3bc
SHA256:	1a0d4b328438a72cee012f6387825d942463b896fadc13f2c17e8d005f510cd4
Filetype:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{20078DE0-B35D-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	13E47D90BC1C1D71FB960BD7DBF91099	17385913779143F5D7281C96EAFF4EA46F7A563A	0E0755C66FE657EF520818206045A6C0D2DD547A64BEBF294700E20579CD3980
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{20078DE2-B35D-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	75B9311DC327D4B60EDACD38906AAD77	F6936702FDCB04C1D892B8E57DD19990B802786D	E7BDD1D59779EFA94418DC0D478B7D11D753157B8C20AFBCCD006CF377B3C346
C:\Users\user\AppData\Local\Temp\~DF431E96C18C7F8EF8.TMP	data	F9BEBD0A297294BDC7B8C6114EB819EE	B1B441E13DB70A0D1E0CC3A2A6190C5C1A91F3D8	6A30EE99C23AA29DC94019C3BAA95B463123752680D4FE185BF5FA05BEF15F17
C:\Users\user\AppData\Local\Temp\~DFE4F68CE1A440F339.TMP	data	4762FCF754568D904969642F670EB3B1	75FC43D947F228DAA1EC1BA2E54562C8FC869D41	8E4034726C607D15EF4ADEEC4D952A17EAE0ADC1F52AEC4A96752316D7A53060

AV Detection:

Found malware configuration

Source: 5.3.rundll32.exe.d2a427.0.raw.unpack

Malware Configuration Extractor: Ursnif {"RSA Public Key": "KujE77ctKyR8x3/dODwZbEsxGmck+FW9384s5u0Kacw8y1gCN+8m2bfjJPovkn+Uzufcdfss+a43eI6oHR1KgWQmvEAO6LK8tJv+Wl7iCBPJP7eef8xKeXht/Mhk1PSj7mHnJ9lcqKMtTteEdSecVvMRtb/WSKVTFfHDva9My7AJ/NbXqHdzCG7znACswLxD", "c2_domain": ["outlook.com/login", "gmail.com", "worunekulo.club", "horunekulo.website"], "botnet": "8877", "server": "12", "serpent_key": "30218409ILPAJDUR", "sleep_time": "10", "CONF_TIMEOUT": "20", "SetWaitableTimer_value": "0", "DGA_count": "10"}

Multi AV Scanner detection for submitted file

Source: kZcCqvNtWa.dll

ReversingLabs: Detection: 21%

Machine Learning detection for sample

Source: kZcCqvNtWa.dll

Joe Sandbox ML: detected

Compliance:

Uses 32bit PE files

Source: kZcCqvNtWa.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Binary contains paths to debug symbols

Source:

Binary string: c:\Tube-meet\585\straight\lift\38_Claim\Tail.pdb source: loaddll32.exe, 00000000.00000002.480778808.000000006E289000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000002.479153934.000000006E289000.00000002.00020000.sdmp, kZcCqvNtWa.dll

Spreading:

Contains functionality to enumerate / list files inside a directory

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_001D4C3B RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,memset,CreateFileA,GetFileTime,CloseHandle,StrRChrA,lstrcat,FindFirstFileA,FindFirstFileA,CompareFileTime,CompareFileTime,FindClose,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,StrChrA,memcpy,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,FindClose,HeapFree,HeapFree,

0_2_001D4C3B

Networking:

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: outlook.com

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected Ursnif

Source: Yara match	File source: 00000000.00000002.477098512.0000000002FA8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 1956, type: MEMORY

E-Banking Fraud:

Yara detected Ursnif

Source: Yara match	File source: 00000000.00000002.477098512.0000000002FA8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 1956, type: MEMORY

System Summary:

Writes or reads registry keys via WMI

Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetStringValue
Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue

Writes registry values via WMI

Source: C:\Windows\System32\loaddll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\System32\loaddll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\System32\loaddll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue

Contains functionality to call native functions

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E241F14 NtMapViewOfSection,		0_2_6E241F14
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E2415F1 GetProcAddress,NtCreateSection,memset,		0_2_6E2415F1
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E2423A5 NtQueryVirtualMemory,		0_2_6E2423A5
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_001D1168 NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose,		0_2_001D1168
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_001DB2F1 NtQueryVirtualMemory,		0_2_001DB2F1

Detected potential crypto function

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E242184		0_2_6E242184
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_001DB0CC		0_2_001DB0CC
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_001D696A		0_2_001D696A
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_001D1B6A		0_2_001D1B6A
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E278960		0_2_6E278960
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E282153		0_2_6E282153
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E278960		3_2_6E278960
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E282153		3_2_6E282153

Sample file is different than original file name gathered from version info

Source: kZcCqvNtWa.dll

Binary or memory string: OriginalFilenameTail.dll0 vs kZcCqvNtWa.dll

Uses 32bit PE files

Source: kZcCqvNtWa.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)

Source: kZcCqvNtWa.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Classification label

Source: classification engine

Classification label: mal76.troj.winDLL@14/4@3/0

Contains functionality to enum processes or threads

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_001D7F56 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_001D7F56

Creates files inside the user directory

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High

Jump to behavior

Creates temporary files

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DFE4F68CE1A440F339.TMP

Jump to behavior

PE file has an executable .text section and no other executable section

Source: kZcCqvNtWa.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads ini files

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Reads software policies

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Runs a DLL by calling functions

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\kZcCqvNtWa.dll,Eithernothing

Sample is known by Antivirus

Source: kZcCqvNtWa.dll

ReversingLabs: Detection: 21%

Spawns processes

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\kZcCqvNtWa.dll'
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\kZcCqvNtWa.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\kZcCqvNtWa.dll,Eithernothing
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\kZcCqvNtWa.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\kZcCqvNtWa.dll,Order
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\kZcCqvNtWa.dll,Smileschool
Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:1492 CREDAT:17410 /prefetch:2
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\kZcCqvNtWa.dll',#1			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\kZcCqvNtWa.dll,Eithernothing			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\kZcCqvNtWa.dll,Order			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\kZcCqvNtWa.dll,Smileschool			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\kZcCqvNtWa.dll',#1			Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:1492 CREDAT:17410 /prefetch:2			Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Windows\System32\loaddll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Found GUI installer (many successful clicks)

Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

PE file contains a mix of data directories often seen in goodware

Source: kZcCqvNtWa.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: kZcCqvNtWa.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: kZcCqvNtWa.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: kZcCqvNtWa.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: kZcCqvNtWa.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: kZcCqvNtWa.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

PE file contains a debug data directory

Source: kZcCqvNtWa.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Binary contains paths to debug symbols

Source:

Binary string: c:\Tube-meet\585\straight\lift\38_Claim\Tail.pdb source: loaddll32.exe, 00000000.00000002.480778808.000000006E289000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000002.479153934.000000006E289000.00000002.00020000.sdmp, kZcCqvNtWa.dll

PE file contains a valid data directory to section mapping

Source: kZcCqvNtWa.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: kZcCqvNtWa.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: kZcCqvNtWa.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: kZcCqvNtWa.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: kZcCqvNtWa.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation:

Contains functionality to dynamically determine API calls

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E2417FA LoadLibraryA,GetProcAddress,

0_2_6E2417FA

PE file contains an invalid checksum

Source: kZcCqvNtWa.dll

Static PE information: real checksum: 0x84de2 should be: 0x8037c

Uses code obfuscation techniques (call, push, ret)

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E242120 push ecx; ret		0_2_6E242129
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E242173 push ecx; ret		0_2_6E242183
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_001DB0BB push ecx; ret		0_2_001DB0CB
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_001DAD00 push ecx; ret		0_2_001DAD09
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E282761 push ecx; ret		0_2_6E282774
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E254348 push ss; ret		0_2_6E25434B
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E25778D pushfd ; ret		0_2_6E2577AB
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E252F9A push edi; retf		0_2_6E252FA4
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E252C15 push ebp; retf		0_2_6E252C16
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E282761 push ecx; ret		3_2_6E282774
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E254348 push ss; ret		3_2_6E25434B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E25778D pushfd ; ret		3_2_6E2577AB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E252F9A push edi; retf		3_2_6E252FA4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E252C15 push ebp; retf		3_2_6E252C16

