Windows Analysis Report 0f.dll

ID:	498857
Product:	CloudBasic
Start time:	15:51:49
Start date:	07.10.2021
Sample:	0f.dll
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	0f90b21a2cdc35511626509c67c8cbf5
SHA1:	1293aa454365b3679afd77b34749ce8e175c997a
SHA256:	95dbbfc33223e8e670b4f25d086d65a41d67f0434d3fe37469a7bd23e134f1f6
Filetype:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{C5D724C1-27C1-11EC-90E9-ECF4BB862DED}.dat	Microsoft Word Document	94F9B5C28E9B149EB46ADF9F2AEF671C	D980F86F0CB9D559D4511FE48DF6DC551FA7EE8E	18C6860293D7ED805DAE18A5C77E6B816ECF9C7952B6588E2E5278CCA7E9B7BB
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{C5D724C3-27C1-11EC-90E9-ECF4BB862DED}.dat	Microsoft Word Document	AEB3A15AEDBCF9FB5FA5B95E2DEB6649	ECFA0B9E79EE11ACA8CB3E5D5A3650CEC7471C19	0FD03A33686DDBC1905354E97A0449F8E2937910F7C545F13F55FDBA1F0D5099
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-17529550060\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	DC395B2AEFBEDD9A677BD175271E1437	878FD1F33DF98EF507658F2A95279CC4ED1B7539	9FDD3722C364EE0FB6936FA96D61709E1C800150A8C22B43760D1D0250D1181B
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-18270793970\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	B75797E660E655043C9F8ABB4B4D25B6	E726052E9AB9C4C81B05049B04E399017A0C512E	D6477BBF5E39AA393F596BBD590C2977F5652E08AF0C78F557E8CC788CF13858
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-21706820\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	2544FD05527C054C8DF3BA23EE41EC7B	E831E81CC7D44B0136DCDB28B43D205F7ACB2373	B01039E1F635638B2F6EA1E9A71206D07523634A4F7320C9BCA1CBBAAB1EA218
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-4759708130\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	E0B40BCD3C29E9C1843BBF53A62255A3	E4ACD05178FA797D64DBF9E4C97BF38D9995F726	30E079AA2536B1FDE438410443824E67DA7996D7B788BA171191004E96666421
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-6757900\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	2A79317507DCC843A39E305AF8AFDE32	70A060E42DCFA217398616C5745D15446B2505C1	AF625B0D3CDA31324047ED4ABC78F4B15C73AFA5E26082A7164196A30BEBD9DE
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-8760897390\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	BE0E56E5768CB1791890ED689C01B1BE	3A1A25EAC0B613D8EA41AD6DA0130FEBBDD2DFE4	DC668F7C29E2F40537610A5D7D7FC3C77F6E6DDED2657488D35880B946703D7A
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20259167780\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	F74D7428F32B2F62DE287ACC75B6D49A	BFA99A67ECC10AC006FAB791E7F97147458C66F4	DE3EE199535C258A56FDB933EE6665804B4207B36D88EFA7ED3DCAF8449BD1B6
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20332743330\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	0B59888F018D85C6AF868C51B39B0603	3F61342FFB6A4D827187B09D6E013CB480889FAA	0008F44CA9738270DFFF72E1FF1ED004C5DDE062A4A430E94CEF86F8F2F72DB2
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin8215062560\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	C0CECA743047E53995B308329C42B758	80F5FA1AB8CF709D2DEA1DDE221C9F5AB9656F0C	B1BB9FE8C5741A24D45511004CEA2B082CA438DB2B8028777E6A640E86313A0F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\NewErrorPageTemplate[1]	UTF-8 Unicode (with BOM) text, with CRLF line terminators	DFEABDE84792228093A5A270352395B6	E41258C9576721025926326F76063C2305586F76	77B138AB5D0A90FF04648C26ADDD5E414CC178165E3B54A4CB3739DA0F58E075
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\down[1]	PNG image data, 15 x 15, 8-bit colormap, non-interlaced	C4F558C4C8B56858F15C09037CD6625A	EE497CC061D6A7A59BB66DEFEA65F9A8145BA240	39E7DE847C9F731EAA72338AD9053217B957859DE27B50B6474EC42971530781
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\dnserror[1]	HTML document, UTF-8 Unicode (with BOM) text, with CRLF line terminators	2DC61EB461DA1436F5D22BCE51425660	E1B79BCAB0F073868079D807FAEC669596DC46C1	ACDEB4966289B6CE46ECC879531F85E9C6F94B718AAB521D38E2E00F7F7F7993
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\errorPageStrings[1]	UTF-8 Unicode (with BOM) text, with CRLF line terminators	D65EC06F21C379C87040B83CC1ABAC6B	208D0A0BB775661758394BE7E4AFB18357E46C8B	A1270E90CEA31B46432EC44731BF4400D22B38EB2855326BF934FE8F1B169A4F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\httpErrorPagesScripts[1]	UTF-8 Unicode (with BOM) text, with CRLF line terminators	9234071287E637F85D721463C488704C	CCA09B1E0FBA38BA29D3972ED8DCECEFDEF8C152	65CC039890C7CEB927CE40F6F199D74E49B8058C3F8A6E22E8F916AD90EA8649
C:\Users\user\AppData\Local\Temp\JavaDeployReg.log	ASCII text, with CRLF line terminators	96CE80CB02C302A441DE74AF8A06EED5	3AC02A600B79AF8ABAFD5C57CC1A996915FC21FC	48026BED77C076952F9F5AC2FAC05B4840EBABC3D4F26E23424CF27ED1E9D87C
C:\Users\user\AppData\Local\Temp\~DFA1D11EC49A94A948.TMP	data	A10F00C96C90A98D5AD726F315D7E8EC	DDC4214284F24081022316EAB9A06F30D7F20A33	5CD7342F83768F33EC03EED2017C885D7AF4D2C88F569514BAA896D409935B37
C:\Users\user\AppData\Local\Temp\~DFCB4F6EF3903B6C34.TMP	data	C93DA6F6188C47D44D61BA6CE2A636FE	A88F5F64B15D7C3D192BEA14E7273C0B82F48F74	96CB17E675B019E40C198AA6F29DDF5BA747FA6F36916D120E963A61B48D675F

