Loading ...

Play interactive tourEdit tour

Analysis Report QDfpQK7SOG.dll

Overview

General Information

Sample Name:QDfpQK7SOG.dll
Analysis ID:430230
MD5:320192b545d3f45fd588b741c30fb2ec
SHA1:807433d7c1f8c7629ebcafd9d2c4e6797c82ce16
SHA256:2ee0e0b21737b7f9ecc613be83b7ec84560d0770f794a819afe64f54b0e7743b
Tags:dllGoziISFBUrsnif
Infos:

Most interesting Screenshot:

Detection

Ursnif
Score:64
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected Ursnif
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Creates a DirectInput object (often for capturing keystrokes)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Found potential string decryption / allocating functions
PE file contains an invalid checksum
Program does not show much activity (idle)
Sample execution stops while process was sleeping (likely an evasion)
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • loaddll32.exe (PID: 6520 cmdline: loaddll32.exe 'C:\Users\user\Desktop\QDfpQK7SOG.dll' MD5: 542795ADF7CC08EFCF675D65310596E8)
    • cmd.exe (PID: 6560 cmdline: cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\QDfpQK7SOG.dll',#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • rundll32.exe (PID: 6588 cmdline: rundll32.exe 'C:\Users\user\Desktop\QDfpQK7SOG.dll',#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
        • cmd.exe (PID: 6632 cmdline: C:\Windows\system32\cmd.exe /c cd Island MD5: F3BDBE3BB6F734E357235F4D5898582D)
          • conhost.exe (PID: 6664 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
        • cmd.exe (PID: 6800 cmdline: C:\Windows\system32\cmd.exe /c cd Matter m MD5: F3BDBE3BB6F734E357235F4D5898582D)
          • conhost.exe (PID: 6808 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • rundll32.exe (PID: 6572 cmdline: rundll32.exe C:\Users\user\Desktop\QDfpQK7SOG.dll,Connectdark MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
      • cmd.exe (PID: 6616 cmdline: C:\Windows\system32\cmd.exe /c cd Island MD5: F3BDBE3BB6F734E357235F4D5898582D)
        • conhost.exe (PID: 6648 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • cmd.exe (PID: 6740 cmdline: C:\Windows\system32\cmd.exe /c cd Matter m MD5: F3BDBE3BB6F734E357235F4D5898582D)
        • conhost.exe (PID: 6788 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • rundll32.exe (PID: 6884 cmdline: rundll32.exe C:\Users\user\Desktop\QDfpQK7SOG.dll,Mindlake MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
      • cmd.exe (PID: 6900 cmdline: C:\Windows\system32\cmd.exe /c cd Island MD5: F3BDBE3BB6F734E357235F4D5898582D)
        • conhost.exe (PID: 6912 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • cmd.exe (PID: 6968 cmdline: C:\Windows\system32\cmd.exe /c cd Matter m MD5: F3BDBE3BB6F734E357235F4D5898582D)
        • conhost.exe (PID: 6976 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • rundll32.exe (PID: 6956 cmdline: rundll32.exe C:\Users\user\Desktop\QDfpQK7SOG.dll,Porthigh MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
      • cmd.exe (PID: 7008 cmdline: C:\Windows\system32\cmd.exe /c cd Island MD5: F3BDBE3BB6F734E357235F4D5898582D)
        • conhost.exe (PID: 7024 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • cmd.exe (PID: 7072 cmdline: C:\Windows\system32\cmd.exe /c cd Matter m MD5: F3BDBE3BB6F734E357235F4D5898582D)
        • conhost.exe (PID: 7124 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • rundll32.exe (PID: 7084 cmdline: rundll32.exe C:\Users\user\Desktop\QDfpQK7SOG.dll,Problemscale MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
      • cmd.exe (PID: 776 cmdline: C:\Windows\system32\cmd.exe /c cd Island MD5: F3BDBE3BB6F734E357235F4D5898582D)
        • conhost.exe (PID: 5700 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • cmd.exe (PID: 5632 cmdline: C:\Windows\system32\cmd.exe /c cd Matter m MD5: F3BDBE3BB6F734E357235F4D5898582D)
        • conhost.exe (PID: 5820 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • rundll32.exe (PID: 2332 cmdline: rundll32.exe C:\Users\user\Desktop\QDfpQK7SOG.dll,WingGrass MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
      • cmd.exe (PID: 3924 cmdline: C:\Windows\system32\cmd.exe /c cd Island MD5: F3BDBE3BB6F734E357235F4D5898582D)
        • conhost.exe (PID: 5644 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • cmd.exe (PID: 4148 cmdline: C:\Windows\system32\cmd.exe /c cd Matter m MD5: F3BDBE3BB6F734E357235F4D5898582D)
        • conhost.exe (PID: 1604 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 4568 cmdline: C:\Windows\system32\cmd.exe /c cd Island MD5: F3BDBE3BB6F734E357235F4D5898582D)
    • cmd.exe (PID: 6364 cmdline: C:\Windows\system32\cmd.exe /c cd Matter m MD5: F3BDBE3BB6F734E357235F4D5898582D)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

Initial Sample

SourceRuleDescriptionAuthorStrings
QDfpQK7SOG.dllJoeSecurity_Ursnif_2Yara detected UrsnifJoe Security

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    0000001A.00000002.664721905.000000006E1A1000.00000020.00020000.sdmpJoeSecurity_Ursnif_2Yara detected UrsnifJoe Security
      00000004.00000002.677279699.000000006E1A1000.00000020.00020000.sdmpJoeSecurity_Ursnif_2Yara detected UrsnifJoe Security
        00000012.00000002.686115705.000000006E1A1000.00000020.00020000.sdmpJoeSecurity_Ursnif_2Yara detected UrsnifJoe Security
          00000005.00000002.687931274.000000006E1A1000.00000020.00020000.sdmpJoeSecurity_Ursnif_2Yara detected UrsnifJoe Security
            00000018.00000002.696642986.000000006E1A1000.00000020.00020000.sdmpJoeSecurity_Ursnif_2Yara detected UrsnifJoe Security
              Click to see the 2 entries

              Unpacked PEs

              SourceRuleDescriptionAuthorStrings
              26.2.rundll32.exe.6e1a0000.1.unpackJoeSecurity_Ursnif_2Yara detected UrsnifJoe Security
                2.2.loaddll32.exe.6e1a0000.0.unpackJoeSecurity_Ursnif_2Yara detected UrsnifJoe Security
                  15.2.rundll32.exe.6e1a0000.1.unpackJoeSecurity_Ursnif_2Yara detected UrsnifJoe Security
                    24.2.rundll32.exe.6e1a0000.1.unpackJoeSecurity_Ursnif_2Yara detected UrsnifJoe Security
                      4.2.rundll32.exe.6e1a0000.1.unpackJoeSecurity_Ursnif_2Yara detected UrsnifJoe Security
                        Click to see the 2 entries

