Analysis Report SecuriteInfo.com..7135.20767

ID:	432910
Product:	CloudBasic
Start time:	22:48:16
Start date:	10.06.2021
Sample:	SecuriteInfo.com..7135.20767
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	5ba7ac7fa4f9e831679832b6cc22aee8
SHA1:	813df24ac22c2666b28bc3e7fb9bd1eef2a7f395
SHA256:	d2c19ac3eace29239bf919c442556abf782da5953325ee6b2626482fbf442f29
Filetype:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{FA4B99A4-CA78-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	BB2CC967C3C6EDA44A69083EB767C117	DAC9F7F3B92917522249C29E661CF7ACF78847C2	88AB7F2C9FAD173136BD458EB3523BCED520C008EC9208F4D665934C16BEED5C
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{FA4B99A6-CA78-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	14655AB8FC1D47B0C5998041E1946C6F	BF8356158D90869DE775D3EBAC100BD449C872E9	4C387E86AA95C86898A353AAAF18A2E2BF0CA0A6F686641D280D5032A840DEFB
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\down[1]	PNG image data, 15 x 15, 8-bit colormap, non-interlaced	C4F558C4C8B56858F15C09037CD6625A	EE497CC061D6A7A59BB66DEFEA65F9A8145BA240	39E7DE847C9F731EAA72338AD9053217B957859DE27B50B6474EC42971530781
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\errorPageStrings[1]	UTF-8 Unicode (with BOM) text, with CRLF line terminators	D65EC06F21C379C87040B83CC1ABAC6B	208D0A0BB775661758394BE7E4AFB18357E46C8B	A1270E90CEA31B46432EC44731BF4400D22B38EB2855326BF934FE8F1B169A4F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\ErrorPageTemplate[1]	UTF-8 Unicode (with BOM) text, with CRLF line terminators	F4FE1CB77E758E1BA56B8A8EC20417C5	F4EDA06901EDB98633A686B11D02F4925F827BF0	8D018639281B33DA8EB3CE0B21D11E1D414E59024C3689F92BE8904EB5779B5F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\bullet[1]	PNG image data, 15 x 15, 8-bit colormap, non-interlaced	26F971D87CA00E23BD2D064524AEF838	7440BEFF2F4F8FABC9315608A13BF26CABAD27D9	1D8E5FD3C1FD384C0A7507E7283C7FE8F65015E521B84569132A7EABEDC9D41D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\background_gradient[1]	JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 1x800, frames 3	20F0110ED5E4E0D5384A496E4880139B	51F5FC61D8BF19100DF0F8AADAA57FCD9C086255	1471693BE91E53C2640FE7BAEECBC624530B088444222D93F2815DFCE1865D5B
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\httpErrorPagesScripts[1]	UTF-8 Unicode (with BOM) text, with CRLF line terminators	9234071287E637F85D721463C488704C	CCA09B1E0FBA38BA29D3972ED8DCECEFDEF8C152	65CC039890C7CEB927CE40F6F199D74E49B8058C3F8A6E22E8F916AD90EA8649
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\http_404[1]	HTML document, UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators	F65C729DC2D457B7A1093813F1253192	5006C9B50108CF582BE308411B157574E5A893FC	B82BFB6FA37FD5D56AC7C00536F150C0F244C81F1FC2D4FEFBBDC5E175C71B4F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\info_48[1]	PNG image data, 47 x 48, 8-bit/color RGBA, non-interlaced	5565250FCC163AA3A79F0B746416CE69	B97CC66471FCDEE07D0EE36C7FB03F342C231F8F	51129C6C98A82EA491F89857C31146ECEC14C4AF184517450A7A20C699C84859
C:\Users\user\AppData\Local\Temp\JavaDeployReg.log	ASCII text, with CRLF line terminators	178A01ED015C601590BBEC374F63BA4E	60027051467C6F595B05EE96B3F462A5347A1386	008E01001F033E85A43FB4222C9D49A536730F53E20CA5B6000FF2208C7EB11C
C:\Users\user\AppData\Local\Temp\~DF00D3A9B95DF089AC.TMP	data	05B04A30B7A55791319C4F71771CF16A	2C6404B854340AB4675377DA01707CD122A8B0CF	589607C9B026909DF546D1EC625408F36A64662A30971317540738E6FF09F154
C:\Users\user\AppData\Local\Temp\~DF80E1CCC67DA5CD93.TMP	data	BB6D7F6068DA37F8EAC557E8224E9DA4	FB0E3897C467217EF4BCD46E8E22723E28A734C9	2E68651AAB4451D174A526B8DC3C253810F8DBF4848C0AECBAAF4E167E84D035

