Analysis Report HP7cjYBnlS

ID:	430819
Product:	CloudBasic
Start time:	03:03:14
Start date:	08.06.2021
Sample:	HP7cjYBnlS
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	b8bc8b1740b329ff2baf16bcee6ca23d
SHA1:	d9215e03d2ddae00041a4ddd731872025b3ce537
SHA256:	aafda6138e0a43b153cc003b11f3e5fa8bf9e929d2356ec536b931a0ce983aa1
Filetype:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{09EF2731-C841-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	F0047039D92C510E826FA3722F724292	875A02313AA8EC48FF05D234EF2C37C305D0CBB7	E58A01C579A1B54726A1859E357A2754A15521627C26EE701A71AA3F45F7F347
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{09EF2733-C841-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	28803DAF8FFCCE649C0C015B1A555EA6	DAD62007917336DFCA4D104FFEF94AA2DC0A91F9	200769DF4608C1C9577F58F50E9D86CAF134724A80D35F5CBC55F4ACF4A65E50
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-17529550060\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	6B9654B5CA5F22C2164548A9D096480C	143CB516BBF18599C40A5E19400FB44A6650FCC2	2380BA5BE87922269AA7A63CC1DCCA0B374A1EE6184A52FF5D7387EA68BA18D9
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-18270793970\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	6E7C25C1A0622910F446656C3D77B971	D3F1F79C09873942FD741F1EF10271E033551BBA	72C086222AE0970AEC5D0054AFF1384D631EB869DF20D03FF29448AA16CF8B3F
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-21706820\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	9464F564BBEF02C775B6893D2199D426	9EA222883F510BDC1222C8B7148818A3B23BAD30	933B4954F5209FDCABBC9A67D5A1C1771F753B54D8433F77F1CD33F8C18145C9
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-4759708130\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	21E145FCFFFB3F4E94A251DF9817D48C	820A41F8CD11AA175931CAAB4E8E433D29502C96	66F90DD72734A1FB2FA7E1F19591678FDEF91AB156A24D114162F281BC012062
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-6757900\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	7496A75541186C68094AF292E8489680	ED00F31F1B52335B8C2F7C0EC4B77EF20DB60119	AF0068A73B4DE0907F9CC99D903B79BA2C50E8D5FD867F5B36681B724F7A1117
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-8760897390\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	AABC34FD747C07772AAE4336F43B9B21	6FAE91AC5FC1E9C069FD3BFC63F8DCECA1A20994	63552A00989F00CEE54E199424D009ADCEA6ED934E22E0F07DF8632E217D12A8
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20259167780\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	8473F0AC244EA0062FDBB746AD657821	B0E117492B62EDE106080B75A5821ADF10ECDC93	8700A766CBEE959F2D483889CAA34F2F82CB0FCEE6D411057061AA8EF0D1745F
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20332743330\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	358A297A51F48C33F354313C7F997ED0	1FC04A3475CF94404CA5B75AB75C4E50CD9610C4	641C3E8CE7C07CBF850015BD6A69E65235B822672BD873F5CAE873C304F669A1