                        Sigma Overview

                        No Sigma rule has matched

                        Signature Overview

                        Click to jump to signature section

                        Show All Signature Results

                        AV Detection:

                        barindex
                        Antivirus / Scanner detection for submitted sampleShow sources
                        Source: QDfpQK7SOG.dllAvira: detected
                        Multi AV Scanner detection for submitted fileShow sources
                        Source: QDfpQK7SOG.dllVirustotal: Detection: 59%Perma Link
                        Source: QDfpQK7SOG.dllReversingLabs: Detection: 65%
                        Source: QDfpQK7SOG.dllStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
                        Source: QDfpQK7SOG.dllStatic PE information: DYNAMIC_BASE, NX_COMPAT
                        Source: Binary string: c:\938\follow-Record\Suffix\observe-element\force.pdb source: loaddll32.exe, 00000002.00000002.683594147.000000006E22A000.00000002.00020000.sdmp, rundll32.exe, 00000004.00000002.690126193.000000006E22A000.00000002.00020000.sdmp, rundll32.exe, 00000005.00000002.691931847.000000006E22A000.00000002.00020000.sdmp, rundll32.exe, 0000000F.00000002.697216102.000000006E22A000.00000002.00020000.sdmp, rundll32.exe, 00000012.00000002.686162523.000000006E22A000.00000002.00020000.sdmp, rundll32.exe, 00000018.00000002.696718223.000000006E22A000.00000002.00020000.sdmp, rundll32.exe, 0000001A.00000002.664832906.000000006E22A000.00000002.00020000.sdmp, QDfpQK7SOG.dll

                        Key, Mouse, Clipboard, Microphone and Screen Capturing:

                        barindex
                        Yara detected UrsnifShow sources
                        Source: Yara matchFile source: QDfpQK7SOG.dll, type: SAMPLE
                        Source: Yara matchFile source: 0000001A.00000002.664721905.000000006E1A1000.00000020.00020000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000004.00000002.677279699.000000006E1A1000.00000020.00020000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000012.00000002.686115705.000000006E1A1000.00000020.00020000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000005.00000002.687931274.000000006E1A1000.00000020.00020000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000018.00000002.696642986.000000006E1A1000.00000020.00020000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000F.00000002.690715845.000000006E1A1000.00000020.00020000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000002.00000002.675775659.000000006E1A1000.00000020.00020000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 26.2.rundll32.exe.6e1a0000.1.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 2.2.loaddll32.exe.6e1a0000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 15.2.rundll32.exe.6e1a0000.1.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 24.2.rundll32.exe.6e1a0000.1.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 4.2.rundll32.exe.6e1a0000.1.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 5.2.rundll32.exe.6e1a0000.1.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 18.2.rundll32.exe.6e1a0000.1.unpack, type: UNPACKEDPE
                        Source: loaddll32.exe, 00000002.00000002.675698694.00000000010FB000.00000004.00000020.sdmpBinary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

                        E-Banking Fraud:

                        barindex
                        Yara detected UrsnifShow sources
                        Source: Yara matchFile source: QDfpQK7SOG.dll, type: SAMPLE
                        Source: Yara matchFile source: 0000001A.00000002.664721905.000000006E1A1000.00000020.00020000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000004.00000002.677279699.000000006E1A1000.00000020.00020000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000012.00000002.686115705.000000006E1A1000.00000020.00020000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000005.00000002.687931274.000000006E1A1000.00000020.00020000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000018.00000002.696642986.000000006E1A1000.00000020.00020000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000F.00000002.690715845.000000006E1A1000.00000020.00020000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000002.00000002.675775659.000000006E1A1000.00000020.00020000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 26.2.rundll32.exe.6e1a0000.1.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 2.2.loaddll32.exe.6e1a0000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 15.2.rundll32.exe.6e1a0000.1.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 24.2.rundll32.exe.6e1a0000.1.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 4.2.rundll32.exe.6e1a0000.1.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 5.2.rundll32.exe.6e1a0000.1.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 18.2.rundll32.exe.6e1a0000.1.unpack, type: UNPACKEDPE
                        Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6E1E3E00
                        Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6E1E1C3C
                        Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6E2167D9
                        Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6E2084BB
                        Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6E2202BC
                        Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6E210396
                        Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6E1FE079
                        Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6E1F5150
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_6E1E3E00
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_6E2167D9
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_6E1E1C3C
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_6E2084BB
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_6E2202BC
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_6E210396
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_6E1FE079
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_6E1F5150
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 15_2_6E1E3E00
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 15_2_6E2167D9
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 15_2_6E1E1C3C
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 15_2_6E2084BB
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 15_2_6E2202BC
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 15_2_6E210396
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 15_2_6E1FE079
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 15_2_6E1F5150
                        Source: C:\Windows\System32\loaddll32.exeCode function: String function: 6E1E0990 appears 34 times
                        Source: C:\Windows\System32\loaddll32.exeCode function: String function: 6E1E00AC appears 100 times
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: String function: 6E1E0990 appears 57 times
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: String function: 6E1E00E0 appears 57 times
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: String function: 6E1E00AC appears 199 times
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: String function: 6E2023A9 appears 35 times
                        Source: QDfpQK7SOG.dllStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
                        Source: classification engineClassification label: mal64.troj.winDLL@55/0@0/0
                        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6648:120:WilError_01
                        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5644:120:WilError_01
                        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6664:120:WilError_01
                        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6976:120:WilError_01
                        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7124:120:WilError_01
                        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5820:120:WilError_01
                        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6912:120:WilError_01
                        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6788:120:WilError_01
                        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6808:120:WilError_01
                        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5700:120:WilError_01
                        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7024:120:WilError_01
                        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1604:120:WilError_01
                        Source: QDfpQK7SOG.dllStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                        Source: C:\Windows\System32\loaddll32.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
                        Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\QDfpQK7SOG.dll,Connectdark
                        Source: QDfpQK7SOG.dllVirustotal: Detection: 59%
                        Source: QDfpQK7SOG.dllReversingLabs: Detection: 65%
                        Source: unknownProcess created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\QDfpQK7SOG.dll'
                        Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\QDfpQK7SOG.dll',#1
                        Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\QDfpQK7SOG.dll,Connectdark
                        Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\QDfpQK7SOG.dll',#1
                        Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Island
                        Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Island
                        Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Matter m
                        Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Matter m
                        Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\QDfpQK7SOG.dll,Mindlake
                        Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Island
                        Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\QDfpQK7SOG.dll,Porthigh
                        Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Matter m
                        Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Island
                        Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Matter m
                        Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\QDfpQK7SOG.dll,Problemscale
                        Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\QDfpQK7SOG.dll,WingGrass
                        Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Island
                        Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Island
                        Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Matter m
                        Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Island
                        Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Matter m
                        Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Matter m
                        Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\QDfpQK7SOG.dll',#1
                        Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\QDfpQK7SOG.dll,Connectdark
                        Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\QDfpQK7SOG.dll,Mindlake
                        Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\QDfpQK7SOG.dll,Porthigh
                        Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\QDfpQK7SOG.dll,Problemscale
                        Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\QDfpQK7SOG.dll,WingGrass
                        Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Island
                        Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Matter m
                        Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\QDfpQK7SOG.dll',#1
                        Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Island
                        Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Matter m
                        Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Island
                        Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Matter m
                        Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Island
                        Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Matter m
                        Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Island
                        Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Matter m
                        Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Island
                        Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Matter m
                        Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Island
                        Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Matter m
                        Source: Window RecorderWindow detected: More than 3 window changes detected
                        Source: QDfpQK7SOG.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
                        Source: QDfpQK7SOG.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
                        Source: QDfpQK7SOG.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
                        Source: QDfpQK7SOG.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                        Source: QDfpQK7SOG.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
                        Source: QDfpQK7SOG.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
                        Source: QDfpQK7SOG.dllStatic PE information: DYNAMIC_BASE, NX_COMPAT
                        Source: QDfpQK7SOG.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                        Source: Binary string: c:\938\follow-Record\Suffix\observe-element\force.pdb source: loaddll32.exe, 00000002.00000002.683594147.000000006E22A000.00000002.00020000.sdmp, rundll32.exe, 00000004.00000002.690126193.000000006E22A000.00000002.00020000.sdmp, rundll32.exe, 00000005.00000002.691931847.000000006E22A000.00000002.00020000.sdmp, rundll32.exe, 0000000F.00000002.697216102.000000006E22A000.00000002.00020000.sdmp, rundll32.exe, 00000012.00000002.686162523.000000006E22A000.00000002.00020000.sdmp, rundll32.exe, 00000018.00000002.696718223.000000006E22A000.00000002.00020000.sdmp, rundll32.exe, 0000001A.00000002.664832906.000000006E22A000.00000002.00020000.sdmp, QDfpQK7SOG.dll
                        Source: QDfpQK7SOG.dllStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
                        Source: QDfpQK7SOG.dllStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
                        Source: QDfpQK7SOG.dllStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
                        Source: QDfpQK7SOG.dllStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
                        Source: QDfpQK7SOG.dllStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
                        Source: QDfpQK7SOG.dllStatic PE information: real checksum: 0xf3990 should be: 0xf1211
                        Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6E1E09D6 push ecx; ret
                        Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6E1E0075 push ecx; ret
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_6E1E0075 push ecx; ret
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_6E1E09D6 push ecx; ret
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 15_2_6E1E0075 push ecx; ret
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 15_2_6E1E09D6 push ecx; ret