AV Detection:

Antivirus detection for URL or domain

Source: http://authd.feronok.com/INsgiuDpuLw85PPWCNwmsmw/LyIcaMF9BW/RDuesN3193oziv6jZ/21yngUSJZxlB/5U99_2BFq	Avira URL Cloud: Label: malware
Source: http://authd.feronok.com/INsgiuDpuLw85PPWCNwmsmw/LyIcaMF9BW/RDuesN3193oziv6jZ/21yngUSJZxlB/5U99_2BFq39/C9yL3XEqjGdzvV/F4wrCEliEtubK_2BQN3v0/mpD0sYBWj1_2BOoZ/MhYNZMroasOcyRm/Y7cgiiYGTmIYClS1bt/R_2BrGpes/V0WKbm6yczDyoBvOW06Z/_2FVUJ_2BtBEMJQ2mZ0/eqMRxCIXxJwUIjVA7qTLlE/f_2FwC5tmUPbh/r76jmp6x/obp7g2x_2BpjxmD9q5fMhKl/Y1cOMUM_2F/x9ahGBENuH7csdR7_/2FySnpeWZizz/XD203nXIqoX/COsoX4qlT56/jcBfJkpo	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000005.00000003.323666044.0000000002AB0000.00000040.00000001.sdmp

Malware Configuration Extractor: Ursnif {"lang_id": "RU, CN", "RSA Public Key": "oUnY8+/8G/QjijBEa03/PDDCyhbZrtKtx8eYSXLSbmKpR2omzPKPDVDiaj+dBCVC5Sp5s16D5EsjkO+S9MLdqEPK+/EAZI0qxYwv0GmWkXSlJi4jyYyJKc5a5Nek5/cWbmHSXPW+Rq2S8QAD5SioqB8j4ScC8nSuqcxPZwTdEUXuTG36kAdjIfamPdH5DlrmzxdodFTkShIE2IKM5O/dCTIwhTSQIj7YF2w9akzONLDoXT8cJE2CEp0UrlGkTtCcRTWQr67rMF2nSqm+ctweTZRfgBKtrDgiEDrXnhmUscy59twRBz1A7dRDpJryotUEkXjZHrb6gv4q0NjsbeCK4Jw4zYJf7CO+eANF3Bou0fo=", "c2_domain": ["authd.feronok.com", "app.bighomegl.at"], "botnet": "1500", "server": "580", "serpent_key": "jT7xNsiVSW2IugIq", "sleep_time": "10", "CONF_TIMEOUT": "20", "SetWaitableTimer_value": "10"}

Multi AV Scanner detection for domain / URL

Source: authd.feronok.com

Virustotal: Detection: 11%

Perma Link

Compliance:

Uses 32bit PE files

Source: SecuriteInfo.com..7135.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: SecuriteInfo.com..7135.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Source:

Binary string: c:\571\bar\Nature\industry\Son.pdb source: loaddll32.exe, rundll32.exe, SecuriteInfo.com..7135.dll

Networking:

Internet Provider seen in connection with other malware

Source: Joe Sandbox View

ASN Name: SUPERSERVERSDATACENTERRU SUPERSERVERSDATACENTERRU

Downloads files from webservers via HTTP

Source: global traffic

HTTP traffic detected: GET /INsgiuDpuLw85PPWCNwmsmw/LyIcaMF9BW/RDuesN3193oziv6jZ/21yngUSJZxlB/5U99_2BFq39/C9yL3XEqjGdzvV/F4wrCEliEtubK_2BQN3v0/mpD0sYBWj1_2BOoZ/MhYNZMroasOcyRm/Y7cgiiYGTmIYClS1bt/R_2BrGpes/V0WKbm6yczDyoBvOW06Z/_2FVUJ_2BtBEMJQ2mZ0/eqMRxCIXxJwUIjVA7qTLlE/f_2FwC5tmUPbh/r76jmp6x/obp7g2x_2BpjxmD9q5fMhKl/Y1cOMUM_2F/x9ahGBENuH7csdR7_/2FySnpeWZizz/XD203nXIqoX/COsoX4qlT56/jcBfJkpo HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: authd.feronok.comConnection: Keep-Alive