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin8215062560\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	5FACBF68BC885E0930CBDD5501E58E39	BCB29F778D7C4CED48E2CB1F6504F4291FAFD48C	CB27A98E64763FBAF8BCAE8B14E411F0C37072A29F152038A445A64E233D2E37
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\down[1]	PNG image data, 15 x 15, 8-bit colormap, non-interlaced	C4F558C4C8B56858F15C09037CD6625A	EE497CC061D6A7A59BB66DEFEA65F9A8145BA240	39E7DE847C9F731EAA72338AD9053217B957859DE27B50B6474EC42971530781
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\errorPageStrings[1]	UTF-8 Unicode (with BOM) text, with CRLF line terminators	D65EC06F21C379C87040B83CC1ABAC6B	208D0A0BB775661758394BE7E4AFB18357E46C8B	A1270E90CEA31B46432EC44731BF4400D22B38EB2855326BF934FE8F1B169A4F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\ErrorPageTemplate[1]	UTF-8 Unicode (with BOM) text, with CRLF line terminators	F4FE1CB77E758E1BA56B8A8EC20417C5	F4EDA06901EDB98633A686B11D02F4925F827BF0	8D018639281B33DA8EB3CE0B21D11E1D414E59024C3689F92BE8904EB5779B5F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\bullet[1]	PNG image data, 15 x 15, 8-bit colormap, non-interlaced	26F971D87CA00E23BD2D064524AEF838	7440BEFF2F4F8FABC9315608A13BF26CABAD27D9	1D8E5FD3C1FD384C0A7507E7283C7FE8F65015E521B84569132A7EABEDC9D41D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\background_gradient[1]	JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 1x800, frames 3	20F0110ED5E4E0D5384A496E4880139B	51F5FC61D8BF19100DF0F8AADAA57FCD9C086255	1471693BE91E53C2640FE7BAEECBC624530B088444222D93F2815DFCE1865D5B
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\httpErrorPagesScripts[1]	UTF-8 Unicode (with BOM) text, with CRLF line terminators	9234071287E637F85D721463C488704C	CCA09B1E0FBA38BA29D3972ED8DCECEFDEF8C152	65CC039890C7CEB927CE40F6F199D74E49B8058C3F8A6E22E8F916AD90EA8649
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\http_404[1]	HTML document, UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators	F65C729DC2D457B7A1093813F1253192	5006C9B50108CF582BE308411B157574E5A893FC	B82BFB6FA37FD5D56AC7C00536F150C0F244C81F1FC2D4FEFBBDC5E175C71B4F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\info_48[1]	PNG image data, 47 x 48, 8-bit/color RGBA, non-interlaced	5565250FCC163AA3A79F0B746416CE69	B97CC66471FCDEE07D0EE36C7FB03F342C231F8F	51129C6C98A82EA491F89857C31146ECEC14C4AF184517450A7A20C699C84859
C:\Users\user\AppData\Local\Temp\JavaDeployReg.log	ASCII text, with CRLF line terminators	C9577366B230E3D02989EBAE9039B378	E7A71B648ECE0114729875CD56C41BB39738933D	26CBDD7D48376CF1A596B4DD0988F22A24394BCE856656C45F8F2D0F98725C4C
C:\Users\user\AppData\Local\Temp\~DF576B8A5F529C2713.TMP	data	425B698152378D38042530C60D4CBF41	4D04296F6B32E8D5D6B7E6F48EBAFFEC5FBC9642	8FFC223AF114D5767DC8C75CB0F52959B12E762D46A07694526B50FAFA59102F
C:\Users\user\AppData\Local\Temp\~DF911219CB699D8BEF.TMP	data	4C4A4BC5DD5CF7031A47ECDABADC6329	7AEB5294FD7C7389A8922365F152536E38968767	C3650AAE56849635B121E3C56D0BD1B427FBDC5A841E19F11E6EE4617D68C376

