Windows Analysis Report 5.dll

ID:	445164
Product:	CloudBasic
Start time:	10:40:23
Start date:	07.07.2021
Sample:	5.dll
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	fceb6a51be4205d11be1491f6e263cae
SHA1:	0abb60d37fac49912172c5385ff58e049520eb53
SHA256:	c521dd937ce9b2e8bda2fa915bae5b5be0e150a8b82e3b2bfb1cdbc60a8326c4
Filetype:	Win32 Dynamic Link Library (generic) (1002004/3) 96.66%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{BD6AF35A-DF4A-11EB-90E5-ECF4BB570DC9}.dat	Microsoft Word Document	1B2C08B04283EF2331ACDE91B8BBCB4D	43A807C8569A26885E912103F9D6D63547638D07	77E5A7867B6DA6BC138D8896ACB6DE61361F526F8CA51CE601A9E68DC95E6992
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{BD6AF35C-DF4A-11EB-90E5-ECF4BB570DC9}.dat	Microsoft Word Document	ABBBABDCEF013C7360EF262DA94D0BB1	7886E7C0D416567109ED45A58EB4C63AEC4DA13D	5F82BCE7575218FED78D6771274A7CE3F2F9450019B37CA1A44043E2DE1B67AD
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{BD6AF35E-DF4A-11EB-90E5-ECF4BB570DC9}.dat	Microsoft Word Document	E314AEEF8885724C4F91A74CBF288AAE	C299E34AFACD5E67A2748443AE4F3D71D1213174	3DC9BB6E88346FF7285AA2B7BE18C8FA94331C42DD48253FBC3436DFB8BF4F00
C:\Users\user\AppData\Local\Temp\JavaDeployReg.log	ASCII text, with CRLF line terminators	7551EDFC2A095038308DE03A979AEA3B	28A3E4408ABBD841E14B80C82D712894D7480A73	FD0B2F23730CC3AAAFEB969CE5AFF07BAD4CA1EDA987671346FE6513CB7AFDD6
C:\Users\user\AppData\Local\Temp\~DF3A99C7AD2702480D.TMP	data	5E4E8D633EEC37451CA584FB977CD2A3	F2FDC159F116F1F666876081CD57C21FF4D6F629	54912DA24BE3C7F0278AFF9A7FA3748F20BB70B7A444BB6D36219E8F5BAF910E
C:\Users\user\AppData\Local\Temp\~DF48F8DB99852E5824.TMP	data	48DB8549900DAE5BC2552D048ED02C3F	6C535A402C05BF8FEFC3500973D9F4393FC67277	3DB755B3A9C5F18FE0694056E963504C59603244F11C801A72991E62CA219BC6
C:\Users\user\AppData\Local\Temp\~DFBADD8EC8FEBD51BA.TMP	data	3252CDAF94741DE42A0C2C0887F7B2AA	917057587119E9A2610A30B1F1538C94B99E6179	DBDD2E68C5A55AD1E178E0860709F5D0AB2205E30D8D0FF184B95D39DD820087

AV Detection:

Found malware configuration

Source: 00000006.00000003.368989675.0000000000900000.00000040.00000001.sdmp

Malware Configuration Extractor: Ursnif {"RSA Public Key": "ovNAU+HRorLZmwnDvbYFDY7UA+FTIAnF2uJSQd0M+N3ep6CVEhoDrEXACstP09QHK7cBl9nMAaFI1as0K4aXOQKngdScIQbDa3MQ98Ce9MYRMvxGUI05fSIRRFzMYffOXQr97vVUUUPjsYgfkDWS2eKPxSe5dz/pF0mjA0T8ibOLzHmVMs4vVv+nwVAw0xpD", "c2_domain": ["outlook.com", "auredosite.club", "vuredosite.club"], "botnet": "8877", "server": "12", "serpent_key": "30218409ILPAJDUR", "sleep_time": "10", "CONF_TIMEOUT": "20", "SetWaitableTimer_value": "0", "DGA_count": "10"}

Multi AV Scanner detection for submitted file

Source: 5.dll

Virustotal: Detection: 22%

Perma Link

Machine Learning detection for sample

Source: 5.dll

Joe Sandbox ML: detected

Compliance:

Uses 32bit PE files

Source: 5.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: 5.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Source:

Binary string: c:\393_Molecule\skin\depend\supply\Thick\Drive.pdb source: loaddll32.exe, rundll32.exe

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Source: Traffic	Snort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.5:49721 -> 40.97.116.82:80
Source: Traffic	Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.5:49721 -> 40.97.116.82:80