AV Detection:

Antivirus / Scanner detection for submitted sample

Source: 0f.dll

Avira: detected

Found malware configuration

Source: 1.2.loaddll32.exe.38f94a0.3.raw.unpack

Malware Configuration Extractor: Ursnif {"RSA Public Key": "YspyHla3Q+Y+mL+jkDMPo0K37HDx3ZQpkC6iMQ9FB0Jvz67qLEuPPd+7itRbk+5jPXxEvcc4HELzBbK+zEpcnk3gfkFepE47XU1UkIqwsz5EFKG4uDfy9jLX4cSD4IKUeWVT2AmhhkhIjXebeVqL2cavKIWzE+O11PlMSJB8CPxu3rcoXlZgOw7DYBYyTHdQlEkgzTqDwlIzW3bdSDtO0jlb1GqIU5jAVZj0nusFmwufXbMRHKThAuzV0SiB8H0jceNWGALcy01VeCV7PJrnPe8wCvy64gODn28q2topDihJ51KGWbMNR5jWjFp/LTmfqJ9+UqlA3XrMm4Ht2D3DJEE72pdtZyqrd+EuqZEvdjw=", "c2_domain": ["app5.folion.xyz", "wer.defone.click", "app10.laptok.at", "apt.feel500.at", "init.in100k.at"], "botnet": "2500", "server": "580", "serpent_key": "lOrlLLFRkSMi2UOq", "sleep_time": "10", "CONF_TIMEOUT": "20", "SetWaitableTimer_value": "10"}

Multi AV Scanner detection for submitted file

Source: 0f.dll	Metadefender: Detection: 24%			Perma Link
Source: 0f.dll	ReversingLabs: Detection: 78%

Machine Learning detection for sample

Source: 0f.dll

Joe Sandbox ML: detected

Antivirus or Machine Learning detection for unpacked file

Source: 5.2.rundll32.exe.10000000.2.unpack	Avira: Label: TR/Crypt.XPACK.Gen8
Source: 1.2.loaddll32.exe.10000000.4.unpack	Avira: Label: TR/Crypt.XPACK.Gen8

Cryptography:

Uses Microsoft's Enhanced Cryptographic Provider

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_00F935A1 CryptAcquireContextW,memcpy,CryptImportKey,CryptSetKeyParam,memcpy,CryptEncrypt,CryptDecrypt,GetLastError,GetLastError,CryptDestroyKey,GetLastError,CryptReleaseContext,GetLastError,

1_2_00F935A1

Compliance:

Uses 32bit PE files

Source: 0f.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Spreading:

Contains functionality to enumerate / list files inside a directory

Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00F94E9C Wow64EnableWow64FsRedirection,RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,memset,CreateFileA,GetFileTime,CloseHandle,StrRChrA,lstrcat,FindFirstFileA,FindFirstFileA,CompareFileTime,CompareFileTime,FindClose,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,StrChrA,memcpy,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,FindClose,HeapFree,HeapFree,		1_2_00F94E9C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_01374E9C Wow64EnableWow64FsRedirection,RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,memset,CreateFileA,GetFileTime,CloseHandle,StrRChrA,lstrcat,FindFirstFileA,FindFirstFileA,CompareFileTime,CompareFileTime,FindClose,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,StrChrA,memcpy,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,FindClose,HeapFree,HeapFree,		4_2_01374E9C

Networking:

Performs DNS queries to domains with low reputation

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	DNS query: app5.folion.xyz
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	DNS query: app5.folion.xyz
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	DNS query: app5.folion.xyz