AV Detection:

Antivirus detection for URL or domain

Source: http://authd.feronok.com/5FNMYYgHAZL8fVyyU/16CafLRrMTz3/QRf0T9yKnnG/48zYuAResxRN4Y/8IsjuLfvxqx5QmY_2	Avira URL Cloud: Label: malware
Source: http://authd.feronok.com/ft4uMX2U8DExkako/7nz7XYcy_2FPVr_/2FPwc_2Fs5FKMespD3/eoY8gKUtH/5APsBMu_2FYgV7VnT01F/UNasB5xyXVRAz2U9YlK/vPhVaOevuoWXkOwOuvQxwX/WzTW2Vxlbm5Dm/rPytLuLu/KL_2FHSOlQc2K_2BpO7JML7/v1pC4egQVv/iWGaiNgaqJFCdjHoy/PoXO84M5LLuy/jOUqBl_2Bse/EY7p0c9R6kAidR/RKeKXozKr_2B2DMk4uhLx/44Gh2U87rhzhq5q8/e3uXzWyPgLhp7zv/L1Iu0qPLA6WpCvBUhY/ZBphUq1tO/a9IY_2Fv/fGT	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000005.00000003.328801653.0000000002F30000.00000040.00000001.sdmp

Malware Configuration Extractor: Ursnif {"lang_id": "RU, CN", "RSA Public Key": "U9rEBqXZSYCa5+IGIsh6bG+yCElOQeh3mm/EbofYWnWn8eEmiiYrJf4LFttt0DUA+39n8FZdgzQ8+SZc3rzhnMPMr8Z4fx3D+fbRo+I1MIlbD4szoKzRpMkx5aTB8Cab5I+DXW6gWdfQr7HECFEcTAwpyJLhfIGXn6KxgwFOnVndUgrjSYq7Gck569kPOO4YXnbUwt69XT2FKUKDeX2hms5/QtXX3Hh9nmWOhvUxbY98vRvvbsLlPzjNF7v0QGIh4X7uypp3Ivkr2P2sMxabdSYOW4HN4JM/VPPFS2qTgX6hwJ09dF8P8HXDM24KI8tEs5YG59SMhcwCDFrBdfAkYEtatx5JFUNCiZ8QoDq+MTA=", "c2_domain": ["authd.feronok.com", "app.bighomegl.at"], "botnet": "5500", "server": "580", "serpent_key": "w81KRA2f0ixucq4e", "sleep_time": "10", "CONF_TIMEOUT": "20", "SetWaitableTimer_value": "10"}

Multi AV Scanner detection for domain / URL

Source: authd.feronok.com

Virustotal: Detection: 12%

Perma Link

Cryptography:

Uses Microsoft's Enhanced Cryptographic Provider

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_030839C5 CryptAcquireContextW,memcpy,CryptImportKey,CryptSetKeyParam,memcpy,CryptEncrypt,GetLastError,GetLastError,CryptDestroyKey,GetLastError,CryptReleaseContext,GetLastError,

4_2_030839C5

Compliance:

Uses 32bit PE files

Source: HP7cjYBnlS.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: HP7cjYBnlS.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Source:

Binary string: c:\doctor\223\Top\key\each M\Iron.pdb source: loaddll32.exe, 00000001.00000002.474423465.000000006E242000.00000002.00020000.sdmp, rundll32.exe, 00000004.00000002.476442754.000000006E242000.00000002.00020000.sdmp, HP7cjYBnlS.dll

Spreading:

Contains functionality to enumerate / list files inside a directory

Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E1DBE2B FindFirstFileExW,FindNextFileW,FindClose,		1_2_6E1DBE2B
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E1DBA6F FindFirstFileExW,		1_2_6E1DBA6F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E1DBE2B FindFirstFileExW,FindNextFileW,FindClose,		4_2_6E1DBE2B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E1DBA6F FindFirstFileExW,		4_2_6E1DBA6F

Networking:

Internet Provider seen in connection with other malware

Source: Joe Sandbox View

ASN Name: CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC

Downloads files from webservers via HTTP

Source: global traffic

HTTP traffic detected: GET /5FNMYYgHAZL8fVyyU/16CafLRrMTz3/QRf0T9yKnnG/48zYuAResxRN4Y/8IsjuLfvxqx5QmY_2BQXv/jhaYgnRoJXbt0p9E/b8fATrD6qQYegBk/Z_2BGMca1pIbKyE0_2/B6xQROT_2/FVtM7cI_2F4AqKBZTcM8/ka_2F9uVk0Uf7i421qg/djhua0iQVsNSQqZdHOVnOp/1bWWjsxwMvE9P/MwkEBGYh/46lRSAqS_2BR6Lm5JNn7FqF/Gnvaxpv6Hg/PmOIMmhyTSho2PVt_/2FS0IBXGm_2B/SjjfTOvQzGo/_2FqD_2BGuMeOB/vnbxHYtmqGY_2BlpC/_2BvpW HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: authd.feronok.comConnection: Keep-Alive