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 52.97.144.2 52.97.144.2
Source: Joe Sandbox View	IP Address: 40.97.116.82 40.97.116.82

Downloads files from webservers via HTTP

Source: global traffic

HTTP traffic detected: GET /grower/b1FUosZSinX/D_2FTo28i4eES3/o1nX6HvoNr7JCqEB2TBDy/3reac2cOKkFxPa3C/uHqcEARrcPcZDk3/M6E_2BTZS_2BVaLqj4/34AYxwikF/REm_2FMb1QNTSjBFb_2F/tvRFv4olV4RM6PFjWcs/Yxi4zCvrQiijB3JFDfkmao/_2Ff4LrwOirbu/dGY1O2o_/2BPYCJyNgelsd4Jc6x2/N.grow HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: outlook.comConnection: Keep-Alive

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: outlook.com

URLs found in memory or binary data

Source: ~DF3A99C7AD2702480D.TMP.24.dr, {BD6AF35E-DF4A-11EB-90E5-ECF4BB570DC9}.dat.24.dr	String found in binary or memory: https://outlook.office365.com/grower/GwIQZ7VTU_2B0dEDGXi3usO/98Jy_2Fhjs/9ADdwnOA_2BxxHdxk/bJ6tUkE3rK
Source: ~DFBADD8EC8FEBD51BA.TMP.24.dr, {BD6AF35C-DF4A-11EB-90E5-ECF4BB570DC9}.dat.24.dr	String found in binary or memory: https://outlook.office365.com/grower/b1FUosZSinX/D_2FTo28i4eES3/o1nX6HvoNr7JCqEB2TBDy/3reac2cOKkFxPa

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected Ursnif

Source: Yara match	File source: 00000003.00000003.451946137.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.452051043.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.496928044.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445570350.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.452023874.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.452000205.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445487547.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445636875.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445602533.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445524931.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.451869538.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.452038744.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.498068878.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445456909.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.451977445.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.451921011.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445424230.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445650161.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 452, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 2248, type: MEMORY

E-Banking Fraud:

Yara detected Ursnif

Source: Yara match	File source: 00000003.00000003.451946137.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.452051043.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.496928044.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445570350.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.452023874.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.452000205.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445487547.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445636875.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445602533.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445524931.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.451869538.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.452038744.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.498068878.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445456909.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.451977445.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.451921011.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445424230.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445650161.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 452, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 2248, type: MEMORY

System Summary:

Writes or reads registry keys via WMI

Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetStringValue
Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue

Writes registry values via WMI

Source: C:\Windows\System32\loaddll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\System32\loaddll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\System32\loaddll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue

Contains functionality to call native functions

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DDC1A44 NtMapViewOfSection,		0_2_6DDC1A44
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DDC1996 GetProcAddress,NtCreateSection,memset,		0_2_6DDC1996
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DDC23A5 NtQueryVirtualMemory,		0_2_6DDC23A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02A75A27 NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose,		3_2_02A75A27
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02A7B1A5 NtQueryVirtualMemory,		3_2_02A7B1A5

Detected potential crypto function

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DDC2184		0_2_6DDC2184
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DDE17B0		0_2_6DDE17B0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DDF05E5		0_2_6DDF05E5
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DDF0DB8		0_2_6DDF0DB8
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DDFBE61		0_2_6DDFBE61
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DDF4E00		0_2_6DDF4E00
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DE009C8		0_2_6DE009C8
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DDF88B7		0_2_6DDF88B7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02A7888E		3_2_02A7888E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02A73EE1		3_2_02A73EE1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02A7AF80		3_2_02A7AF80
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6DDE17B0		3_2_6DDE17B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6DDF05E5		3_2_6DDF05E5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6DDF0DB8		3_2_6DDF0DB8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6DDFBE61		3_2_6DDFBE61
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6DDF4E00		3_2_6DDF4E00
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6DE009C8		3_2_6DE009C8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6DDF88B7		3_2_6DDF88B7

Found potential string decryption / allocating functions

Source: C:\Windows\System32\loaddll32.exe	Code function: String function: 6DDF3290 appears 39 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6DDF3290 appears 39 times

Uses 32bit PE files

Source: 5.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Classification label

Source: classification engine

Classification label: mal84.troj.winDLL@18/7@6/5

Contains functionality to enum processes or threads

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_02A7A65C CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

3_2_02A7A65C

Creates files inside the user directory

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{BD6AF35A-DF4A-11EB-90E5-ECF4BB570DC9}.dat

Jump to behavior

Creates temporary files

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DF48F8DB99852E5824.TMP

Jump to behavior

Reads ini files

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Reads software policies

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Runs a DLL by calling functions