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: authd.feronok.com

Tries to download or post to a non-existing HTTP route (HTTP/1.1 404 Not Found / 503 Service Unavailable)

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 10 Jun 2021 20:50:54 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingContent-Encoding: gzipData Raw: 36 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 40 11 1b 7d a8 34 c8 6c a0 22 28 2f 2f 3d 33 af 02 59 4e 1f 66 9a 3e d4 25 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6a(HML),I310Q/Qp/K&T";Ct@}4l"(//=3YNf>%a30

URLs found in memory or binary data

Source: {FA4B99A6-CA78-11EB-90E4-ECF4BB862DED}.dat.23.dr, ~DF80E1CCC67DA5CD93.TMP.23.dr

String found in binary or memory: http://authd.feronok.com/INsgiuDpuLw85PPWCNwmsmw/LyIcaMF9BW/RDuesN3193oziv6jZ/21yngUSJZxlB/5U99_2BFq

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected Ursnif

Source: Yara match	File source: 00000004.00000003.430352092.0000000005A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.464198146.0000000005A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.430424986.0000000005A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.430241635.0000000005A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.430313705.0000000005A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.430450163.0000000005A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.430406711.0000000005A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.430285928.0000000005A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.430372927.0000000005A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 5328, type: MEMORY

Creates a DirectInput object (often for capturing keystrokes)

Source: loaddll32.exe, 00000000.00000002.460078435.000000000073B000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

Yara detected Ursnif

Source: Yara match	File source: 00000004.00000003.430352092.0000000005A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.464198146.0000000005A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.430424986.0000000005A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.430241635.0000000005A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.430313705.0000000005A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.430450163.0000000005A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.430406711.0000000005A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.430285928.0000000005A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.430372927.0000000005A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 5328, type: MEMORY

System Summary:

Writes registry values via WMI

Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue

Contains functionality to call native functions

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E1C2485 NtQueryVirtualMemory,		0_2_6E1C2485
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E1C1B9C GetProcAddress,NtCreateSection,memset,		4_2_6E1C1B9C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E1C1EC7 NtMapViewOfSection,		4_2_6E1C1EC7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E1C2485 NtQueryVirtualMemory,		4_2_6E1C2485

Detected potential crypto function

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E1C2264		0_2_6E1C2264
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E2237EA		0_2_6E2237EA
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E23F1F0		0_2_6E23F1F0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E23D7C5		0_2_6E23D7C5
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E23DFD2		0_2_6E23DFD2
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E224510		0_2_6E224510
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E291D40		0_2_6E291D40
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E237200		0_2_6E237200
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E23A216		0_2_6E23A216
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E221010		0_2_6E221010
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E2308E5		0_2_6E2308E5
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E22A9D3		0_2_6E22A9D3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E1C2264		4_2_6E1C2264
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E2237EA		4_2_6E2237EA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E23F1F0		4_2_6E23F1F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E23D7C5		4_2_6E23D7C5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E23DFD2		4_2_6E23DFD2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E224510		4_2_6E224510
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E291D40		4_2_6E291D40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E237200		4_2_6E237200
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E23A216		4_2_6E23A216
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E221010		4_2_6E221010
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E2308E5		4_2_6E2308E5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E22A9D3		4_2_6E22A9D3

Found potential string decryption / allocating functions

Source: C:\Windows\System32\loaddll32.exe	Code function: String function: 6E220F70 appears 31 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6E220F70 appears 31 times

Sample file is different than original file name gathered from version info

Source: SecuriteInfo.com..7135.dll

Binary or memory string: OriginalFilenameSon.dll8 vs SecuriteInfo.com..7135.dll

Uses 32bit PE files

Source: SecuriteInfo.com..7135.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Classification label

Source: classification engine

Classification label: mal76.troj.winDLL@12/13@1/1

Creates files inside the user directory

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High

Jump to behavior

Creates temporary files

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DF00D3A9B95DF089AC.TMP

Jump to behavior

PE file has an executable .text section and no other executable section

Source: SecuriteInfo.com..7135.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads ini files