                        Hooking and other Techniques for Hiding and Protection:

                        barindex
                        Yara detected UrsnifShow sources
                        Source: Yara matchFile source: QDfpQK7SOG.dll, type: SAMPLE
                        Source: Yara matchFile source: 0000001A.00000002.664721905.000000006E1A1000.00000020.00020000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000004.00000002.677279699.000000006E1A1000.00000020.00020000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000012.00000002.686115705.000000006E1A1000.00000020.00020000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000005.00000002.687931274.000000006E1A1000.00000020.00020000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000018.00000002.696642986.000000006E1A1000.00000020.00020000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000F.00000002.690715845.000000006E1A1000.00000020.00020000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000002.00000002.675775659.000000006E1A1000.00000020.00020000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 26.2.rundll32.exe.6e1a0000.1.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 2.2.loaddll32.exe.6e1a0000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 15.2.rundll32.exe.6e1a0000.1.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 24.2.rundll32.exe.6e1a0000.1.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 4.2.rundll32.exe.6e1a0000.1.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 5.2.rundll32.exe.6e1a0000.1.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 18.2.rundll32.exe.6e1a0000.1.unpack, type: UNPACKEDPE
                        Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
                        Source: C:\Windows\SysWOW64\rundll32.exeLast function: Thread delayed
                        Source: C:\Windows\SysWOW64\rundll32.exeLast function: Thread delayed
                        Source: C:\Windows\SysWOW64\rundll32.exeLast function: Thread delayed
                        Source: C:\Windows\SysWOW64\rundll32.exeLast function: Thread delayed
                        Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                        Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                        Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                        Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6E201F6D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
                        Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6E20966F mov eax, dword ptr fs:[00000030h]
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_6E20966F mov eax, dword ptr fs:[00000030h]
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 15_2_6E20966F mov eax, dword ptr fs:[00000030h]
                        Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
                        Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6E201F6D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
                        Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6E1E07A7 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
                        Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6E1E0288 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_6E201F6D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_6E1E07A7 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_6E1E0288 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 15_2_6E201F6D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 15_2_6E1E07A7 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 15_2_6E1E0288 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,
                        Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Island
                        Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Matter m
                        Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\QDfpQK7SOG.dll',#1
                        Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Island
                        Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Matter m
                        Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Island
                        Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Matter m
                        Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Island
                        Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Matter m
                        Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Island
                        Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Matter m
                        Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Island
                        Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Matter m
                        Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Island
                        Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Matter m
                        Source: loaddll32.exe, 00000002.00000002.675721619.0000000001580000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.664452445.0000000003200000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.687883244.0000000002F50000.00000002.00000001.sdmp, rundll32.exe, 0000000F.00000002.683862618.0000000003230000.00000002.00000001.sdmp, rundll32.exe, 00000012.00000002.684399021.00000000031E0000.00000002.00000001.sdmp, rundll32.exe, 00000018.00000002.696572906.00000000033A0000.00000002.00000001.sdmp, rundll32.exe, 0000001A.00000002.664660133.00000000030E0000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
                        Source: loaddll32.exe, 00000002.00000002.675721619.0000000001580000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.664452445.0000000003200000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.687883244.0000000002F50000.00000002.00000001.sdmp, rundll32.exe, 0000000F.00000002.683862618.0000000003230000.00000002.00000001.sdmp, rundll32.exe, 00000012.00000002.684399021.00000000031E0000.00000002.00000001.sdmp, rundll32.exe, 00000018.00000002.696572906.00000000033A0000.00000002.00000001.sdmp, rundll32.exe, 0000001A.00000002.664660133.00000000030E0000.00000002.00000001.sdmpBinary or memory string: Progman
                        Source: loaddll32.exe, 00000002.00000002.675721619.0000000001580000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.664452445.0000000003200000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.687883244.0000000002F50000.00000002.00000001.sdmp, rundll32.exe, 0000000F.00000002.683862618.0000000003230000.00000002.00000001.sdmp, rundll32.exe, 00000012.00000002.684399021.00000000031E0000.00000002.00000001.sdmp, rundll32.exe, 00000018.00000002.696572906.00000000033A0000.00000002.00000001.sdmp, rundll32.exe, 0000001A.00000002.664660133.00000000030E0000.00000002.00000001.sdmpBinary or memory string: &Program Manager
                        Source: loaddll32.exe, 00000002.00000002.675721619.0000000001580000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.664452445.0000000003200000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.687883244.0000000002F50000.00000002.00000001.sdmp, rundll32.exe, 0000000F.00000002.683862618.0000000003230000.00000002.00000001.sdmp, rundll32.exe, 00000012.00000002.684399021.00000000031E0000.00000002.00000001.sdmp, rundll32.exe, 00000018.00000002.696572906.00000000033A0000.00000002.00000001.sdmp, rundll32.exe, 0000001A.00000002.664660133.00000000030E0000.00000002.00000001.sdmpBinary or memory string: Progmanlock
                        Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6E1E0604 cpuid
                        Source: C:\Windows\System32\loaddll32.exeCode function: GetLocaleInfoW,
                        Source: C:\Windows\System32\loaddll32.exeCode function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,
                        Source: C:\Windows\System32\loaddll32.exeCode function: EnumSystemLocalesW,
                        Source: C:\Windows\System32\loaddll32.exeCode function: GetLocaleInfoW,
                        Source: C:\Windows\System32\loaddll32.exeCode function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,
                        Source: C:\Windows\System32\loaddll32.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,
                        Source: C:\Windows\System32\loaddll32.exeCode function: GetLocaleInfoW,
                        Source: C:\Windows\System32\loaddll32.exeCode function: ___crtGetLocaleInfoEx,
                        Source: C:\Windows\System32\loaddll32.exeCode function: GetLocaleInfoW,
                        Source: C:\Windows\System32\loaddll32.exeCode function: EnumSystemLocalesW,
                        Source: C:\Windows\System32\loaddll32.exeCode function: EnumSystemLocalesW,
                        Source: C:\Windows\System32\loaddll32.exeCode function: EnumSystemLocalesW,
                        Source: C:\Windows\System32\loaddll32.exeCode function: GetLocaleInfoW,
                        Source: C:\Windows\System32\loaddll32.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: GetLocaleInfoW,
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: GetLocaleInfoW,
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: GetLocaleInfoW,
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: ___crtGetLocaleInfoEx,
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: GetLocaleInfoW,
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: EnumSystemLocalesW,
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: EnumSystemLocalesW,
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: EnumSystemLocalesW,
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: EnumSystemLocalesW,
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: GetLocaleInfoW,
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: GetLocaleInfoW,
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: GetLocaleInfoW,
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: GetLocaleInfoW,
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: ___crtGetLocaleInfoEx,
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: GetLocaleInfoW,
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: EnumSystemLocalesW,
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: EnumSystemLocalesW,
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: EnumSystemLocalesW,
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: EnumSystemLocalesW,
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: GetLocaleInfoW,
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,
                        Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6E1C9A14 GetSystemTimeAsFileTime,
                        Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6E218951 _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