Source: global traffic

HTTP traffic detected: GET /ft4uMX2U8DExkako/7nz7XYcy_2FPVr_/2FPwc_2Fs5FKMespD3/eoY8gKUtH/5APsBMu_2FYgV7VnT01F/UNasB5xyXVRAz2U9YlK/vPhVaOevuoWXkOwOuvQxwX/WzTW2Vxlbm5Dm/rPytLuLu/KL_2FHSOlQc2K_2BpO7JML7/v1pC4egQVv/iWGaiNgaqJFCdjHoy/PoXO84M5LLuy/jOUqBl_2Bse/EY7p0c9R6kAidR/RKeKXozKr_2B2DMk4uhLx/44Gh2U87rhzhq5q8/e3uXzWyPgLhp7zv/L1Iu0qPLA6WpCvBUhY/ZBphUq1tO/a9IY_2Fv/fGT HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: authd.feronok.comConnection: Keep-Alive

Found strings which match to known social media urls

Source: msapplication.xml0.23.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0xe0e390e5,0x01d75c4d</date><accdate>0xe0e390e5,0x01d75c4d</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml0.23.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0xe0e390e5,0x01d75c4d</date><accdate>0xe0e390e5,0x01d75c4d</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml5.23.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0xe0ed1a45,0x01d75c4d</date><accdate>0xe0ed1a45,0x01d75c4d</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml5.23.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0xe0ed1a45,0x01d75c4d</date><accdate>0xe0ed1a45,0x01d75c4d</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml7.23.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0xe0ed1a45,0x01d75c4d</date><accdate>0xe0ed1a45,0x01d75c4d</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: msapplication.xml7.23.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0xe0ed1a45,0x01d75c4d</date><accdate>0xe0ed1a45,0x01d75c4d</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: authd.feronok.com

Tries to download or post to a non-existing HTTP route (HTTP/1.1 404 Not Found / 503 Service Unavailable)

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 08 Jun 2021 01:05:27 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingContent-Encoding: gzipData Raw: 36 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 40 11 1b 7d a8 34 c8 6c a0 22 28 2f 2f 3d 33 af 02 59 4e 1f 66 9a 3e d4 25 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6a(HML),I310Q/Qp/K&T";Ct@}4l"(//=3YNf>%a30

URLs found in memory or binary data

Source: {09EF2733-C841-11EB-90E4-ECF4BB862DED}.dat.23.dr	String found in binary or memory: http://authd.feronok.com/5FNMYYgHAZL8fVyyU/16CafLRrMTz3/QRf0T9yKnnG/48zYuAResxRN4Y/8IsjuLfvxqx5QmY_2
Source: msapplication.xml.23.dr	String found in binary or memory: http://www.amazon.com/
Source: msapplication.xml1.23.dr	String found in binary or memory: http://www.google.com/
Source: msapplication.xml2.23.dr	String found in binary or memory: http://www.live.com/
Source: msapplication.xml3.23.dr	String found in binary or memory: http://www.nytimes.com/
Source: msapplication.xml4.23.dr	String found in binary or memory: http://www.reddit.com/
Source: msapplication.xml5.23.dr	String found in binary or memory: http://www.twitter.com/
Source: msapplication.xml6.23.dr	String found in binary or memory: http://www.wikipedia.com/
Source: msapplication.xml7.23.dr	String found in binary or memory: http://www.youtube.com/