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Reads software policies

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Runs a DLL by calling functions

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com..7135.dll,Paragraphbell

Spawns processes

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com..7135.dll'
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com..7135.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com..7135.dll,Paragraphbell
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com..7135.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com..7135.dll,Sharptwo
Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4456 CREDAT:17410 /prefetch:2
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com..7135.dll',#1			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com..7135.dll,Paragraphbell			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com..7135.dll,Sharptwo			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com..7135.dll',#1			Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4456 CREDAT:17410 /prefetch:2			Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Found GUI installer (many successful clicks)

Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

PE file contains a mix of data directories often seen in goodware

Source: SecuriteInfo.com..7135.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: SecuriteInfo.com..7135.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: SecuriteInfo.com..7135.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: SecuriteInfo.com..7135.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: SecuriteInfo.com..7135.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: SecuriteInfo.com..7135.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: SecuriteInfo.com..7135.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

PE file contains a debug data directory

Source: SecuriteInfo.com..7135.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Binary contains paths to debug symbols

Source:

Binary string: c:\571\bar\Nature\industry\Son.pdb source: loaddll32.exe, rundll32.exe, SecuriteInfo.com..7135.dll

Data Obfuscation:

Contains functionality to dynamically determine API calls

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E1C1F7C LoadLibraryA,GetProcAddress,

0_2_6E1C1F7C

Uses code obfuscation techniques (call, push, ret)

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E1C2200 push ecx; ret		0_2_6E1C2209
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E1C2253 push ecx; ret		0_2_6E1C2263
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E220FB5 push ecx; ret		0_2_6E220FC8
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E1D0B16 pushad ; iretd		0_2_6E1D0B17
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E1CEBB5 pushfd ; iretd		0_2_6E1CEC0C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E1D2807 pushad ; retf		0_2_6E1D2809
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E1D10D4 push 04853024h; retf		0_2_6E1D10DB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E1C2200 push ecx; ret		4_2_6E1C2209
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E1C2253 push ecx; ret		4_2_6E1C2263
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E220FB5 push ecx; ret		4_2_6E220FC8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E1D0B16 pushad ; iretd		4_2_6E1D0B17
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E1CEBB5 pushfd ; iretd		4_2_6E1CEC0C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E1D2807 pushad ; retf		4_2_6E1D2809
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E1D10D4 push 04853024h; retf		4_2_6E1D10DB

Hooking and other Techniques for Hiding and Protection:

Yara detected Ursnif

Source: Yara match	File source: 00000004.00000003.430352092.0000000005A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.464198146.0000000005A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.430424986.0000000005A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.430241635.0000000005A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.430313705.0000000005A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.430450163.0000000005A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.430406711.0000000005A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.430285928.0000000005A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.430372927.0000000005A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 5328, type: MEMORY

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Windows\SysWOW64\rundll32.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Disables application error messsages (SetErrorMode)

Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\System32\loaddll32.exe	Last function: Thread delayed
Source: C:\Windows\System32\loaddll32.exe	Last function: Thread delayed

Anti Debugging:

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E238402 ___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,IsDebuggerPresent,OutputDebugStringW,RtlDecodePointer,

0_2_6E238402

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E238402 ___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,IsDebuggerPresent,OutputDebugStringW,RtlDecodePointer,

0_2_6E238402

Contains functionality to dynamically determine API calls

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E1C1F7C LoadLibraryA,GetProcAddress,

0_2_6E1C1F7C

Contains functionality to read the PEB

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E297188 mov eax, dword ptr fs:[00000030h]		0_2_6E297188
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E2970BE mov eax, dword ptr fs:[00000030h]		0_2_6E2970BE
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E296CC5 push dword ptr fs:[00000030h]		0_2_6E296CC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E297188 mov eax, dword ptr fs:[00000030h]		4_2_6E297188
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E2970BE mov eax, dword ptr fs:[00000030h]		4_2_6E2970BE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E296CC5 push dword ptr fs:[00000030h]		4_2_6E296CC5

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E225139 GetProcessHeap,

0_2_6E225139

Contains functionality to register its own exception handler

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E225EA1 SetUnhandledExceptionFilter,		0_2_6E225EA1
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E225ED2 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6E225ED2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E225EA1 SetUnhandledExceptionFilter,		4_2_6E225EA1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E225ED2 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		4_2_6E225ED2