                        Stealing of Sensitive Information:

                        barindex
                        Yara detected UrsnifShow sources
                        Source: Yara matchFile source: QDfpQK7SOG.dll, type: SAMPLE
                        Source: Yara matchFile source: 0000001A.00000002.664721905.000000006E1A1000.00000020.00020000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000004.00000002.677279699.000000006E1A1000.00000020.00020000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000012.00000002.686115705.000000006E1A1000.00000020.00020000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000005.00000002.687931274.000000006E1A1000.00000020.00020000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000018.00000002.696642986.000000006E1A1000.00000020.00020000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000F.00000002.690715845.000000006E1A1000.00000020.00020000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000002.00000002.675775659.000000006E1A1000.00000020.00020000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 26.2.rundll32.exe.6e1a0000.1.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 2.2.loaddll32.exe.6e1a0000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 15.2.rundll32.exe.6e1a0000.1.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 24.2.rundll32.exe.6e1a0000.1.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 4.2.rundll32.exe.6e1a0000.1.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 5.2.rundll32.exe.6e1a0000.1.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 18.2.rundll32.exe.6e1a0000.1.unpack, type: UNPACKEDPE

                        Remote Access Functionality:

                        barindex
                        Yara detected UrsnifShow sources
                        Source: Yara matchFile source: QDfpQK7SOG.dll, type: SAMPLE
                        Source: Yara matchFile source: 0000001A.00000002.664721905.000000006E1A1000.00000020.00020000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000004.00000002.677279699.000000006E1A1000.00000020.00020000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000012.00000002.686115705.000000006E1A1000.00000020.00020000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000005.00000002.687931274.000000006E1A1000.00000020.00020000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000018.00000002.696642986.000000006E1A1000.00000020.00020000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000F.00000002.690715845.000000006E1A1000.00000020.00020000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000002.00000002.675775659.000000006E1A1000.00000020.00020000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 26.2.rundll32.exe.6e1a0000.1.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 2.2.loaddll32.exe.6e1a0000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 15.2.rundll32.exe.6e1a0000.1.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 24.2.rundll32.exe.6e1a0000.1.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 4.2.rundll32.exe.6e1a0000.1.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 5.2.rundll32.exe.6e1a0000.1.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 18.2.rundll32.exe.6e1a0000.1.unpack, type: UNPACKEDPE
                        Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6E1A16BC __ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ,
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_6E1A16BC __ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ,
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 15_2_6E1A16BC __ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ,

                        Mitre Att&ck Matrix

                        Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
                        Valid AccountsWindows Management InstrumentationPath InterceptionProcess Injection12Rundll321Input Capture1System Time Discovery2Remote ServicesInput Capture1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
                        Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsProcess Injection12LSASS MemorySecurity Software Discovery1Remote Desktop ProtocolArchive Collected Data1Exfiltration Over BluetoothJunk DataExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
                        Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Deobfuscate/Decode Files or Information1Security Account ManagerProcess Discovery1SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
                        Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Obfuscated Files or Information2NTDSSystem Information Discovery22Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud

                        Behavior Graph

                        Hide Legend

                        Legend:

                        • Process
                        • Signature
                        • Created File
                        • DNS/IP Info
                        • Is Dropped
                        • Is Windows Process
                        • Number of created Registry Values
                        • Number of created Files
                        • Visual Basic
                        • Delphi
                        • Java
                        • .Net C# or VB.NET
                        • C, C++ or other language
                        • Is malicious
                        • Internet
                        behaviorgraph top1 signatures2 2 Behavior Graph ID: 430230 Sample: QDfpQK7SOG.dll Startdate: 07/06/2021 Architecture: WINDOWS Score: 64 59 Antivirus / Scanner detection for submitted sample 2->59 61 Multi AV Scanner detection for submitted file 2->61 63 Yara detected  Ursnif 2->63 9 loaddll32.exe 1 2->9         started        process3 process4 11 cmd.exe 1 9->11         started        13 rundll32.exe 9->13         started        15 rundll32.exe 9->15         started        17 5 other processes 9->17 process5 19 rundll32.exe 11->19         started        21 cmd.exe 1 13->21         started        23 cmd.exe 1 13->23         started        25 cmd.exe 1 15->25         started        27 cmd.exe 1 15->27         started        29 cmd.exe 1 17->29         started        31 cmd.exe 1 17->31         started        33 cmd.exe 1 17->33         started        35 3 other processes 17->35 process6 51 2 other processes 19->51 37 conhost.exe 21->37         started        39 conhost.exe 23->39         started        41 conhost.exe 25->41         started        43 conhost.exe 27->43         started        45 conhost.exe 29->45         started        47 conhost.exe 31->47         started        49 conhost.exe 33->49         started        53 3 other processes 35->53 process7 55 conhost.exe 51->55         started        57 conhost.exe 51->57         started       

                        Screenshots

                        Thumbnails

                        This section contains all screenshots as thumbnails, including those not shown in the slideshow.

