Analysis Report nT5pUwoJSS.dll

ID:	412166
Product:	CloudBasic
Start time:	13:05:21
Start date:	12.05.2021
Sample:	nT5pUwoJSS.dll
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	6fdbd25f7a84da80ee9d8577122c3291
SHA1:	39a52cbc48be934cf953d4699e8a1ea5ff53a5bf
SHA256:	4bf6e9d4067cb905631ddf7452ac571c4ed9800c7eb8fc7e51b688e1154f52e3
Filetype:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60%

Name	Type	MD5	SHA1	SHA256
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_rundll32.exe_4323c1d7a32576d87639b5d887c5a93fe7aab20_82810a17_002dad83\Report.wer	Little-endian UTF-16 Unicode text, with CRLF line terminators	65B1A8F8223E4AB018A95B43305BB1C8	48B24682C2E0631A963EB2BEF63ABD6F50ECF4C5	5C437229DCC881F3B4F37B7BB9B772AADD7AD70D95C1E89E9A451E8C94726565
C:\ProgramData\Microsoft\Windows\WER\Temp\WER8EB1.tmp.dmp	Mini DuMP crash report, 15 streams, Wed May 12 11:07:55 2021, 0x1205a4 type	2DFACEB2A6B8E2DB10FA736DE4498EAC	59577B330853D4007FFD428C7A70100F6373F93E	DF885B82793B6A37F202AD54154B6CDAC1F386C92701CF861E596B7AC12BAD52
C:\ProgramData\Microsoft\Windows\WER\Temp\WER9808.tmp.WERInternalMetadata.xml	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators	D2AE7D4FC19E3D3F00CB3BBA18716414	F27E57C80022F1AD378735B72957A6A4B05805E4	A73833AD0DB5A85528DAD79B81C85DB2EC216A26CE6E5E54EE4EFAF76ACD3C37
C:\ProgramData\Microsoft\Windows\WER\Temp\WER9A6B.tmp.xml	XML 1.0 document, ASCII text, with CRLF line terminators	3A363033BCDA509CC11610F8EAE185F1	78454D6E43EC4DA98F46B02EF181673BCD929E6E	E9E57C10B891757381366073C1037A28BD36DB3DAB60F99BEE3D2690BC0107EB
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{4BD5DCDD-B312-11EB-90EB-ECF4BBEA1588}.dat	Microsoft Word Document	F75591F98019D2A0608F3FB097EA2F15	4787CAEFE912FB167C6FEB9FE00EEC553BDEA5FC	EB3FC9C41D9193ED4B8409124C88AF54D920E178F2CF2FBF466CA0CEA4C4A534
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{4BD5DCDF-B312-11EB-90EB-ECF4BBEA1588}.dat	Microsoft Word Document	8B7FC14949EEB4934FD6671CDF794B2E	258C482B68B3B6141A58274D970E0B6207DB7ED9	9EC0132700BAA61FE67AFAFF537B02FE5A31E856547FD0D7528964F4AC7EC3B6
C:\Users\user\AppData\Local\Temp\JavaDeployReg.log	ASCII text, with CRLF line terminators	174BE973E6B0C3BD797883F3212802DF	954D60C1360503B14A9E51AB3ACA4BDD2A5C0EB4	C13A06C3F7825D7230CB567F756CDE4F8CADDE35A8FBED07F36E4688E0432EBA
C:\Users\user\AppData\Local\Temp\~DF7EA0309EEFF1F973.TMP	data	4B91B3F5A88EEBB6F58712D6DAC44382	3E64372F0900AD52FE1259E702A1F0C2DE8004B0	E2BA9974330571C2AD06972236C49D39DABF23514931341E6CCD45518C3F1AF4
C:\Users\user\AppData\Local\Temp\~DFA1436EB82669AF9C.TMP	data	A7BD0ABE7B8FC7B1D1EADEC39A42E343	83109B9245E2D070D04B32FA123C9D81EC10F66F	51542B6CDC943EB6BE14D54417295C84A4FAF1FE953309D01F82ACAC05E59684