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\5.dll,Clockcondition

Sample is known by Antivirus

Source: 5.dll

Virustotal: Detection: 22%

Spawns processes

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\5.dll'
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\5.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\5.dll,Clockcondition
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\5.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\5.dll,Dogwhen
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\5.dll,Sing
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\5.dll,Wholegray
Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:1900 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:1900 CREDAT:17418 /prefetch:2
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\5.dll',#1			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\5.dll,Clockcondition			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\5.dll,Dogwhen			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\5.dll,Sing			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\5.dll,Wholegray			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\5.dll',#1			Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:1900 CREDAT:17410 /prefetch:2			Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:1900 CREDAT:17418 /prefetch:2			Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Windows\System32\loaddll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Found GUI installer (many successful clicks)

Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: 5.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Source:

Binary string: c:\393_Molecule\skin\depend\supply\Thick\Drive.pdb source: loaddll32.exe, rundll32.exe

Data Obfuscation:

Contains functionality to dynamically determine API calls

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6DDC1BAC LoadLibraryA,GetProcAddress,

0_2_6DDC1BAC

Uses code obfuscation techniques (call, push, ret)

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DDC2173 push ecx; ret		0_2_6DDC2183
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DDC2120 push ecx; ret		0_2_6DDC2129
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DDEDE07 push ecx; ret		0_2_6DDEDE1A
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DDF32D5 push ecx; ret		0_2_6DDF32E8
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DE1C347 push eax; ret		0_2_6DE1C3B1
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DE1C400 push eax; ret		0_2_6DE1C3B1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02A7E0C7 push cs; ret		3_2_02A7E0C8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02A7E458 push ds; retf		3_2_02A7E47A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02A7ABC0 push ecx; ret		3_2_02A7ABC9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02A7E163 push edx; iretd		3_2_02A7E164
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02A7AF6F push ecx; ret		3_2_02A7AF7F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6DDEDE07 push ecx; ret		3_2_6DDEDE1A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6DDF32D5 push ecx; ret		3_2_6DDF32E8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6DE1C400 push eax; ret		3_2_6DE1C3B1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6DE1C347 push eax; ret		3_2_6DE1C3B1

Sample is packed with UPX

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Hooking and other Techniques for Hiding and Protection:

Yara detected Ursnif

Source: Yara match	File source: 00000003.00000003.451946137.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.452051043.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.496928044.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445570350.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.452023874.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.452000205.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445487547.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445636875.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445602533.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445524931.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.451869538.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.452038744.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.498068878.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445456909.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.451977445.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.451921011.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445424230.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445650161.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 452, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 2248, type: MEMORY

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Windows\System32\loaddll32.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Disables application error messsages (SetErrorMode)

Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\SysWOW64\rundll32.exe

Last function: Thread delayed

Anti Debugging:

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6DDFAFAC RtlEncodePointer,RtlEncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,IsDebuggerPresent,OutputDebugStringW,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,

0_2_6DDFAFAC

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6DDFAFAC RtlEncodePointer,RtlEncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,IsDebuggerPresent,OutputDebugStringW,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,

0_2_6DDFAFAC

Contains functionality to dynamically determine API calls

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6DDC1BAC LoadLibraryA,GetProcAddress,

0_2_6DDC1BAC

Contains functionality to read the PEB

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DE1E2D8 mov eax, dword ptr fs:[00000030h]		0_2_6DE1E2D8
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DE1E207 mov eax, dword ptr fs:[00000030h]		0_2_6DE1E207
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DE1DE0E push dword ptr fs:[00000030h]		0_2_6DE1DE0E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6DE1E2D8 mov eax, dword ptr fs:[00000030h]		3_2_6DE1E2D8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6DE1E207 mov eax, dword ptr fs:[00000030h]		3_2_6DE1E207
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6DE1DE0E push dword ptr fs:[00000030h]		3_2_6DE1DE0E

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6DDF3484 GetProcessHeap,

0_2_6DDF3484

Contains functionality to register its own exception handler

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DDEFEBA SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6DDEFEBA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6DDEFEBA SetUnhandledExceptionFilter,UnhandledExceptionFilter,		3_2_6DDEFEBA

HIPS / PFW / Operating System Protection Evasion:

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\5.dll',#1

Jump to behavior

May try to detect the Windows Explorer process (often used for injection)