                        windows-stand

                        Antivirus, Machine Learning and Genetic Malware Detection

                        Initial Sample

                        SourceDetectionScannerLabelLink
                        QDfpQK7SOG.dll60%VirustotalBrowse
                        QDfpQK7SOG.dll66%ReversingLabsWin32.Trojan.Zusy
                        QDfpQK7SOG.dll100%AviraTR/Spy.Ursnif.ozghq

                        Dropped Files

                        No Antivirus matches

                        Unpacked PE Files

                        SourceDetectionScannerLabelLinkDownload
                        5.2.rundll32.exe.6e1a0000.1.unpack100%AviraHEUR/AGEN.1142290Download File
                        26.2.rundll32.exe.6e1a0000.1.unpack100%AviraHEUR/AGEN.1142290Download File
                        15.2.rundll32.exe.6e1a0000.1.unpack100%AviraHEUR/AGEN.1142290Download File
                        2.2.loaddll32.exe.6e1a0000.0.unpack100%AviraHEUR/AGEN.1142290Download File
                        18.2.rundll32.exe.6e1a0000.1.unpack100%AviraHEUR/AGEN.1142290Download File
                        24.2.rundll32.exe.6e1a0000.1.unpack100%AviraHEUR/AGEN.1142290Download File
                        4.2.rundll32.exe.6e1a0000.1.unpack100%AviraHEUR/AGEN.1142290Download File

                        Domains

                        No Antivirus matches

                        URLs

                        No Antivirus matches

                        Domains and IPs

                        Contacted Domains

                        No contacted domains info

                        Contacted IPs

                        No contacted IP infos

                        General Information

                        Joe Sandbox Version:32.0.0 Black Diamond
                        Analysis ID:430230
                        Start date:07.06.2021
                        Start time:08:44:42
                        Joe Sandbox Product:CloudBasic
                        Overall analysis duration:0h 10m 47s
                        Hypervisor based Inspection enabled:false
                        Report type:light
                        Sample file name:QDfpQK7SOG.dll
                        Cookbook file name:default.jbs
                        Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                        Number of analysed new started processes analysed:42
                        Number of new started drivers analysed:0
                        Number of existing processes analysed:0
                        Number of existing drivers analysed:0
                        Number of injected processes analysed:0
                        Technologies:
                        • HCA enabled
                        • EGA enabled
                        • HDC enabled
                        • AMSI enabled
                        Analysis Mode:default
                        Analysis stop reason:Timeout
                        Detection:MAL
                        Classification:mal64.troj.winDLL@55/0@0/0
                        EGA Information:Failed
                        HDC Information:
                        • Successful, ratio: 15.2% (good quality ratio 14.2%)
                        • Quality average: 68.9%
                        • Quality standard deviation: 26.7%
                        HCA Information:Failed
                        Cookbook Comments:
                        • Adjust boot time
                        • Enable AMSI
                        • Found application associated with file extension: .dll
                        Warnings:
                        Show All
                        • Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
                        • Not all processes where analyzed, report is missing behavior information
                        • Report size exceeded maximum capacity and may have missing behavior information.

                        Simulations

                        Behavior and APIs

                        No simulations

                        Joe Sandbox View / Context

                        IPs

                        No context

                        Domains

                        No context

                        ASN

                        No context

                        JA3 Fingerprints

                        No context

                        Dropped Files

                        No context

                        Created / dropped Files

                        No created / dropped files found

                        Static File Info

                        General

                        File type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                        Entropy (8bit):6.790050906790882
                        TrID:
                        • Win32 Dynamic Link Library (generic) (1002004/3) 99.60%
                        • Generic Win/DOS Executable (2004/3) 0.20%
                        • DOS Executable Generic (2002/1) 0.20%
                        • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                        File name:QDfpQK7SOG.dll
                        File size:960000
                        MD5:320192b545d3f45fd588b741c30fb2ec
                        SHA1:807433d7c1f8c7629ebcafd9d2c4e6797c82ce16
                        SHA256:2ee0e0b21737b7f9ecc613be83b7ec84560d0770f794a819afe64f54b0e7743b
                        SHA512:c95b2c2d1f7cdf5950db9bd655965cbacf3b8d383728db3786de404e68f70bec761dc6101ebbf6b0fc0252ec8626a8c5247cce4e5f378c6a63da648364b158c9
                        SSDEEP:24576:HQfpzjXPgfh8CJV4X+IBIJ3cazaLwj1mCG9CpNiLi:IFDgVJV4OaIRj150CpNiLi
                        File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......t...0...0...0....{i.3...9...#...b...4...b...=...b...=....{r.&...0.......b.......b...1...b.b.1...0...1...b...1...Rich0..........

                        File Icon

                        Icon Hash:74f0e4ecccdce0e4

                        Static PE Info

                        General

                        Entrypoint:0x1040052
                        Entrypoint Section:.text
                        Digitally signed:false
                        Imagebase:0x1000000
                        Subsystem:windows gui
                        Image File Characteristics:32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
                        DLL Characteristics:DYNAMIC_BASE, NX_COMPAT
                        Time Stamp:0x5AC512FB [Wed Apr 4 18:01:31 2018 UTC]
                        TLS Callbacks:
                        CLR (.Net) Version:
                        OS Version Major:6
                        OS Version Minor:0
                        File Version Major:6
                        File Version Minor:0
                        Subsystem Version Major:6
                        Subsystem Version Minor:0
                        Import Hash:7a79d10b1d4343a18a4f6e25e165b4ae