AV Detection:

Found malware configuration

Source: 2.3.rundll32.exe.2c3a427.0.raw.unpack

Malware Configuration Extractor: Ursnif {"RSA Public Key": "KujE77ctKyR8x3/dODwZbEsxGmck+FW9384s5u0Kacw8y1gCN+8m2bfjJPovkn+Uzufcdfss+a43eI6oHR1KgWQmvEAO6LK8tJv+Wl7iCBPJP7eef8xKeXht/Mhk1PSj7mHnJ9lcqKMtTteEdSecVvMRtb/WSKVTFfHDva9My7AJ/NbXqHdzCG7znACswLxD", "c2_domain": ["outlook.com/login", "gmail.com", "worunekulo.club", "horunekulo.website"], "botnet": "8877", "server": "12", "serpent_key": "30218409ILPAJDUR", "sleep_time": "10", "CONF_TIMEOUT": "20", "SetWaitableTimer_value": "0", "DGA_count": "10"}

Multi AV Scanner detection for submitted file

Source: nT5pUwoJSS.dll

ReversingLabs: Detection: 21%

Machine Learning detection for sample

Source: nT5pUwoJSS.dll

Joe Sandbox ML: detected

Compliance:

Uses 32bit PE files

Source: nT5pUwoJSS.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Binary contains paths to debug symbols

