Windows Analysis Report p47bG25tTf

ID:	480999
Product:	CloudBasic
Start time:	07:26:31
Start date:	10.09.2021
Sample:	p47bG25tTf
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	d0cb3af3f2f9bbb89faba16f41585e7c
SHA1:	3a1006610fc6e98670cfd6f01744e4623eeedd9b
SHA256:	31f5ee68e7548cd1d49720492502877466b35241cd441b48eefbddffc74a5475
Filetype:	Win32 Executable (generic) a (10002005/4) 99.96%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{54E1EBED-1243-11EC-90E5-ECF4BB2D2496}.dat	Microsoft Word Document	32F915F644D0303AD4FF52854EDAC775	8CC5C68DAC1423ED28DDC612A192F38D68A43D47	8A54441EA01342A6700F45E981FC505A9650BCEFF2DDEED9A30D131599F94544
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{7B4B21B1-1243-11EC-90E5-ECF4BB2D2496}.dat	Microsoft Word Document	DECDC9404C44D35851F7DF1F6DEAF5CD	F557C8E3E26C47AE01F3A8CB1DC5DD95F8730AF7	BE7BA463E72FA89F211B9C25E8302E278C541D637446F65F1113F0FA0A0AA3E6
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{54E1EBEF-1243-11EC-90E5-ECF4BB2D2496}.dat	Microsoft Word Document	4071FCD40650175D24DD5998725A6FFF	159412F8607724683B8DBAF4B57AE3F669A405E0	11D7FAF519AE6FA4463D0FC79FE2C3745BD061395D588CEF77BDEE0C57BB50F8
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{7B4B21B3-1243-11EC-90E5-ECF4BB2D2496}.dat	Microsoft Word Document	2FFE83F0271D9386F3A78653738CB2EA	A0760867AF5D35E5CCB87A642E00FBC30EE3079E	ADB941AEB59FBEEE861F3403FB29AF6D7081B1D0FF261EF4AB2AF2C019B915D2
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-17529550060\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	CBC2DB9A877E0D7C64FEDF2FECB7E10C	AAFA7ACE14E0D8723D5487F00A0B6B66228DB2BF	D22CFBDD19DCD996BFD62221786F4174525A6AEB1949A4653035A9FD5B928502
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-18270793970\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	D8636A8BAF043132CD3993B8447AC27C	B2859A643B39A88894AF321BAD5ED5C525C25B4B	FF5955446C17EF457442CD561F3228A67107215A955D654AD7DDD17488A68347
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-21706820\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	17CDBF7D4E0179CA4AFB71EBEC2671F9	18CFF5A64AAAA9AD1CB422EA9387FE326115BB86	797443ED0C8E86E29597EE7F7DC5AC59900D93C8915EC1F850DDED065522904B
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-4759708130\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	BA48D6130DEEDF0227A354C4FAAB69A9	C2368AD50B729A583EFA505C871B742B6FB24778	4904567132105BB5B50ABEA614EABDF44D10FCF7D51D42669995B81619AC3F67
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-6757900\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	1C9D261E74E0E31B53A779040773103F	22AC19A7151E5D2E4E77EA2DE137E5A26ED63B69	C36B97B0D3FC6134410DB9A66D273B0623C0C9AC747B6692E7A40022679357DA
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-8760897390\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	DFF76B7B695CDD42F920EB8619B8F0D1	B60BF03B2B24834A3F8AAB67AC8BC72751593F3B	0648EEF317FF46AE29DAB7B62F4800B8FBF8779FEF61A631EBA42C3B77530961
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20259167780\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	367253BEC154A52D863DAFDB0782AE08	46E0E37E012794458E8944FD1368CDF2C3A04409	B70893BDF4156FC4CD010110B8F6AA0F20F34651A645C63B61C7C7B751EF8753
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20332743330\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	ECCDFAE90D63FBF7231A68FE2FE4F8CB	BA789C2EA29A90550B41AEF00314BD6DBE7B8E43	8376C2D3BB4968F8DF6B9E8FC601AEF3B63348529F8B329AEDFEC640C70D4FE4
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin8215062560\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	38E9D1EA4A6D6DDE4FC0979F4D869994	6FD7424F9F9A0A3A751EF341DE4F0E1C36A11139	6C41EAA479E65C789C3E1A682BB87E41786D2253AA597B4D6EE230D6659E3F13