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected Ursnif

Source: Yara match	File source: 00000001.00000003.375144383.0000000003A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.456094378.0000000005BB8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.375123704.0000000003A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.375061576.0000000003A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.473815277.0000000003A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.456111628.0000000005BB8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.375035453.0000000003A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.456029858.0000000005BB8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.375085386.0000000003A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.456137723.0000000005BB8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.476067221.0000000005BB8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.375104521.0000000003A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.456077100.0000000005BB8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.375160465.0000000003A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.456001052.0000000005BB8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.375172121.0000000003A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.456056228.0000000005BB8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.455955678.0000000005BB8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 2160, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 5564, type: MEMORY

E-Banking Fraud:

Yara detected Ursnif

Source: Yara match	File source: 00000001.00000003.375144383.0000000003A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.456094378.0000000005BB8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.375123704.0000000003A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.375061576.0000000003A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.473815277.0000000003A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.456111628.0000000005BB8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.375035453.0000000003A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.456029858.0000000005BB8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.375085386.0000000003A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.456137723.0000000005BB8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.476067221.0000000005BB8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.375104521.0000000003A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.456077100.0000000005BB8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.375160465.0000000003A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.456001052.0000000005BB8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.375172121.0000000003A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.456056228.0000000005BB8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.455955678.0000000005BB8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 2160, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 5564, type: MEMORY

Spam, unwanted Advertisements and Ransom Demands:

Contains functionality to import cryptographic keys (often used in ransomware)

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_030839C5 CryptAcquireContextW,memcpy,CryptImportKey,CryptSetKeyParam,memcpy,CryptEncrypt,GetLastError,GetLastError,CryptDestroyKey,GetLastError,CryptReleaseContext,GetLastError,

4_2_030839C5

System Summary:

Writes or reads registry keys via WMI

Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetStringValue
Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue

Writes registry values via WMI

Source: C:\Windows\System32\loaddll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\System32\loaddll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\System32\loaddll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue

Contains functionality to call native functions

Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E1B1B9C GetProcAddress,NtCreateSection,memset,		1_2_6E1B1B9C
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E1B1EC7 NtMapViewOfSection,		1_2_6E1B1EC7
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E1B2485 NtQueryVirtualMemory,		1_2_6E1B2485
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_03082D06 NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose,		4_2_03082D06
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_03088005 NtQueryVirtualMemory,		4_2_03088005

Detected potential crypto function

Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E1B2264		1_2_6E1B2264
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E1D1EB4		1_2_6E1D1EB4
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E1C5F80		1_2_6E1C5F80
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E1D1C73		1_2_6E1D1C73
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E1D1A41		1_2_6E1D1A41
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E1C5B50		1_2_6E1C5B50
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E1D1800		1_2_6E1D1800
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E1C248F		1_2_6E1C248F
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E1D15CE		1_2_6E1D15CE
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E1D25F2		1_2_6E1D25F2
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E1E325A		1_2_6E1E325A
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E1C5240		1_2_6E1C5240
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E1EF260		1_2_6E1EF260
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E1D238D		1_2_6E1D238D
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E1D2119		1_2_6E1D2119
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E1E313A		1_2_6E1E313A
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E1C3163		1_2_6E1C3163
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_03083109		4_2_03083109
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_03087DE0		4_2_03087DE0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_03082206		4_2_03082206
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E1D1EB4		4_2_6E1D1EB4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E1C5F80		4_2_6E1C5F80
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E1D1C73		4_2_6E1D1C73
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E1C248F		4_2_6E1C248F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E1D15CE		4_2_6E1D15CE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E1D25F2		4_2_6E1D25F2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E1E325A		4_2_6E1E325A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E1C5240		4_2_6E1C5240
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E1D1A41		4_2_6E1D1A41
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E1EF260		4_2_6E1EF260
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E1C5B50		4_2_6E1C5B50
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E1D238D		4_2_6E1D238D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E1D1800		4_2_6E1D1800
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E1D2119		4_2_6E1D2119
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E1E313A		4_2_6E1E313A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E1C3163		4_2_6E1C3163