Source:	Binary string: WinTypes.pdb source: WerFault.exe, 0000000E.00000003.877178241.00000000054B8000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 0000000E.00000003.877150274.00000000053A1000.00000004.00000001.sdmp
Source:	Binary string: shlwapi.pdb+ source: WerFault.exe, 0000000E.00000003.877178241.00000000054B8000.00000004.00000040.sdmp
Source:	Binary string: sfc_os.pdb source: WerFault.exe, 0000000E.00000003.877178241.00000000054B8000.00000004.00000040.sdmp
Source:	Binary string: bcrypt.pdb source: WerFault.exe, 0000000E.00000003.877178241.00000000054B8000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 0000000E.00000003.877169719.00000000054B2000.00000004.00000040.sdmp
Source:	Binary string: CoreMessaging.pdb_ source: WerFault.exe, 0000000E.00000003.877259368.00000000054C3000.00000004.00000040.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 0000000E.00000003.877150274.00000000053A1000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 0000000E.00000003.877231767.00000000054B0000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 0000000E.00000003.871565860.00000000032AE000.00000004.00000001.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 0000000E.00000003.877239660.00000000054B5000.00000004.00000040.sdmp
Source:	Binary string: CoreMessaging.pdb source: WerFault.exe, 0000000E.00000003.877259368.00000000054C3000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 0000000E.00000003.877150274.00000000053A1000.00000004.00000001.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 0000000E.00000003.877178241.00000000054B8000.00000004.00000040.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 0000000E.00000003.877178241.00000000054B8000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 0000000E.00000003.877178241.00000000054B8000.00000004.00000040.sdmp
Source:	Binary string: TextInputFramework.pdb4h source: WerFault.exe, 0000000E.00000003.877178241.00000000054B8000.00000004.00000040.sdmp
Source:	Binary string: shell32.pdb source: WerFault.exe, 0000000E.00000003.877239660.00000000054B5000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdbk source: WerFault.exe, 0000000E.00000003.877169719.00000000054B2000.00000004.00000040.sdmp
Source:	Binary string: ntmarta.pdb source: WerFault.exe, 0000000E.00000003.877178241.00000000054B8000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 0000000E.00000003.877169719.00000000054B2000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 0000000E.00000003.877150274.00000000053A1000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 0000000E.00000003.877178241.00000000054B8000.00000004.00000040.sdmp
Source:	Binary string: CoreUIComponents.pdb source: WerFault.exe, 0000000E.00000003.877259368.00000000054C3000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 0000000E.00000003.877178241.00000000054B8000.00000004.00000040.sdmp
Source:	Binary string: mpr.pdb source: WerFault.exe, 0000000E.00000003.877231767.00000000054B0000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 0000000E.00000003.877150274.00000000053A1000.00000004.00000001.sdmp
Source:	Binary string: setupapi.pdb source: WerFault.exe, 0000000E.00000003.877178241.00000000054B8000.00000004.00000040.sdmp
Source:	Binary string: imagehlp.pdb source: WerFault.exe, 0000000E.00000003.877178241.00000000054B8000.00000004.00000040.sdmp
Source:	Binary string: wUxTheme.pdb source: WerFault.exe, 0000000E.00000003.877178241.00000000054B8000.00000004.00000040.sdmp
Source:	Binary string: dwmapi.pdb source: WerFault.exe, 0000000E.00000003.877178241.00000000054B8000.00000004.00000040.sdmp
Source:	Binary string: c:\Tube-meet\585\straight\lift\38_Claim\Tail.pdb source: loaddll32.exe, 00000000.00000002.910074848.000000006D4C9000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000002.911410296.000000006D4C9000.00000002.00020000.sdmp, nT5pUwoJSS.dll
Source:	Binary string: shcore.pdbk source: WerFault.exe, 0000000E.00000003.877239660.00000000054B5000.00000004.00000040.sdmp
Source:	Binary string: profapi.pdb source: WerFault.exe, 0000000E.00000003.877178241.00000000054B8000.00000004.00000040.sdmp
Source:	Binary string: winspool.pdb source: WerFault.exe, 0000000E.00000003.877178241.00000000054B8000.00000004.00000040.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 0000000E.00000003.877150274.00000000053A1000.00000004.00000001.sdmp
Source:	Binary string: shell32.pdbk source: WerFault.exe, 0000000E.00000003.877239660.00000000054B5000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 0000000E.00000003.877178241.00000000054B8000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdb source: WerFault.exe, 0000000E.00000003.877178241.00000000054B8000.00000004.00000040.sdmp
Source:	Binary string: sfc.pdb4a source: WerFault.exe, 0000000E.00000003.877178241.00000000054B8000.00000004.00000040.sdmp
Source:	Binary string: propsys.pdb source: WerFault.exe, 0000000E.00000003.877178241.00000000054B8000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdbk source: WerFault.exe, 0000000E.00000003.877239660.00000000054B5000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdbk source: WerFault.exe, 0000000E.00000003.877169719.00000000054B2000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 0000000E.00000003.877178241.00000000054B8000.00000004.00000040.sdmp
Source:	Binary string: msctf.pdb source: WerFault.exe, 0000000E.00000003.877178241.00000000054B8000.00000004.00000040.sdmp
Source:	Binary string: ole32.pdb source: WerFault.exe, 0000000E.00000003.877178241.00000000054B8000.00000004.00000040.sdmp
Source:	Binary string: TextInputFramework.pdb source: WerFault.exe, 0000000E.00000003.877178241.00000000054B8000.00000004.00000040.sdmp
Source:	Binary string: AcLayers.pdb source: WerFault.exe, 0000000E.00000003.877150274.00000000053A1000.00000004.00000001.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 0000000E.00000003.877231767.00000000054B0000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 0000000E.00000003.877178241.00000000054B8000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 0000000E.00000003.877239660.00000000054B5000.00000004.00000040.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 0000000E.00000003.877231767.00000000054B0000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 0000000E.00000003.877178241.00000000054B8000.00000004.00000040.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 0000000E.00000003.877231767.00000000054B0000.00000004.00000040.sdmp
Source:	Binary string: rundll32.pdb source: WerFault.exe, 0000000E.00000003.877150274.00000000053A1000.00000004.00000001.sdmp
Source:	Binary string: oleaut32.pdb source: WerFault.exe, 0000000E.00000003.877178241.00000000054B8000.00000004.00000040.sdmp
Source:	Binary string: sfc.pdb source: WerFault.exe, 0000000E.00000003.877178241.00000000054B8000.00000004.00000040.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 0000000E.00000003.877150274.00000000053A1000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 0000000E.00000003.877150274.00000000053A1000.00000004.00000001.sdmp
Source:	Binary string: mpr.pdb7` source: WerFault.exe, 0000000E.00000003.877231767.00000000054B0000.00000004.00000040.sdmp