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\NewErrorPageTemplate[1]	UTF-8 Unicode (with BOM) text, with CRLF line terminators	DFEABDE84792228093A5A270352395B6	E41258C9576721025926326F76063C2305586F76	77B138AB5D0A90FF04648C26ADDD5E414CC178165E3B54A4CB3739DA0F58E075
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\down[1]	PNG image data, 15 x 15, 8-bit colormap, non-interlaced	C4F558C4C8B56858F15C09037CD6625A	EE497CC061D6A7A59BB66DEFEA65F9A8145BA240	39E7DE847C9F731EAA72338AD9053217B957859DE27B50B6474EC42971530781
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\errorPageStrings[1]	UTF-8 Unicode (with BOM) text, with CRLF line terminators	D65EC06F21C379C87040B83CC1ABAC6B	208D0A0BB775661758394BE7E4AFB18357E46C8B	A1270E90CEA31B46432EC44731BF4400D22B38EB2855326BF934FE8F1B169A4F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\NewErrorPageTemplate[1]	UTF-8 Unicode (with BOM) text, with CRLF line terminators	DFEABDE84792228093A5A270352395B6	E41258C9576721025926326F76063C2305586F76	77B138AB5D0A90FF04648C26ADDD5E414CC178165E3B54A4CB3739DA0F58E075
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\dnserror[1]	HTML document, UTF-8 Unicode (with BOM) text, with CRLF line terminators	2DC61EB461DA1436F5D22BCE51425660	E1B79BCAB0F073868079D807FAEC669596DC46C1	ACDEB4966289B6CE46ECC879531F85E9C6F94B718AAB521D38E2E00F7F7F7993
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\down[1]	PNG image data, 15 x 15, 8-bit colormap, non-interlaced	C4F558C4C8B56858F15C09037CD6625A	EE497CC061D6A7A59BB66DEFEA65F9A8145BA240	39E7DE847C9F731EAA72338AD9053217B957859DE27B50B6474EC42971530781
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\httpErrorPagesScripts[1]	UTF-8 Unicode (with BOM) text, with CRLF line terminators	9234071287E637F85D721463C488704C	CCA09B1E0FBA38BA29D3972ED8DCECEFDEF8C152	65CC039890C7CEB927CE40F6F199D74E49B8058C3F8A6E22E8F916AD90EA8649
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\dnserror[1]	HTML document, UTF-8 Unicode (with BOM) text, with CRLF line terminators	2DC61EB461DA1436F5D22BCE51425660	E1B79BCAB0F073868079D807FAEC669596DC46C1	ACDEB4966289B6CE46ECC879531F85E9C6F94B718AAB521D38E2E00F7F7F7993
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\errorPageStrings[1]	UTF-8 Unicode (with BOM) text, with CRLF line terminators	D65EC06F21C379C87040B83CC1ABAC6B	208D0A0BB775661758394BE7E4AFB18357E46C8B	A1270E90CEA31B46432EC44731BF4400D22B38EB2855326BF934FE8F1B169A4F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\httpErrorPagesScripts[1]	UTF-8 Unicode (with BOM) text, with CRLF line terminators	9234071287E637F85D721463C488704C	CCA09B1E0FBA38BA29D3972ED8DCECEFDEF8C152	65CC039890C7CEB927CE40F6F199D74E49B8058C3F8A6E22E8F916AD90EA8649
C:\Users\user\AppData\Local\Temp\JavaDeployReg.log	ASCII text, with CRLF line terminators	A2B7AD8390CE4353328431196B7C7E67	787E491F5EEE64CDDB1F9A46403D4D57571E8FAC	E9F8316B380EFB562E124FC3CEED78F7DC6C37DE52E9F42110A906FF0EC46D8E
C:\Users\user\AppData\Local\Temp\~DF173DAD1FEFCCC031.TMP	data	85A96C33A4D0D986D4695979A2893E2B	ADB7EF717CA0B73338A3E5CE3FF01FCB2BD59A8B	AA21F1D72887F021E816F98EE6DB74296226819752D3F6A7A39565883558DF09
C:\Users\user\AppData\Local\Temp\~DF29513E450399A0E6.TMP	data	B27950A47D3C84FA6E074FCBE1936C1A	2D764B05EC5F6FA90D85E664A468D994D3AA9789	CF25D8F1611843D169DE538A0B3D9E82DA2FFBF6C6F90BE7C5D519228076E209
C:\Users\user\AppData\Local\Temp\~DF904617D6CF584C8C.TMP	data	2EBD710925DF5B3DFE76C07D8F0DE84F	16977BBE653EC66C3D7BCB546214DC1DD1EBA0AA	7EDE8C824769552CE616FE3A0DDA3271FF9770D38BBC79AFE9F3D806F8161A03
C:\Users\user\AppData\Local\Temp\~DF9DEA79CED7C13093.TMP	data	F648059D56199311B49614A202316819	7FE1FE80D07EAC9350C4605CF5A1C7666DEBBD10	3441BF87926E7F7E2940E4010BCC6B4604F35703051757EAA603FB0AE8AEBA0E