Uses 32bit PE files

Source: HP7cjYBnlS.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Classification label

Source: classification engine

Classification label: mal80.troj.winDLL@12/22@2/1

Contains functionality to enum processes or threads

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_0308513E CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

4_2_0308513E

Creates files inside the user directory

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High

Jump to behavior

Creates temporary files

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DF911219CB699D8BEF.TMP

Jump to behavior

PE file has an executable .text section and no other executable section

Source: HP7cjYBnlS.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads ini files

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Reads software policies

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Runs a DLL by calling functions

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\HP7cjYBnlS.dll,Lastinch

Spawns processes

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\HP7cjYBnlS.dll'
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\HP7cjYBnlS.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\HP7cjYBnlS.dll,Lastinch
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\HP7cjYBnlS.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\HP7cjYBnlS.dll,Ownof
Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5936 CREDAT:17410 /prefetch:2
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\HP7cjYBnlS.dll',#1			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\HP7cjYBnlS.dll,Lastinch			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\HP7cjYBnlS.dll,Ownof			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\HP7cjYBnlS.dll',#1			Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5936 CREDAT:17410 /prefetch:2			Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Windows\System32\loaddll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Found GUI installer (many successful clicks)

Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

PE file contains a mix of data directories often seen in goodware

Source: HP7cjYBnlS.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: HP7cjYBnlS.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: HP7cjYBnlS.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: HP7cjYBnlS.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: HP7cjYBnlS.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: HP7cjYBnlS.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: HP7cjYBnlS.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

PE file contains a debug data directory

Source: HP7cjYBnlS.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Binary contains paths to debug symbols

Source:

Binary string: c:\doctor\223\Top\key\each M\Iron.pdb source: loaddll32.exe, 00000001.00000002.474423465.000000006E242000.00000002.00020000.sdmp, rundll32.exe, 00000004.00000002.476442754.000000006E242000.00000002.00020000.sdmp, HP7cjYBnlS.dll

PE file contains a valid data directory to section mapping

Source: HP7cjYBnlS.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: HP7cjYBnlS.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: HP7cjYBnlS.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: HP7cjYBnlS.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: HP7cjYBnlS.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation:

Contains functionality to dynamically determine API calls

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_6E1B1F7C LoadLibraryA,GetProcAddress,

1_2_6E1B1F7C

Uses code obfuscation techniques (call, push, ret)

Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E1B2200 push ecx; ret		1_2_6E1B2209
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E1B2253 push ecx; ret		1_2_6E1B2263
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E282E55 push esi; ret		1_2_6E282E5E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_03087DCF push ecx; ret		4_2_03087DDF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_03087A60 push ecx; ret		4_2_03087A69
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E282E55 push esi; ret		4_2_6E282E5E

Hooking and other Techniques for Hiding and Protection:

Yara detected Ursnif

Source: Yara match	File source: 00000001.00000003.375144383.0000000003A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.456094378.0000000005BB8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.375123704.0000000003A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.375061576.0000000003A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.473815277.0000000003A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.456111628.0000000005BB8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.375035453.0000000003A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.456029858.0000000005BB8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.375085386.0000000003A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.456137723.0000000005BB8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.476067221.0000000005BB8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.375104521.0000000003A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.456077100.0000000005BB8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.375160465.0000000003A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.456001052.0000000005BB8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.375172121.0000000003A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.456056228.0000000005BB8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.455955678.0000000005BB8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 2160, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 5564, type: MEMORY

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Windows\System32\loaddll32.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Disables application error messsages (SetErrorMode)

Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Contains functionality to enumerate / list files inside a directory

Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E1DBE2B FindFirstFileExW,FindNextFileW,FindClose,		1_2_6E1DBE2B
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E1DBA6F FindFirstFileExW,		1_2_6E1DBA6F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E1DBE2B FindFirstFileExW,FindNextFileW,FindClose,		4_2_6E1DBE2B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E1DBA6F FindFirstFileExW,		4_2_6E1DBA6F