Spreading:

Contains functionality to enumerate / list files inside a directory

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_02C84C3B RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,memset,CreateFileA,GetFileTime,FindCloseChangeNotification,StrRChrA,lstrcat,FindFirstFileA,FindFirstFileA,CompareFileTime,CompareFileTime,FindClose,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,StrChrA,memcpy,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,FindClose,HeapFree,HeapFree,

3_2_02C84C3B

Networking:

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 40.97.153.146 40.97.153.146

Downloads files from webservers via HTTP

Source: global traffic

HTTP traffic detected: GET /login/greed/KnH9H6Qjc_2F7/0e3_2F0_/2FRqQPyOKs18rFK5waVCGCI/jIBCBbgDdF/18TiURZdioL3eU4Wc/SUXArexakZ5d/R0lDxIGeIYj/c6FwtLcTr3EmEj/nbrTM1t_2BdTxREGmfFhs/_2BnTf5cT9dEAnPd/AFLbs3lARk22SMJ/POUz7dti2oyFXHE3_2/FgEVGs1vD/4LhoHpnAxyp/chUrsX.gfk HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: outlook.comConnection: Keep-Alive

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: outlook.com

URLs found in memory or binary data

Source: WerFault.exe, 0000000E.00000003.889153103.0000000005072000.00000004.00000001.sdmp	String found in binary or memory: http://crl.microsoft
Source: {4BD5DCDF-B312-11EB-90EB-ECF4BBEA1588}.dat.17.dr	String found in binary or memory: https://outlook.office365.com/login/greed/KnH9H6Qjc_2F7/0e3_2F0_/2FRqQPyOKs18rFK5waVCGCI/jIBCBbgDdF/

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected Ursnif

Source: Yara match	File source: 00000003.00000003.881584954.00000000050E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.881638380.00000000050E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.881444184.00000000050E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.881614039.00000000050E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.881537844.00000000050E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.881689753.00000000050E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.881502007.00000000050E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.881360850.00000000050E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 6960, type: MEMORY

Creates a DirectInput object (often for capturing keystrokes)

Source: loaddll32.exe, 00000000.00000002.909557678.00000000012EB000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

Yara detected Ursnif

Source: Yara match	File source: 00000003.00000003.881584954.00000000050E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.881638380.00000000050E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.881444184.00000000050E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.881614039.00000000050E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.881537844.00000000050E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.881689753.00000000050E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.881502007.00000000050E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.881360850.00000000050E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 6960, type: MEMORY

System Summary:

Writes registry values via WMI

Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue

Contains functionality to call native functions

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D4823A5 NtQueryVirtualMemory,		0_2_6D4823A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D4815F1 GetProcAddress,NtCreateSection,memset,		3_2_6D4815F1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D481F14 NtMapViewOfSection,		3_2_6D481F14
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D4823A5 NtQueryVirtualMemory,		3_2_6D4823A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02C81168 NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose,		3_2_02C81168
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02C8B2F1 NtQueryVirtualMemory,		3_2_02C8B2F1

Detected potential crypto function

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D482184		0_2_6D482184
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D4B8960		0_2_6D4B8960
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D4C2153		0_2_6D4C2153
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D482184		3_2_6D482184
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02C8B0CC		3_2_02C8B0CC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02C8696A		3_2_02C8696A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02C81B6A		3_2_02C81B6A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D4B8960		3_2_6D4B8960
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D4C2153		3_2_6D4C2153