AV Detection:

Multi AV Scanner detection for submitted file

Source: p47bG25tTf.exe	Virustotal: Detection: 14%			Perma Link
Source: p47bG25tTf.exe	ReversingLabs: Detection: 17%

Multi AV Scanner detection for domain / URL

Source: haverit.xyz

Virustotal: Detection: 5%

Perma Link

Machine Learning detection for sample

Source: p47bG25tTf.exe

Joe Sandbox ML: detected

Antivirus or Machine Learning detection for unpacked file

Source: 0.3.p47bG25tTf.exe.db9d7c.0.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.2.p47bG25tTf.exe.1000000.0.unpack	Avira: Label: TR/Crypt.XPACK.Gen7

Compliance:

Uses 32bit PE files

Source: p47bG25tTf.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Binary contains paths to debug symbols

Source:

Binary string: c:\Muchwin\WorkWhich\centstring\shinegray\WanthumanMarket.pdb source: p47bG25tTf.exe

Networking:

Performs DNS queries to domains with low reputation

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	DNS query: haverit.xyz
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	DNS query: haverit.xyz
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	DNS query: haverit.xyz
Source: C:\Users\user\Desktop\p47bG25tTf.exe	DNS query: haverit.xyz
Source: C:\Users\user\Desktop\p47bG25tTf.exe	DNS query: haverit.xyz
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	DNS query: haverit.xyz
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	DNS query: haverit.xyz
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	DNS query: haverit.xyz

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Source: unknown

DNS traffic detected: query: haverit.xyz replaycode: Name error (3)

Found strings which match to known social media urls

Source: msapplication.xml0.8.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x2a9b72c5,0x01d7a650</date><accdate>0x2a9b72c5,0x01d7a650</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml0.8.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x2a9b72c5,0x01d7a650</date><accdate>0x2a9b72c5,0x01d7a650</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml5.8.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x2aa299ee,0x01d7a650</date><accdate>0x2aa299ee,0x01d7a650</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml5.8.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x2aa299ee,0x01d7a650</date><accdate>0x2aa299ee,0x01d7a650</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml7.8.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x2aaa0d44,0x01d7a650</date><accdate>0x2aaa0d44,0x01d7a650</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: msapplication.xml7.8.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x2aaa0d44,0x01d7a650</date><accdate>0x2aaa0d44,0x01d7a650</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)

URLs found in memory or binary data

Source: p47bG25tTf.exe, 00000000.00000003.412774183.0000000003750000.00000004.00000040.sdmp	String found in binary or memory: http://%s=%s&file://&os=%u.%u_%u_%u_x%uindex.html;
Source: p47bG25tTf.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: p47bG25tTf.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: p47bG25tTf.exe	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: p47bG25tTf.exe	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: p47bG25tTf.exe	String found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
Source: p47bG25tTf.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: p47bG25tTf.exe	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: p47bG25tTf.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: p47bG25tTf.exe	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: p47bG25tTf.exe	String found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
Source: p47bG25tTf.exe	String found in binary or memory: http://ocsp.comodoca.com0
Source: p47bG25tTf.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: p47bG25tTf.exe	String found in binary or memory: http://ocsp.digicert.com0O
Source: p47bG25tTf.exe	String found in binary or memory: http://ocsp.sectigo.com0
Source: msapplication.xml.8.dr	String found in binary or memory: http://www.amazon.com/
Source: p47bG25tTf.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: msapplication.xml1.8.dr	String found in binary or memory: http://www.google.com/
Source: msapplication.xml2.8.dr	String found in binary or memory: http://www.live.com/
Source: msapplication.xml3.8.dr	String found in binary or memory: http://www.nytimes.com/
Source: msapplication.xml4.8.dr	String found in binary or memory: http://www.reddit.com/
Source: msapplication.xml5.8.dr	String found in binary or memory: http://www.twitter.com/
Source: msapplication.xml6.8.dr	String found in binary or memory: http://www.wikipedia.com/
Source: msapplication.xml7.8.dr	String found in binary or memory: http://www.youtube.com/
Source: p47bG25tTf.exe	String found in binary or memory: https://haverit.xyz
Source: ~DF29513E450399A0E6.TMP.21.dr	String found in binary or memory: https://haverit.xyz/index.htm
Source: {7B4B21B3-1243-11EC-90E5-ECF4BB2D2496}.dat.21.dr	String found in binary or memory: https://haverit.xyz/index.htmRoot
Source: {7B4B21B3-1243-11EC-90E5-ECF4BB2D2496}.dat.21.dr	String found in binary or memory: https://haverit.xyz/index.htmdex.htm
Source: p47bG25tTf.exe	String found in binary or memory: https://sectigo.com/CPS0
Source: p47bG25tTf.exe	String found in binary or memory: https://www.digicert.com/CPS0