Anti Debugging:

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_6E1D520E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

1_2_6E1D520E

Contains functionality to dynamically determine API calls

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_6E1B1F7C LoadLibraryA,GetProcAddress,

1_2_6E1B1F7C

Contains functionality to read the PEB

Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E1DB429 mov eax, dword ptr fs:[00000030h]		1_2_6E1DB429
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E1DB21D mov eax, dword ptr fs:[00000030h]		1_2_6E1DB21D
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E1DB260 mov eax, dword ptr fs:[00000030h]		1_2_6E1DB260
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E1DB2BB mov eax, dword ptr fs:[00000030h]		1_2_6E1DB2BB
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E1DB370 mov eax, dword ptr fs:[00000030h]		1_2_6E1DB370
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E1DB3B4 mov eax, dword ptr fs:[00000030h]		1_2_6E1DB3B4
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E1DB3F8 mov eax, dword ptr fs:[00000030h]		1_2_6E1DB3F8
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E1CB0D0 mov eax, dword ptr fs:[00000030h]		1_2_6E1CB0D0
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E1CB112 mov ecx, dword ptr fs:[00000030h]		1_2_6E1CB112
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E1DB1DA mov eax, dword ptr fs:[00000030h]		1_2_6E1DB1DA
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E280A6A mov eax, dword ptr fs:[00000030h]		1_2_6E280A6A
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E2809A0 mov eax, dword ptr fs:[00000030h]		1_2_6E2809A0
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E2805A7 push dword ptr fs:[00000030h]		1_2_6E2805A7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E1DB429 mov eax, dword ptr fs:[00000030h]		4_2_6E1DB429
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E1DB21D mov eax, dword ptr fs:[00000030h]		4_2_6E1DB21D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E1DB260 mov eax, dword ptr fs:[00000030h]		4_2_6E1DB260
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E1DB2BB mov eax, dword ptr fs:[00000030h]		4_2_6E1DB2BB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E1DB370 mov eax, dword ptr fs:[00000030h]		4_2_6E1DB370
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E1DB3B4 mov eax, dword ptr fs:[00000030h]		4_2_6E1DB3B4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E1DB3F8 mov eax, dword ptr fs:[00000030h]		4_2_6E1DB3F8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E1CB0D0 mov eax, dword ptr fs:[00000030h]		4_2_6E1CB0D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E1DB1DA mov eax, dword ptr fs:[00000030h]		4_2_6E1DB1DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E280A6A mov eax, dword ptr fs:[00000030h]		4_2_6E280A6A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E2809A0 mov eax, dword ptr fs:[00000030h]		4_2_6E2809A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E2805A7 push dword ptr fs:[00000030h]		4_2_6E2805A7

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_6E1DED89 GetProcessHeap,

1_2_6E1DED89

Contains functionality to register its own exception handler

Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E1D520E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		1_2_6E1D520E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E1D520E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		4_2_6E1D520E

HIPS / PFW / Operating System Protection Evasion:

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\HP7cjYBnlS.dll',#1

Jump to behavior

May try to detect the Windows Explorer process (often used for injection)

Source: loaddll32.exe, 00000001.00000002.472113602.00000000018F0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.473066797.0000000003860000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: loaddll32.exe, 00000001.00000002.472113602.00000000018F0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.473066797.0000000003860000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: loaddll32.exe, 00000001.00000002.472113602.00000000018F0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.473066797.0000000003860000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: loaddll32.exe, 00000001.00000002.472113602.00000000018F0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.473066797.0000000003860000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Contains functionality to query CPU information (cpuid)

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_03084454 cpuid

4_2_03084454

Contains functionality to query locales information (e.g. system language)