Hooking and other Techniques for Hiding and Protection:

Yara detected Ursnif

Source: Yara match	File source: 00000000.00000002.477098512.0000000002FA8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 1956, type: MEMORY

Disables application error messsages (SetErrorMode)

Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed

Contains functionality to enumerate / list files inside a directory

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_001D4C3B RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,memset,CreateFileA,GetFileTime,CloseHandle,StrRChrA,lstrcat,FindFirstFileA,FindFirstFileA,CompareFileTime,CompareFileTime,FindClose,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,StrChrA,memcpy,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,FindClose,HeapFree,HeapFree,

0_2_001D4C3B

Anti Debugging:

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E28636F _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_6E28636F

Contains functionality to dynamically determine API calls

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E2417FA LoadLibraryA,GetProcAddress,

0_2_6E2417FA

Contains functionality to read the PEB

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E2B5770 mov eax, dword ptr fs:[00000030h]		0_2_6E2B5770
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E2B56A6 mov eax, dword ptr fs:[00000030h]		0_2_6E2B56A6
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E2B52AD push dword ptr fs:[00000030h]		0_2_6E2B52AD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E2B5770 mov eax, dword ptr fs:[00000030h]		3_2_6E2B5770
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E2B56A6 mov eax, dword ptr fs:[00000030h]		3_2_6E2B56A6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E2B52AD push dword ptr fs:[00000030h]		3_2_6E2B52AD

Contains functionality to register its own exception handler

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E282F08 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6E282F08
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E28636F _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6E28636F
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E28150C IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6E28150C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E282F08 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		3_2_6E282F08
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E28636F _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		3_2_6E28636F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E28150C IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		3_2_6E28150C

HIPS / PFW / Operating System Protection Evasion:

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\kZcCqvNtWa.dll',#1

Jump to behavior

May try to detect the Windows Explorer process (often used for injection)

Source: loaddll32.exe, 00000000.00000002.476337684.0000000001240000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.477553156.0000000003910000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: loaddll32.exe, 00000000.00000002.476337684.0000000001240000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.477553156.0000000003910000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: loaddll32.exe, 00000000.00000002.476337684.0000000001240000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.477553156.0000000003910000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: loaddll32.exe, 00000000.00000002.476337684.0000000001240000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.477553156.0000000003910000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Contains functionality to query CPU information (cpuid)

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_001D2D6E cpuid

0_2_001D2D6E

Contains functionality to query locales information (e.g. system language)

Source: C:\Windows\System32\loaddll32.exe	Code function: GetLocaleInfoA,		0_2_6E287660
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoA,		3_2_6E287660

Contains functionality to query local / system time

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E241237 SetThreadPriority,GetSystemTime,SwitchToThread,Sleep,GetLongPathNameW,GetLongPathNameW,GetLongPathNameW,GetLastError,WaitForSingleObject,GetExitCodeThread,CloseHandle,GetLastError,GetLastError,

0_2_6E241237

Contains functionality to query the account / user name

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_001D2D6E RtlAllocateHeap,GetUserNameW,RtlAllocateHeap,GetUserNameW,HeapFree,GetComputerNameW,GetComputerNameW,RtlAllocateHeap,GetComputerNameW,HeapFree,

0_2_001D2D6E

Contains functionality to query windows version

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E241CDD CreateEventA,GetVersion,GetCurrentProcessId,OpenProcess,GetLastError,

0_2_6E241CDD

Stealing of Sensitive Information:

Yara detected Ursnif

Source: Yara match	File source: 00000000.00000002.477098512.0000000002FA8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 1956, type: MEMORY

Remote Access Functionality:

Yara detected Ursnif

Source: Yara match	File source: 00000000.00000002.477098512.0000000002FA8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 1956, type: MEMORY