One or more processes crash

Source: C:\Windows\SysWOW64\rundll32.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6992 -s 892

Sample file is different than original file name gathered from version info

Source: nT5pUwoJSS.dll

Binary or memory string: OriginalFilenameTail.dll0 vs nT5pUwoJSS.dll

Uses 32bit PE files

Source: nT5pUwoJSS.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)

Source: nT5pUwoJSS.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Classification label

Source: classification engine

Classification label: mal72.troj.winDLL@15/9@3/3

Contains functionality to enum processes or threads

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_02C87F56 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

3_2_02C87F56

Creates files inside the user directory

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{4BD5DCDD-B312-11EB-90EB-ECF4BBEA1588}.dat

Jump to behavior

Creates mutexes

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6992

Creates temporary files

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WER8EB1.tmp

Jump to behavior

PE file has an executable .text section and no other executable section

Source: nT5pUwoJSS.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads ini files

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Reads software policies

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Reads the hosts file

Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Runs a DLL by calling functions

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\nT5pUwoJSS.dll,Eithernothing

Sample is known by Antivirus

Source: nT5pUwoJSS.dll

ReversingLabs: Detection: 21%

Spawns processes

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\nT5pUwoJSS.dll'
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\nT5pUwoJSS.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\nT5pUwoJSS.dll,Eithernothing
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\nT5pUwoJSS.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\nT5pUwoJSS.dll,Order
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\nT5pUwoJSS.dll,Smileschool
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6992 -s 892
Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5516 CREDAT:17410 /prefetch:2
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\nT5pUwoJSS.dll',#1			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\nT5pUwoJSS.dll,Eithernothing			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\nT5pUwoJSS.dll,Order			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\nT5pUwoJSS.dll,Smileschool			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\nT5pUwoJSS.dll',#1			Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5516 CREDAT:17410 /prefetch:2			Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Found GUI installer (many successful clicks)

Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

PE file contains a mix of data directories often seen in goodware

Source: nT5pUwoJSS.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: nT5pUwoJSS.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: nT5pUwoJSS.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: nT5pUwoJSS.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: nT5pUwoJSS.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: nT5pUwoJSS.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

PE file contains a debug data directory

Source: nT5pUwoJSS.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Binary contains paths to debug symbols