                        Entrypoint Preview

                        Instruction
                        push ebp
                        mov ebp, esp
                        cmp dword ptr [ebp+0Ch], 01h
                        jne 00007FE81898C597h
                        call 00007FE81898CF72h
                        push dword ptr [ebp+10h]
                        push dword ptr [ebp+0Ch]
                        push dword ptr [ebp+08h]
                        call 00007FE81898C43Fh
                        add esp, 0Ch
                        pop ebp
                        retn 000Ch
                        mov ecx, dword ptr [ebp-0Ch]
                        mov dword ptr fs:[00000000h], ecx
                        pop ecx
                        pop edi
                        pop edi
                        pop esi
                        pop ebx
                        mov esp, ebp
                        pop ebp
                        push ecx
                        ret
                        mov ecx, dword ptr [ebp-10h]
                        xor ecx, ebp
                        call 00007FE81898BDA6h
                        jmp 00007FE81898C570h
                        mov ecx, dword ptr [ebp-14h]
                        xor ecx, ebp
                        call 00007FE81898BD95h
                        jmp 00007FE81898C55Fh
                        push eax
                        push dword ptr fs:[00000000h]
                        lea eax, dword ptr [esp+0Ch]
                        sub esp, dword ptr [esp+0Ch]
                        push ebx
                        push esi
                        push edi
                        mov dword ptr [eax], ebp
                        mov ebp, eax
                        mov eax, dword ptr [010E506Ch]
                        xor eax, ebp
                        push eax
                        push dword ptr [ebp-04h]
                        mov dword ptr [ebp-04h], FFFFFFFFh
                        lea eax, dword ptr [ebp-0Ch]
                        mov dword ptr fs:[00000000h], eax
                        ret
                        push eax
                        push dword ptr fs:[00000000h]
                        lea eax, dword ptr [esp+0Ch]
                        sub esp, dword ptr [esp+0Ch]
                        push ebx
                        push esi
                        push edi
                        mov dword ptr [eax], ebp
                        mov ebp, eax
                        mov eax, dword ptr [010E506Ch]
                        xor eax, ebp
                        push eax
                        mov dword ptr [ebp-10h], eax
                        push dword ptr [ebp-04h]
                        mov dword ptr [ebp-04h], FFFFFFFFh
                        lea eax, dword ptr [ebp-0Ch]
                        mov dword ptr fs:[00000000h], eax
                        ret
                        push eax
                        inc dword ptr fs:[eax]

                        Rich Headers

                        Programming Language:
                        • [IMP] VS2008 SP1 build 30729

                        Data Directories

                        NameVirtual AddressVirtual Size Is in Section
                        IMAGE_DIRECTORY_ENTRY_EXPORT0xe35b00x9c.rdata
                        IMAGE_DIRECTORY_ENTRY_IMPORT0xe364c0x8c.rdata
                        IMAGE_DIRECTORY_ENTRY_RESOURCE0xfd0000x9d0.rsrc
                        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                        IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                        IMAGE_DIRECTORY_ENTRY_BASERELOC0xfe0000x5074.reloc
                        IMAGE_DIRECTORY_ENTRY_DEBUG0xde8200x54.rdata
                        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                        IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0xde8780x40.rdata
                        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                        IMAGE_DIRECTORY_ENTRY_IAT0x8a0000x26c.rdata
                        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                        Sections

                        NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                        .text0x10000x883dc0x88400False0.544624426606data6.71832454464IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                        .rdata0x8a0000x5a4400x5a600False0.658643456086data5.95813601066IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                        .data0xe50000x17ebc0x1c00False0.184291294643data4.04646123564IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
                        .rsrc0xfd0000x9d00xa00False0.396484375data3.77819611332IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                        .reloc0xfe0000x50740x5200False0.726133765244data6.63977268899IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                        Resources

                        NameRVASizeTypeLanguageCountry
                        RT_DIALOG0xfd1c00x10edataEnglishUnited States
                        RT_DIALOG0xfd2d00xc0dBase III DBT, next free block index 4294901761EnglishUnited States
                        RT_DIALOG0xfd3900x126dataEnglishUnited States
                        RT_DIALOG0xfd4b80xf0dataEnglishUnited States
                        RT_DIALOG0xfd5a80xbadataEnglishUnited States
                        RT_DIALOG0xfd6640xecdataEnglishUnited States
                        RT_DIALOG0xfd7500x124dataEnglishUnited States
                        RT_MANIFEST0xfd8740x15aASCII text, with CRLF line terminatorsEnglishUnited States

                        Imports

                        DLLImport
                        KERNEL32.dllSetEnvironmentVariableA, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, GetProcessHeap, CreateFileW, SetStdHandle, ReadConsoleW, WriteConsoleW, HeapSize, SetEndOfFile, SetEnvironmentVariableW, GetOEMCP, IsValidCodePage, FindNextFileW, FindNextFileA, FindFirstFileExW, FindFirstFileExA, FindClose, GetTimeZoneInformation, OutputDebugStringA, OutputDebugStringW, WaitForSingleObjectEx, CreateSemaphoreA, GetSystemTimeAsFileTime, TlsGetValue, VirtualProtectEx, TlsAlloc, GetSystemDirectoryA, GetTempPathA, Sleep, GetCommandLineA, GetModuleHandleA, InitializeCriticalSection, SetSystemPowerState, EnterCriticalSection, VirtualProtect, GetModuleFileNameA, MultiByteToWideChar, GetLastError, FormatMessageW, WideCharToMultiByte, GetStringTypeW, LeaveCriticalSection, DeleteCriticalSection, SetLastError, InitializeCriticalSectionAndSpinCount, CreateEventW, SwitchToThread, TlsSetValue, TlsFree, GetTickCount, GetModuleHandleW, GetProcAddress, EncodePointer, DecodePointer, CompareStringW, LCMapStringW, GetLocaleInfoW, GetCPInfo, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, IsDebuggerPresent, GetStartupInfoW, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, InitializeSListHead, RtlUnwind, RaiseException, InterlockedPushEntrySList, InterlockedFlushSList, FreeLibrary, LoadLibraryExW, ExitProcess, GetModuleHandleExW, GetModuleFileNameW, HeapAlloc, HeapFree, GetCurrentThread, GetACP, GetStdHandle, GetFileType, CloseHandle, WaitForSingleObject, GetExitCodeProcess, CreateProcessA, CreateProcessW, GetFileAttributesExW, WriteFile, GetConsoleCP, GetConsoleMode, GetDateFormatW, GetTimeFormatW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, FlushFileBuffers, ReadFile, SetFilePointerEx, HeapReAlloc, SetConsoleCtrlHandler, CreateThread
                        USER32.dllSetFocus, GetCursorPos, RegisterClassExA, GetFocus, GetClassInfoExA, GetKeyNameTextA, GetWindowTextLengthA, CallWindowProcA, IsDlgButtonChecked, DestroyIcon, AppendMenuA, DrawIconEx, DrawEdge
                        GDI32.dllBitBlt, DeleteDC, CreatePen, DeleteObject, CreateDCA, GetObjectA, DPtoLP
                        ole32.dllOleUninitialize, OleSetContainedObject, OleInitialize
                        SHLWAPI.dllPathFindFileNameA, PathAddBackslashW, PathStripToRootA
                        DCIMAN32.dllDCICreatePrimary, DCIOpenProvider, GetDCRegionData, DCISetDestination, DCICloseProvider, DCICreateOverlay, GetWindowRegionData, DCIEndAccess, WinWatchDidStatusChange, DCICreateOffscreen, DCISetSrcDestClip, DCIDestroy, DCIDraw, DCISetClipList, DCIEnum, DCIBeginAccess, WinWatchClose