HIPS / PFW / Operating System Protection Evasion:

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com..7135.dll',#1

Jump to behavior

May try to detect the Windows Explorer process (often used for injection)

Source: loaddll32.exe, 00000000.00000002.460172900.0000000000CD0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.461520126.0000000003680000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: loaddll32.exe, 00000000.00000002.460172900.0000000000CD0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.461520126.0000000003680000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: loaddll32.exe, 00000000.00000002.460172900.0000000000CD0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.461520126.0000000003680000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: loaddll32.exe, 00000000.00000002.460172900.0000000000CD0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.461520126.0000000003680000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Contains functionality to query locales information (e.g. system language)

Source: C:\Windows\System32\loaddll32.exe	Code function: GetLocaleInfoA,GetSystemDefaultUILanguage,VerLanguageNameA,		0_2_6E1C1E8A
Source: C:\Windows\System32\loaddll32.exe	Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage,		0_2_6E22E72D
Source: C:\Windows\System32\loaddll32.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,		0_2_6E22E438
Source: C:\Windows\System32\loaddll32.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,		0_2_6E22E4B5
Source: C:\Windows\System32\loaddll32.exe	Code function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage,		0_2_6E22E538
Source: C:\Windows\System32\loaddll32.exe	Code function: EnumSystemLocalesW,		0_2_6E22ED13
Source: C:\Windows\System32\loaddll32.exe	Code function: GetLocaleInfoW,		0_2_6E22ED99
Source: C:\Windows\System32\loaddll32.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,		0_2_6E22FA7E
Source: C:\Windows\System32\loaddll32.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,__invoke_watson,		0_2_6E223BC0
Source: C:\Windows\System32\loaddll32.exe	Code function: EnumSystemLocalesW,		0_2_6E22E3DC
Source: C:\Windows\System32\loaddll32.exe	Code function: _wcscmp,_wcscmp,GetLocaleInfoW,GetLocaleInfoW,GetACP,		0_2_6E22E857
Source: C:\Windows\System32\loaddll32.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,		0_2_6E22E904
Source: C:\Windows\System32\loaddll32.exe	Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,__invoke_watson,_LcidFromHexString,GetLocaleInfoW,		0_2_6E22E168
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoA,GetSystemDefaultUILanguage,VerLanguageNameA,		4_2_6E1C1E8A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage,		4_2_6E22E72D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,		4_2_6E22E438
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,		4_2_6E22E4B5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage,		4_2_6E22E538
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,		4_2_6E22ED13
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,		4_2_6E22ED99
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,		4_2_6E22FA7E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,__invoke_watson,		4_2_6E223BC0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,		4_2_6E22E3DC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _wcscmp,_wcscmp,GetLocaleInfoW,GetLocaleInfoW,GetACP,		4_2_6E22E857
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,		4_2_6E22E904
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,__invoke_watson,_LcidFromHexString,GetLocaleInfoW,		4_2_6E22E168

Queries the installation date of Windows

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Jump to behavior

Contains functionality to query local / system time

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E1C1C7D SetThreadPriority,GetSystemTime,SwitchToThread,Sleep,GetLongPathNameW,GetLongPathNameW,GetLongPathNameW,WaitForSingleObject,GetExitCodeThread,CloseHandle,GetLastError,GetLastError,

0_2_6E1C1C7D

Contains functionality to query windows version

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E1C1F10 CreateEventA,GetVersion,GetCurrentProcessId,OpenProcess,GetLastError,

0_2_6E1C1F10

Queries the cryptographic machine GUID

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected Ursnif

Source: Yara match	File source: 00000004.00000003.430352092.0000000005A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.464198146.0000000005A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.430424986.0000000005A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.430241635.0000000005A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.430313705.0000000005A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.430450163.0000000005A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.430406711.0000000005A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.430285928.0000000005A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.430372927.0000000005A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 5328, type: MEMORY

Remote Access Functionality:

Yara detected Ursnif

Source: Yara match	File source: 00000004.00000003.430352092.0000000005A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.464198146.0000000005A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.430424986.0000000005A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.430241635.0000000005A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.430313705.0000000005A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.430450163.0000000005A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.430406711.0000000005A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.430285928.0000000005A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.430372927.0000000005A58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 5328, type: MEMORY