Source:	Binary string: WinTypes.pdb source: WerFault.exe, 0000000E.00000003.877178241.00000000054B8000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 0000000E.00000003.877150274.00000000053A1000.00000004.00000001.sdmp
Source:	Binary string: shlwapi.pdb+ source: WerFault.exe, 0000000E.00000003.877178241.00000000054B8000.00000004.00000040.sdmp
Source:	Binary string: sfc_os.pdb source: WerFault.exe, 0000000E.00000003.877178241.00000000054B8000.00000004.00000040.sdmp
Source:	Binary string: bcrypt.pdb source: WerFault.exe, 0000000E.00000003.877178241.00000000054B8000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 0000000E.00000003.877169719.00000000054B2000.00000004.00000040.sdmp
Source:	Binary string: CoreMessaging.pdb_ source: WerFault.exe, 0000000E.00000003.877259368.00000000054C3000.00000004.00000040.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 0000000E.00000003.877150274.00000000053A1000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 0000000E.00000003.877231767.00000000054B0000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 0000000E.00000003.871565860.00000000032AE000.00000004.00000001.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 0000000E.00000003.877239660.00000000054B5000.00000004.00000040.sdmp
Source:	Binary string: CoreMessaging.pdb source: WerFault.exe, 0000000E.00000003.877259368.00000000054C3000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 0000000E.00000003.877150274.00000000053A1000.00000004.00000001.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 0000000E.00000003.877178241.00000000054B8000.00000004.00000040.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 0000000E.00000003.877178241.00000000054B8000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 0000000E.00000003.877178241.00000000054B8000.00000004.00000040.sdmp
Source:	Binary string: TextInputFramework.pdb4h source: WerFault.exe, 0000000E.00000003.877178241.00000000054B8000.00000004.00000040.sdmp
Source:	Binary string: shell32.pdb source: WerFault.exe, 0000000E.00000003.877239660.00000000054B5000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdbk source: WerFault.exe, 0000000E.00000003.877169719.00000000054B2000.00000004.00000040.sdmp
Source:	Binary string: ntmarta.pdb source: WerFault.exe, 0000000E.00000003.877178241.00000000054B8000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 0000000E.00000003.877169719.00000000054B2000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 0000000E.00000003.877150274.00000000053A1000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 0000000E.00000003.877178241.00000000054B8000.00000004.00000040.sdmp
Source:	Binary string: CoreUIComponents.pdb source: WerFault.exe, 0000000E.00000003.877259368.00000000054C3000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 0000000E.00000003.877178241.00000000054B8000.00000004.00000040.sdmp
Source:	Binary string: mpr.pdb source: WerFault.exe, 0000000E.00000003.877231767.00000000054B0000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 0000000E.00000003.877150274.00000000053A1000.00000004.00000001.sdmp
Source:	Binary string: setupapi.pdb source: WerFault.exe, 0000000E.00000003.877178241.00000000054B8000.00000004.00000040.sdmp
Source:	Binary string: imagehlp.pdb source: WerFault.exe, 0000000E.00000003.877178241.00000000054B8000.00000004.00000040.sdmp
Source:	Binary string: wUxTheme.pdb source: WerFault.exe, 0000000E.00000003.877178241.00000000054B8000.00000004.00000040.sdmp
Source:	Binary string: dwmapi.pdb source: WerFault.exe, 0000000E.00000003.877178241.00000000054B8000.00000004.00000040.sdmp
Source:	Binary string: c:\Tube-meet\585\straight\lift\38_Claim\Tail.pdb source: loaddll32.exe, 00000000.00000002.910074848.000000006D4C9000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000002.911410296.000000006D4C9000.00000002.00020000.sdmp, nT5pUwoJSS.dll
Source:	Binary string: shcore.pdbk source: WerFault.exe, 0000000E.00000003.877239660.00000000054B5000.00000004.00000040.sdmp
Source:	Binary string: profapi.pdb source: WerFault.exe, 0000000E.00000003.877178241.00000000054B8000.00000004.00000040.sdmp
Source:	Binary string: winspool.pdb source: WerFault.exe, 0000000E.00000003.877178241.00000000054B8000.00000004.00000040.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 0000000E.00000003.877150274.00000000053A1000.00000004.00000001.sdmp
Source:	Binary string: shell32.pdbk source: WerFault.exe, 0000000E.00000003.877239660.00000000054B5000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 0000000E.00000003.877178241.00000000054B8000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdb source: WerFault.exe, 0000000E.00000003.877178241.00000000054B8000.00000004.00000040.sdmp
Source:	Binary string: sfc.pdb4a source: WerFault.exe, 0000000E.00000003.877178241.00000000054B8000.00000004.00000040.sdmp
Source:	Binary string: propsys.pdb source: WerFault.exe, 0000000E.00000003.877178241.00000000054B8000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdbk source: WerFault.exe, 0000000E.00000003.877239660.00000000054B5000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdbk source: WerFault.exe, 0000000E.00000003.877169719.00000000054B2000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 0000000E.00000003.877178241.00000000054B8000.00000004.00000040.sdmp
Source:	Binary string: msctf.pdb source: WerFault.exe, 0000000E.00000003.877178241.00000000054B8000.00000004.00000040.sdmp
Source:	Binary string: ole32.pdb source: WerFault.exe, 0000000E.00000003.877178241.00000000054B8000.00000004.00000040.sdmp
Source:	Binary string: TextInputFramework.pdb source: WerFault.exe, 0000000E.00000003.877178241.00000000054B8000.00000004.00000040.sdmp
Source:	Binary string: AcLayers.pdb source: WerFault.exe, 0000000E.00000003.877150274.00000000053A1000.00000004.00000001.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 0000000E.00000003.877231767.00000000054B0000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 0000000E.00000003.877178241.00000000054B8000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 0000000E.00000003.877239660.00000000054B5000.00000004.00000040.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 0000000E.00000003.877231767.00000000054B0000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 0000000E.00000003.877178241.00000000054B8000.00000004.00000040.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 0000000E.00000003.877231767.00000000054B0000.00000004.00000040.sdmp
Source:	Binary string: rundll32.pdb source: WerFault.exe, 0000000E.00000003.877150274.00000000053A1000.00000004.00000001.sdmp
Source:	Binary string: oleaut32.pdb source: WerFault.exe, 0000000E.00000003.877178241.00000000054B8000.00000004.00000040.sdmp
Source:	Binary string: sfc.pdb source: WerFault.exe, 0000000E.00000003.877178241.00000000054B8000.00000004.00000040.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 0000000E.00000003.877150274.00000000053A1000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 0000000E.00000003.877150274.00000000053A1000.00000004.00000001.sdmp
Source:	Binary string: mpr.pdb7` source: WerFault.exe, 0000000E.00000003.877231767.00000000054B0000.00000004.00000040.sdmp