                        Exports

                        NameOrdinalAddress
                        Connectdark10x1021c64
                        Mindlake20x1020de0
                        Porthigh30x1021c2c
                        Problemscale40x1021bf8
                        WingGrass50x1021b0a

                        Possible Origin

                        Language of compilation systemCountry where language is spokenMap
                        EnglishUnited States

                        Network Behavior

                        No network behavior found

                        Code Manipulations

                        Statistics

                        Behavior

                        Click to jump to process

                        System Behavior

                        General

                        Start time:08:45:33
                        Start date:07/06/2021
                        Path:C:\Windows\System32\loaddll32.exe
                        Wow64 process (32bit):true
                        Commandline:loaddll32.exe 'C:\Users\user\Desktop\QDfpQK7SOG.dll'
                        Imagebase:0x100000
                        File size:116736 bytes
                        MD5 hash:542795ADF7CC08EFCF675D65310596E8
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Yara matches:
                        • Rule: JoeSecurity_Ursnif_2, Description: Yara detected Ursnif, Source: 00000002.00000002.675775659.000000006E1A1000.00000020.00020000.sdmp, Author: Joe Security
                        Reputation:high

                        General

                        Start time:08:45:33
                        Start date:07/06/2021
                        Path:C:\Windows\SysWOW64\cmd.exe
                        Wow64 process (32bit):true
                        Commandline:cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\QDfpQK7SOG.dll',#1
                        Imagebase:0x2a0000
                        File size:232960 bytes
                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Reputation:high

                        General

                        Start time:08:45:33
                        Start date:07/06/2021
                        Path:C:\Windows\SysWOW64\rundll32.exe
                        Wow64 process (32bit):true
                        Commandline:rundll32.exe C:\Users\user\Desktop\QDfpQK7SOG.dll,Connectdark
                        Imagebase:0xd30000
                        File size:61952 bytes
                        MD5 hash:D7CA562B0DB4F4DD0F03A89A1FDAD63D
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Yara matches:
                        • Rule: JoeSecurity_Ursnif_2, Description: Yara detected Ursnif, Source: 00000004.00000002.677279699.000000006E1A1000.00000020.00020000.sdmp, Author: Joe Security
                        Reputation:high

                        General

                        Start time:08:45:34
                        Start date:07/06/2021
                        Path:C:\Windows\SysWOW64\rundll32.exe
                        Wow64 process (32bit):true
                        Commandline:rundll32.exe 'C:\Users\user\Desktop\QDfpQK7SOG.dll',#1
                        Imagebase:0xd30000
                        File size:61952 bytes
                        MD5 hash:D7CA562B0DB4F4DD0F03A89A1FDAD63D
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Yara matches:
                        • Rule: JoeSecurity_Ursnif_2, Description: Yara detected Ursnif, Source: 00000005.00000002.687931274.000000006E1A1000.00000020.00020000.sdmp, Author: Joe Security
                        Reputation:high

                        General

                        Start time:08:45:34
                        Start date:07/06/2021
                        Path:C:\Windows\SysWOW64\cmd.exe
                        Wow64 process (32bit):true
                        Commandline:C:\Windows\system32\cmd.exe /c cd Island
                        Imagebase:0x2a0000
                        File size:232960 bytes
                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Reputation:high

                        General

                        Start time:08:45:34
                        Start date:07/06/2021
                        Path:C:\Windows\SysWOW64\cmd.exe
                        Wow64 process (32bit):true
                        Commandline:C:\Windows\system32\cmd.exe /c cd Island
                        Imagebase:0x2a0000
                        File size:232960 bytes
                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Reputation:high

                        General

                        Start time:08:45:35
                        Start date:07/06/2021
                        Path:C:\Windows\System32\conhost.exe
                        Wow64 process (32bit):false
                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Imagebase:0x7ff61de10000
                        File size:625664 bytes
                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Reputation:high

                        General

                        Start time:08:45:35
                        Start date:07/06/2021
                        Path:C:\Windows\System32\conhost.exe
                        Wow64 process (32bit):false
                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Imagebase:0x7ff61de10000
                        File size:625664 bytes
                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Reputation:high

                        General

                        Start time:08:45:35
                        Start date:07/06/2021
                        Path:C:\Windows\SysWOW64\cmd.exe
                        Wow64 process (32bit):true
                        Commandline:C:\Windows\system32\cmd.exe /c cd Matter m
                        Imagebase:0x2a0000
                        File size:232960 bytes
                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Reputation:high

                        General

                        Start time:08:45:36
                        Start date:07/06/2021
                        Path:C:\Windows\System32\conhost.exe
                        Wow64 process (32bit):false
                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Imagebase:0x7ff61de10000
                        File size:625664 bytes
                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Reputation:high

                        General

                        Start time:08:45:36
                        Start date:07/06/2021
                        Path:C:\Windows\SysWOW64\cmd.exe
                        Wow64 process (32bit):true
                        Commandline:C:\Windows\system32\cmd.exe /c cd Matter m
                        Imagebase:0x2a0000
                        File size:232960 bytes
                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Reputation:high

                        General

                        Start time:08:45:36
                        Start date:07/06/2021
                        Path:C:\Windows\System32\conhost.exe
                        Wow64 process (32bit):false
                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Imagebase:0x7ff61de10000
                        File size:625664 bytes
                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Reputation:high

                        General

                        Start time:08:45:37
                        Start date:07/06/2021
                        Path:C:\Windows\SysWOW64\rundll32.exe
                        Wow64 process (32bit):true
                        Commandline:rundll32.exe C:\Users\user\Desktop\QDfpQK7SOG.dll,Mindlake
                        Imagebase:0xd30000
                        File size:61952 bytes
                        MD5 hash:D7CA562B0DB4F4DD0F03A89A1FDAD63D
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Yara matches:
                        • Rule: JoeSecurity_Ursnif_2, Description: Yara detected Ursnif, Source: 0000000F.00000002.690715845.000000006E1A1000.00000020.00020000.sdmp, Author: Joe Security

                        General

                        Start time:08:45:38
                        Start date:07/06/2021
                        Path:C:\Windows\SysWOW64\cmd.exe
                        Wow64 process (32bit):true
                        Commandline:C:\Windows\system32\cmd.exe /c cd Island
                        Imagebase:0x2a0000
                        File size:232960 bytes
                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language

                        General

                        Start time:08:45:39
                        Start date:07/06/2021
                        Path:C:\Windows\System32\conhost.exe
                        Wow64 process (32bit):false
                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Imagebase:0x7ff61de10000
                        File size:625664 bytes
                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language