Source: C:\Windows\System32\loaddll32.exe	Code function: GetLocaleInfoA,GetSystemDefaultUILanguage,VerLanguageNameA,		1_2_6E1B1E8A
Source: C:\Windows\System32\loaddll32.exe	Code function: EnumSystemLocalesW,		1_2_6E1DDE5B
Source: C:\Windows\System32\loaddll32.exe	Code function: EnumSystemLocalesW,		1_2_6E1DDE84
Source: C:\Windows\System32\loaddll32.exe	Code function: EnumSystemLocalesW,		1_2_6E1E4C9D
Source: C:\Windows\System32\loaddll32.exe	Code function: EnumSystemLocalesW,		1_2_6E1E4D06
Source: C:\Windows\System32\loaddll32.exe	Code function: EnumSystemLocalesW,		1_2_6E1DDD84
Source: C:\Windows\System32\loaddll32.exe	Code function: EnumSystemLocalesW,		1_2_6E1E4DA1
Source: C:\Windows\System32\loaddll32.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,		1_2_6E1E49FB
Source: C:\Windows\System32\loaddll32.exe	Code function: GetLocaleInfoW,		1_2_6E1DE7A7
Source: C:\Windows\System32\loaddll32.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,		1_2_6E1E537A
Source: C:\Windows\System32\loaddll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,		1_2_6E1E51A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,		4_2_6E1DE7A7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,		4_2_6E1E4C9D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,		4_2_6E1E4D06
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,		4_2_6E1DDD84
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,		4_2_6E1E4DA1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,		4_2_6E1E537A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,		4_2_6E1E51A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,		4_2_6E1E49FB

Queries the installation date of Windows

Source: C:\Windows\System32\loaddll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Jump to behavior

Contains functionality to query local / system time

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_6E1B1144 GetSystemTimeAsFileTime,_aulldiv,_snwprintf,CreateFileMappingW,GetLastError,GetLastError,MapViewOfFile,GetLastError,CloseHandle,GetLastError,

1_2_6E1B1144

Contains functionality to query the account / user name

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_03084454 wsprintfA,RtlAllocateHeap,GetUserNameW,RtlAllocateHeap,GetUserNameW,HeapFree,GetComputerNameW,GetComputerNameW,RtlAllocateHeap,GetComputerNameW,HeapFree,

4_2_03084454

Contains functionality to query windows version

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_6E1B1F10 CreateEventA,GetVersion,GetCurrentProcessId,OpenProcess,GetLastError,

1_2_6E1B1F10

Queries the cryptographic machine GUID

Source: C:\Windows\System32\loaddll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected Ursnif

Source: Yara match	File source: 00000001.00000003.375144383.0000000003A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.456094378.0000000005BB8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.375123704.0000000003A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.375061576.0000000003A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.473815277.0000000003A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.456111628.0000000005BB8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.375035453.0000000003A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.456029858.0000000005BB8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.375085386.0000000003A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.456137723.0000000005BB8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.476067221.0000000005BB8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.375104521.0000000003A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.456077100.0000000005BB8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.375160465.0000000003A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.456001052.0000000005BB8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.375172121.0000000003A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.456056228.0000000005BB8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.455955678.0000000005BB8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 2160, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 5564, type: MEMORY

Remote Access Functionality:

Yara detected Ursnif

Source: Yara match	File source: 00000001.00000003.375144383.0000000003A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.456094378.0000000005BB8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.375123704.0000000003A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.375061576.0000000003A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.473815277.0000000003A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.456111628.0000000005BB8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.375035453.0000000003A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.456029858.0000000005BB8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.375085386.0000000003A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.456137723.0000000005BB8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.476067221.0000000005BB8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.375104521.0000000003A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.456077100.0000000005BB8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.375160465.0000000003A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.456001052.0000000005BB8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.375172121.0000000003A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.456056228.0000000005BB8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.455955678.0000000005BB8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 2160, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 5564, type: MEMORY