PE file contains a valid data directory to section mapping

Source: nT5pUwoJSS.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: nT5pUwoJSS.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: nT5pUwoJSS.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: nT5pUwoJSS.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: nT5pUwoJSS.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation:

Contains functionality to dynamically determine API calls

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6D4817FA LoadLibraryA,GetProcAddress,

0_2_6D4817FA

PE file contains an invalid checksum

Source: nT5pUwoJSS.dll

Static PE information: real checksum: 0x84de2 should be: 0x84de4

Uses code obfuscation techniques (call, push, ret)

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D482173 push ecx; ret		0_2_6D482183
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D482120 push ecx; ret		0_2_6D482129
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D492C15 push ebp; retf		0_2_6D492C16
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D494348 push ss; ret		0_2_6D49434B
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D4C2761 push ecx; ret		0_2_6D4C2774
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D49778D pushfd ; ret		0_2_6D4977AB
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D492F9A push edi; retf		0_2_6D492FA4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D482173 push ecx; ret		3_2_6D482183
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D482120 push ecx; ret		3_2_6D482129
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02C8B0BB push ecx; ret		3_2_02C8B0CB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02C8AD00 push ecx; ret		3_2_02C8AD09
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D492C15 push ebp; retf		3_2_6D492C16
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D494348 push ss; ret		3_2_6D49434B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D4C2761 push ecx; ret		3_2_6D4C2774
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D49778D pushfd ; ret		3_2_6D4977AB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D492F9A push edi; retf		3_2_6D492FA4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_06B3F7B4 push 776EF672h; iretd		4_2_06B3F7E5

Hooking and other Techniques for Hiding and Protection:

Yara detected Ursnif

Source: Yara match	File source: 00000003.00000003.881584954.00000000050E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.881638380.00000000050E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.881444184.00000000050E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.881614039.00000000050E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.881537844.00000000050E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.881689753.00000000050E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.881502007.00000000050E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.881360850.00000000050E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 6960, type: MEMORY

Disables application error messsages (SetErrorMode)

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\System32\loaddll32.exe	Last function: Thread delayed
Source: C:\Windows\System32\loaddll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed

Contains functionality to enumerate / list files inside a directory

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_02C84C3B RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,memset,CreateFileA,GetFileTime,FindCloseChangeNotification,StrRChrA,lstrcat,FindFirstFileA,FindFirstFileA,CompareFileTime,CompareFileTime,FindClose,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,StrChrA,memcpy,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,FindClose,HeapFree,HeapFree,