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: haverit.xyz

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected Ursnif

Source: Yara match	File source: 0.2.p47bG25tTf.exe.1000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.p47bG25tTf.exe.db9d7c.0.raw.unpack, type: UNPACKEDPE

Yara detected Ursnif

Source: Yara match	File source: 00000000.00000002.631812823.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.411680498.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412285957.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.411095451.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412774183.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412569620.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.411978196.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.411758460.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412426058.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412785825.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.411605521.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412680066.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412607752.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412384175.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412743237.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.411442677.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.411526814.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.411908339.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412640219.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.410999353.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412334976.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.411184929.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412120238.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412463340.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412538373.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.411360711.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412177885.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.411273329.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412722714.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412702712.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412499004.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.411834632.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412228113.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: p47bG25tTf.exe PID: 6576, type: MEMORYSTR

E-Banking Fraud:

Yara detected Ursnif

Source: Yara match	File source: 0.2.p47bG25tTf.exe.1000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.p47bG25tTf.exe.db9d7c.0.raw.unpack, type: UNPACKEDPE

Yara detected Ursnif

Source: Yara match	File source: 00000000.00000002.631812823.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.411680498.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412285957.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.411095451.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412774183.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412569620.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.411978196.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.411758460.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412426058.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412785825.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.411605521.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412680066.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412607752.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412384175.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412743237.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.411442677.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.411526814.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.411908339.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412640219.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.410999353.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412334976.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.411184929.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412120238.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412463340.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412538373.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.411360711.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412177885.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.411273329.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412722714.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412702712.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412499004.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.411834632.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412228113.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: p47bG25tTf.exe PID: 6576, type: MEMORYSTR

System Summary:

Writes or reads registry keys via WMI

Source: C:\Users\user\Desktop\p47bG25tTf.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetDWORDValue
Source: C:\Users\user\Desktop\p47bG25tTf.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Users\user\Desktop\p47bG25tTf.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Users\user\Desktop\p47bG25tTf.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Users\user\Desktop\p47bG25tTf.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Users\user\Desktop\p47bG25tTf.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue

Writes registry values via WMI

Source: C:\Users\user\Desktop\p47bG25tTf.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Users\user\Desktop\p47bG25tTf.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Users\user\Desktop\p47bG25tTf.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Users\user\Desktop\p47bG25tTf.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Users\user\Desktop\p47bG25tTf.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue

Uses 32bit PE files

Source: p47bG25tTf.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

PE file contains strange resources

Source: p47bG25tTf.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: p47bG25tTf.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

PE / OLE file has an invalid certificate

Source: p47bG25tTf.exe

Static PE information: invalid certificate

Sample is known by Antivirus

Source: p47bG25tTf.exe	Virustotal: Detection: 14%
Source: p47bG25tTf.exe	ReversingLabs: Detection: 17%

PE file has an executable .text section and no other executable section

Source: p47bG25tTf.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads software policies

Source: C:\Users\user\Desktop\p47bG25tTf.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Users\user\Desktop\p47bG25tTf.exe 'C:\Users\user\Desktop\p47bG25tTf.exe'
Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5348 CREDAT:17410 /prefetch:2
Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:2584 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5348 CREDAT:17410 /prefetch:2			Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:2584 CREDAT:17410 /prefetch:2			Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Users\user\Desktop\p47bG25tTf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\InprocServer32

Jump to behavior

Creates mutexes

Source: C:\Users\user\Desktop\p47bG25tTf.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\1978EE24-ED7A-8F95-C655-46BAE5CC03A0

Queries process information (via WMI, Win32_Process)

Source: C:\Users\user\Desktop\p47bG25tTf.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : select * from win32_process

Creates files inside the user directory

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{54E1EBED-1243-11EC-90E5-ECF4BB2D2496}.dat

Jump to behavior

Creates temporary files

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DF9DEA79CED7C13093.TMP

Jump to behavior

Classification label

Source: classification engine

Classification label: mal96.troj.evad.winEXE@7/29@8/0

Reads ini files

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Reads the hosts file

Source: C:\Users\user\Desktop\p47bG25tTf.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\p47bG25tTf.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