Source: loaddll32.exe, 00000000.00000002.496085670.0000000001330000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.497582493.0000000002E20000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: loaddll32.exe, 00000000.00000002.496085670.0000000001330000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.497582493.0000000002E20000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: loaddll32.exe, 00000000.00000002.496085670.0000000001330000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.497582493.0000000002E20000.00000002.00000001.sdmp	Binary or memory string: SProgram Managerl
Source: loaddll32.exe, 00000000.00000002.496085670.0000000001330000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.497582493.0000000002E20000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd,
Source: loaddll32.exe, 00000000.00000002.496085670.0000000001330000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.497582493.0000000002E20000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Contains functionality to query CPU information (cpuid)

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_02A79135 cpuid

3_2_02A79135

Contains functionality to query locales information (e.g. system language)

Source: C:\Windows\System32\loaddll32.exe	Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,__invoke_watson,_LcidFromHexString,GetLocaleInfoW,		0_2_6DDFEC14
Source: C:\Windows\System32\loaddll32.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,__invoke_watson,		0_2_6DDF2C5A
Source: C:\Windows\System32\loaddll32.exe	Code function: _memset,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,___crtDownlevelLCIDToLocaleName,___crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,__itow_s,		0_2_6DDFF468
Source: C:\Windows\System32\loaddll32.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,		0_2_6DDFEF45
Source: C:\Windows\System32\loaddll32.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,		0_2_6DDFEEC8
Source: C:\Windows\System32\loaddll32.exe	Code function: EnumSystemLocalesW,		0_2_6DDFEE88
Source: C:\Windows\System32\loaddll32.exe	Code function: EnumSystemLocalesW,		0_2_6DDF29A0
Source: C:\Windows\System32\loaddll32.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_memmove,_memmove,_memmove,_free,_free,_free,_free,_free,_free,_free,_free,_free,		0_2_6DDEE036
Source: C:\Windows\System32\loaddll32.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,		0_2_6DDFAB64
Source: C:\Windows\System32\loaddll32.exe	Code function: _wcscmp,_wcscmp,GetLocaleInfoW,GetLocaleInfoW,GetACP,		0_2_6DDFF2E7
Source: C:\Windows\System32\loaddll32.exe	Code function: GetLocaleInfoW,		0_2_6DDF2A26
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,__invoke_watson,		3_2_6DDF2C5A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,__invoke_watson,_LcidFromHexString,GetLocaleInfoW,		3_2_6DDFEC14
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,		3_2_6DDFD10F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _memset,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,___crtDownlevelLCIDToLocaleName,___crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,__itow_s,		3_2_6DDFF468
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage,		3_2_6DDFEFC8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,		3_2_6DDFEF45
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,		3_2_6DDFEEC8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,		3_2_6DDFEE88
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage,		3_2_6DDFF1BD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,		3_2_6DDF29A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_memmove,_memmove,_memmove,_free,_free,_free,_free,_free,_free,_free,_free,_free,		3_2_6DDEE036
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,		3_2_6DDFF394
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,		3_2_6DDFAB64
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free,		3_2_6DDFCB0D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _wcscmp,_wcscmp,GetLocaleInfoW,GetLocaleInfoW,GetACP,		3_2_6DDFF2E7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,		3_2_6DDF2A26

Contains functionality to query local / system time

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6DDC1ADA GetSystemTimeAsFileTime,_aulldiv,_snwprintf,CreateFileMappingW,GetLastError,GetLastError,MapViewOfFile,GetLastError,CloseHandle,GetLastError,

0_2_6DDC1ADA

Contains functionality to query the account / user name

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_02A79135 RtlAllocateHeap,GetUserNameW,RtlAllocateHeap,GetUserNameW,HeapFree,GetComputerNameW,GetComputerNameW,RtlAllocateHeap,GetComputerNameW,HeapFree,

3_2_02A79135

Contains functionality to query windows version

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6DDC1F0E CreateEventA,GetVersion,GetCurrentProcessId,OpenProcess,GetLastError,

0_2_6DDC1F0E

Stealing of Sensitive Information:

Yara detected Ursnif

Source: Yara match	File source: 00000003.00000003.451946137.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.452051043.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.496928044.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445570350.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.452023874.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.452000205.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445487547.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445636875.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445602533.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445524931.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.451869538.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.452038744.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.498068878.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445456909.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.451977445.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.451921011.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445424230.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445650161.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 452, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 2248, type: MEMORY

Remote Access Functionality:

Yara detected Ursnif

Source: Yara match	File source: 00000003.00000003.451946137.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.452051043.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.496928044.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445570350.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.452023874.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.452000205.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445487547.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445636875.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445602533.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445524931.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.451869538.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.452038744.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.498068878.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445456909.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.451977445.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.451921011.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445424230.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445650161.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 452, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 2248, type: MEMORY