3_2_02C84C3B

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: WerFault.exe, 0000000E.00000002.892437315.0000000005110000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: WerFault.exe, 0000000E.00000003.889249389.0000000005046000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: WerFault.exe, 0000000E.00000002.892437315.0000000005110000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: WerFault.exe, 0000000E.00000002.892437315.0000000005110000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: WerFault.exe, 0000000E.00000002.892437315.0000000005110000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Anti Debugging:

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6D4C150C IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_6D4C150C

Contains functionality to dynamically determine API calls

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6D4817FA LoadLibraryA,GetProcAddress,

0_2_6D4817FA

Contains functionality to read the PEB

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D4F5770 mov eax, dword ptr fs:[00000030h]		0_2_6D4F5770
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D4F56A6 mov eax, dword ptr fs:[00000030h]		0_2_6D4F56A6
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D4F52AD push dword ptr fs:[00000030h]		0_2_6D4F52AD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D4F5770 mov eax, dword ptr fs:[00000030h]		3_2_6D4F5770
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D4F56A6 mov eax, dword ptr fs:[00000030h]		3_2_6D4F56A6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D4F52AD push dword ptr fs:[00000030h]		3_2_6D4F52AD

Contains functionality to register its own exception handler

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D4C150C IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6D4C150C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D4C636F _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6D4C636F
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D4C2F08 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6D4C2F08
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D4C150C IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		3_2_6D4C150C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D4C636F _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		3_2_6D4C636F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D4C2F08 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		3_2_6D4C2F08

HIPS / PFW / Operating System Protection Evasion:

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\nT5pUwoJSS.dll',#1

Jump to behavior

May try to detect the Windows Explorer process (often used for injection)

Source: loaddll32.exe, 00000000.00000002.909717516.0000000001870000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.910277829.0000000003140000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: loaddll32.exe, 00000000.00000002.909717516.0000000001870000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.910277829.0000000003140000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: loaddll32.exe, 00000000.00000002.909717516.0000000001870000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.910277829.0000000003140000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: loaddll32.exe, 00000000.00000002.909717516.0000000001870000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.910277829.0000000003140000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Contains functionality to query CPU information (cpuid)

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_02C82D6E cpuid

3_2_02C82D6E

Contains functionality to query locales information (e.g. system language)

Source: C:\Windows\System32\loaddll32.exe	Code function: GetLocaleInfoA,		0_2_6D4C7660
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoA,		3_2_6D4C7660

Contains functionality to query local / system time

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6D481237 SetThreadPriority,GetSystemTime,SwitchToThread,Sleep,GetLongPathNameW,GetLongPathNameW,GetLongPathNameW,GetLastError,WaitForSingleObject,GetExitCodeThread,CloseHandle,GetLastError,GetLastError,

0_2_6D481237

Contains functionality to query the account / user name

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_02C82D6E RtlAllocateHeap,GetUserNameW,RtlAllocateHeap,GetUserNameW,HeapFree,GetComputerNameW,GetComputerNameW,RtlAllocateHeap,GetComputerNameW,HeapFree,

3_2_02C82D6E

Contains functionality to query windows version

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6D481CDD CreateEventA,GetVersion,GetCurrentProcessId,OpenProcess,GetLastError,

0_2_6D481CDD

Stealing of Sensitive Information:

Yara detected Ursnif

Source: Yara match	File source: 00000003.00000003.881584954.00000000050E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.881638380.00000000050E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.881444184.00000000050E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.881614039.00000000050E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.881537844.00000000050E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.881689753.00000000050E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.881502007.00000000050E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.881360850.00000000050E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 6960, type: MEMORY

Remote Access Functionality:

Yara detected Ursnif

Source: Yara match	File source: 00000003.00000003.881584954.00000000050E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.881638380.00000000050E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.881444184.00000000050E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.881614039.00000000050E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.881537844.00000000050E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.881689753.00000000050E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.881502007.00000000050E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.881360850.00000000050E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 6960, type: MEMORY