PE file contains a mix of data directories often seen in goodware

Source: p47bG25tTf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: p47bG25tTf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: p47bG25tTf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: p47bG25tTf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: p47bG25tTf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: p47bG25tTf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

PE file contains a debug data directory

Source: p47bG25tTf.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Binary contains paths to debug symbols

Source:

Binary string: c:\Muchwin\WorkWhich\centstring\shinegray\WanthumanMarket.pdb source: p47bG25tTf.exe

PE file contains a valid data directory to section mapping

Source: p47bG25tTf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: p47bG25tTf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: p47bG25tTf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: p47bG25tTf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: p47bG25tTf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation:

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\p47bG25tTf.exe

Unpacked PE file: 0.2.p47bG25tTf.exe.1000000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.bss:W;.reloc:R;

PE file contains an invalid checksum

Source: p47bG25tTf.exe

Static PE information: real checksum: 0xdbfab should be: 0xdee02

Binary may include packed or encrypted code

Source: initial sample

Static PE information: section name: .text entropy: 6.85140338901

Hooking and other Techniques for Hiding and Protection:

Yara detected Ursnif

Source: Yara match	File source: 0.2.p47bG25tTf.exe.1000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.p47bG25tTf.exe.db9d7c.0.raw.unpack, type: UNPACKEDPE

Yara detected Ursnif

Source: Yara match	File source: 00000000.00000002.631812823.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.411680498.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412285957.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.411095451.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412774183.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412569620.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.411978196.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.411758460.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412426058.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412785825.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.411605521.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412680066.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412607752.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412384175.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412743237.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.411442677.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.411526814.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.411908339.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412640219.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.410999353.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412334976.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.411184929.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412120238.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412463340.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412538373.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.411360711.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412177885.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.411273329.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412722714.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412702712.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412499004.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.411834632.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412228113.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: p47bG25tTf.exe PID: 6576, type: MEMORYSTR

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Users\user\Desktop\p47bG25tTf.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Malware Analysis System Evasion:

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\Desktop\p47bG25tTf.exe TID: 5992

Thread sleep time: -60000s >= -30000s

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

May try to detect the Windows Explorer process (often used for injection)

Source: p47bG25tTf.exe, 00000000.00000002.631733193.0000000001100000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: p47bG25tTf.exe, 00000000.00000002.631733193.0000000001100000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: p47bG25tTf.exe, 00000000.00000002.631733193.0000000001100000.00000002.00020000.sdmp	Binary or memory string: &Program Manager
Source: p47bG25tTf.exe, 00000000.00000002.631733193.0000000001100000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Queries the cryptographic machine GUID

Source: C:\Users\user\Desktop\p47bG25tTf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings:

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Source: C:\Users\user\Desktop\p47bG25tTf.exe

WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antispywareproduct

Stealing of Sensitive Information:

Yara detected Ursnif

Source: Yara match	File source: 0.2.p47bG25tTf.exe.1000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.p47bG25tTf.exe.db9d7c.0.raw.unpack, type: UNPACKEDPE

Yara detected Ursnif

Source: Yara match	File source: 00000000.00000002.631812823.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.411680498.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412285957.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.411095451.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412774183.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412569620.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.411978196.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.411758460.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412426058.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412785825.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.411605521.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412680066.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412607752.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412384175.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412743237.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.411442677.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.411526814.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.411908339.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412640219.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.410999353.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412334976.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.411184929.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412120238.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412463340.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412538373.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.411360711.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412177885.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.411273329.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412722714.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412702712.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412499004.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.411834632.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412228113.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: p47bG25tTf.exe PID: 6576, type: MEMORYSTR

Remote Access Functionality:

Yara detected Ursnif

Source: Yara match	File source: 0.2.p47bG25tTf.exe.1000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.p47bG25tTf.exe.db9d7c.0.raw.unpack, type: UNPACKEDPE

Yara detected Ursnif

Source: Yara match	File source: 00000000.00000002.631812823.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.411680498.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412285957.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.411095451.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412774183.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412569620.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.411978196.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.411758460.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412426058.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412785825.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.411605521.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412680066.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412607752.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412384175.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412743237.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.411442677.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.411526814.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.411908339.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412640219.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.410999353.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412334976.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.411184929.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412120238.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412463340.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412538373.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.411360711.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412177885.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.411273329.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412722714.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412702712.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412499004.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.411834632.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.412228113.0000000003750000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: p47bG25tTf.exe PID: 6576, type: MEMORYSTR