                        General

                        Start time:08:45:41
                        Start date:07/06/2021
                        Path:C:\Windows\SysWOW64\rundll32.exe
                        Wow64 process (32bit):true
                        Commandline:rundll32.exe C:\Users\user\Desktop\QDfpQK7SOG.dll,Porthigh
                        Imagebase:0xd30000
                        File size:61952 bytes
                        MD5 hash:D7CA562B0DB4F4DD0F03A89A1FDAD63D
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Yara matches:
                        • Rule: JoeSecurity_Ursnif_2, Description: Yara detected Ursnif, Source: 00000012.00000002.686115705.000000006E1A1000.00000020.00020000.sdmp, Author: Joe Security

                        General

                        Start time:08:45:41
                        Start date:07/06/2021
                        Path:C:\Windows\SysWOW64\cmd.exe
                        Wow64 process (32bit):true
                        Commandline:C:\Windows\system32\cmd.exe /c cd Matter m
                        Imagebase:0x2a0000
                        File size:232960 bytes
                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language

                        General

                        Start time:08:45:43
                        Start date:07/06/2021
                        Path:C:\Windows\System32\conhost.exe
                        Wow64 process (32bit):false
                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Imagebase:0x7ff61de10000
                        File size:625664 bytes
                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language

                        General

                        Start time:08:45:43
                        Start date:07/06/2021
                        Path:C:\Windows\SysWOW64\cmd.exe
                        Wow64 process (32bit):true
                        Commandline:C:\Windows\system32\cmd.exe /c cd Island
                        Imagebase:0x2a0000
                        File size:232960 bytes
                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language

                        General

                        Start time:08:45:44
                        Start date:07/06/2021
                        Path:C:\Windows\System32\conhost.exe
                        Wow64 process (32bit):false
                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Imagebase:0x7ff61de10000
                        File size:625664 bytes
                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language

                        General

                        Start time:08:45:47
                        Start date:07/06/2021
                        Path:C:\Windows\SysWOW64\cmd.exe
                        Wow64 process (32bit):true
                        Commandline:C:\Windows\system32\cmd.exe /c cd Matter m
                        Imagebase:0x2a0000
                        File size:232960 bytes
                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language

                        General

                        Start time:08:45:47
                        Start date:07/06/2021
                        Path:C:\Windows\SysWOW64\rundll32.exe
                        Wow64 process (32bit):true
                        Commandline:rundll32.exe C:\Users\user\Desktop\QDfpQK7SOG.dll,Problemscale
                        Imagebase:0xd30000
                        File size:61952 bytes
                        MD5 hash:D7CA562B0DB4F4DD0F03A89A1FDAD63D
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Yara matches:
                        • Rule: JoeSecurity_Ursnif_2, Description: Yara detected Ursnif, Source: 00000018.00000002.696642986.000000006E1A1000.00000020.00020000.sdmp, Author: Joe Security

                        General

                        Start time:08:45:50
                        Start date:07/06/2021
                        Path:C:\Windows\System32\conhost.exe
                        Wow64 process (32bit):false
                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Imagebase:0x7ff61de10000
                        File size:625664 bytes
                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language

                        General

                        Start time:08:45:52
                        Start date:07/06/2021
                        Path:C:\Windows\SysWOW64\rundll32.exe
                        Wow64 process (32bit):true
                        Commandline:rundll32.exe C:\Users\user\Desktop\QDfpQK7SOG.dll,WingGrass
                        Imagebase:0xd30000
                        File size:61952 bytes
                        MD5 hash:D7CA562B0DB4F4DD0F03A89A1FDAD63D
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Yara matches:
                        • Rule: JoeSecurity_Ursnif_2, Description: Yara detected Ursnif, Source: 0000001A.00000002.664721905.000000006E1A1000.00000020.00020000.sdmp, Author: Joe Security

                        General

                        Start time:08:45:52
                        Start date:07/06/2021
                        Path:C:\Windows\SysWOW64\cmd.exe
                        Wow64 process (32bit):true
                        Commandline:C:\Windows\system32\cmd.exe /c cd Island
                        Imagebase:0x2a0000
                        File size:232960 bytes
                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language

                        General

                        Start time:08:45:53
                        Start date:07/06/2021
                        Path:C:\Windows\System32\conhost.exe
                        Wow64 process (32bit):false
                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Imagebase:0x7ff61de10000
                        File size:625664 bytes
                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language

                        General

                        Start time:08:45:55
                        Start date:07/06/2021
                        Path:C:\Windows\SysWOW64\cmd.exe
                        Wow64 process (32bit):true
                        Commandline:C:\Windows\system32\cmd.exe /c cd Island
                        Imagebase:0x2a0000
                        File size:232960 bytes
                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language

                        General

                        Start time:08:45:56
                        Start date:07/06/2021
                        Path:C:\Windows\System32\conhost.exe
                        Wow64 process (32bit):false
                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Imagebase:0x7ff61de10000
                        File size:625664 bytes
                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language

                        General

                        Start time:08:45:58
                        Start date:07/06/2021
                        Path:C:\Windows\SysWOW64\cmd.exe
                        Wow64 process (32bit):true
                        Commandline:C:\Windows\system32\cmd.exe /c cd Matter m
                        Imagebase:0x2a0000
                        File size:232960 bytes
                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language

                        General

                        Start time:08:45:58
                        Start date:07/06/2021
                        Path:C:\Windows\SysWOW64\cmd.exe
                        Wow64 process (32bit):true
                        Commandline:C:\Windows\system32\cmd.exe /c cd Island
                        Imagebase:0x2a0000
                        File size:232960 bytes
                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language

                        General

                        Start time:08:46:00
                        Start date:07/06/2021
                        Path:C:\Windows\System32\conhost.exe
                        Wow64 process (32bit):false
                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Imagebase:0x7ff61de10000
                        File size:625664 bytes
                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language

                        General

                        Start time:08:46:06
                        Start date:07/06/2021
                        Path:C:\Windows\SysWOW64\cmd.exe
                        Wow64 process (32bit):true
                        Commandline:C:\Windows\system32\cmd.exe /c cd Matter m
                        Imagebase:0x2a0000
                        File size:232960 bytes
                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language

                        General

                        Start time:08:46:08
                        Start date:07/06/2021
                        Path:C:\Windows\SysWOW64\cmd.exe
                        Wow64 process (32bit):true
                        Commandline:C:\Windows\system32\cmd.exe /c cd Matter m
                        Imagebase:0x2a0000
                        File size:232960 bytes
                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language

                        General

                        Start time:08:46:14
                        Start date:07/06/2021
                        Path:C:\Windows\System32\conhost.exe
                        Wow64 process (32bit):false
                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Imagebase:0x7ff61de10000
                        File size:625664 bytes
                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language

                        Disassembly

                        Code Analysis

                        Reset < >