Found strings which match to known social media urls

Source: msapplication.xml0.19.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x9b482054,0x01d7bbce</date><accdate>0x9b482054,0x01d7bbce</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml0.19.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x9b482054,0x01d7bbce</date><accdate>0x9b482054,0x01d7bbce</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml5.19.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x9b4f4795,0x01d7bbce</date><accdate>0x9b4f4795,0x01d7bbce</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml5.19.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x9b4f4795,0x01d7bbce</date><accdate>0x9b4f4795,0x01d7bbce</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml7.19.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x9b566f66,0x01d7bbce</date><accdate>0x9b566f66,0x01d7bbce</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: msapplication.xml7.19.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x9b566f66,0x01d7bbce</date><accdate>0x9b566f66,0x01d7bbce</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)

URLs found in memory or binary data

Source: loaddll32.exe, 00000001.00000002.810736280.000000000119B000.00000004.00000020.sdmp	String found in binary or memory: http://app5.folion.xyz
Source: {C5D724C3-27C1-11EC-90E9-ECF4BB862DED}.dat.19.dr	String found in binary or memory: http://app5.folion.xyz/C6VmqHmn62rFCww6y4ysR/P0nI5lbrE_2FoyZm/BDBmvveWjO3LK9Q/55XxQq6CmCPdNvBaEz/m5n
Source: msapplication.xml.19.dr	String found in binary or memory: http://www.amazon.com/
Source: msapplication.xml1.19.dr	String found in binary or memory: http://www.google.com/
Source: msapplication.xml2.19.dr	String found in binary or memory: http://www.live.com/
Source: msapplication.xml3.19.dr	String found in binary or memory: http://www.nytimes.com/
Source: msapplication.xml4.19.dr	String found in binary or memory: http://www.reddit.com/
Source: msapplication.xml5.19.dr	String found in binary or memory: http://www.twitter.com/
Source: msapplication.xml6.19.dr	String found in binary or memory: http://www.wikipedia.com/
Source: msapplication.xml7.19.dr	String found in binary or memory: http://www.youtube.com/

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: app5.folion.xyz

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected Ursnif

Source: Yara match	File source: 00000001.00000003.739535676.00000000040A8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.739521647.00000000040A8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.739458564.00000000040A8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.739502896.00000000040A8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.739363916.00000000040A8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.813265596.00000000040A8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.739321134.00000000040A8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.739404580.00000000040A8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.739481698.00000000040A8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 5268, type: MEMORYSTR
Source: Yara match	File source: 1.2.loaddll32.exe.38f94a0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.10000000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.f60000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.38f94a0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.11f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.1370000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.rundll32.exe.5bb94a0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.10000000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.a30000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.f90000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.rundll32.exe.5bb94a0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000003.706311406.0000000005BB9000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.706735766.00000000011F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.809626071.0000000000A30000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.813125689.00000000038F9000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.810063319.0000000000F60000.00000004.00000001.sdmp, type: MEMORY

Creates a DirectInput object (often for capturing keystrokes)

Source: loaddll32.exe, 00000001.00000002.810736280.000000000119B000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

Yara detected Ursnif

Source: Yara match	File source: 00000001.00000003.739535676.00000000040A8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.739521647.00000000040A8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.739458564.00000000040A8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.739502896.00000000040A8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.739363916.00000000040A8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.813265596.00000000040A8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.739321134.00000000040A8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.739404580.00000000040A8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.739481698.00000000040A8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 5268, type: MEMORYSTR
Source: Yara match	File source: 1.2.loaddll32.exe.38f94a0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.10000000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.f60000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.38f94a0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.11f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.1370000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.rundll32.exe.5bb94a0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.10000000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.a30000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.f90000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.rundll32.exe.5bb94a0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000003.706311406.0000000005BB9000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.706735766.00000000011F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.809626071.0000000000A30000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.813125689.00000000038F9000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.810063319.0000000000F60000.00000004.00000001.sdmp, type: MEMORY

Spam, unwanted Advertisements and Ransom Demands:

Contains functionality to import cryptographic keys (often used in ransomware)

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_00F935A1 CryptAcquireContextW,memcpy,CryptImportKey,CryptSetKeyParam,memcpy,CryptEncrypt,CryptDecrypt,GetLastError,GetLastError,CryptDestroyKey,GetLastError,CryptReleaseContext,GetLastError,

1_2_00F935A1

System Summary:

Writes or reads registry keys via WMI

Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetStringValue
Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue

Writes registry values via WMI

Source: C:\Windows\System32\loaddll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\System32\loaddll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\System32\loaddll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue

Uses 32bit PE files

Source: 0f.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Detected potential crypto function

Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_02E9810A		1_2_02E9810A
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_10002264		1_2_10002264
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00F96609		1_2_00F96609
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00F97FA8		1_2_00F97FA8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0515810A		4_2_0515810A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_01377FA8		4_2_01377FA8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_01376609		4_2_01376609
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF9305		5_2_04AF9305
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF1000		5_2_04AF1000
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF3F1C		5_2_04AF3F1C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF3AAF		5_2_04AF3AAF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF33AA		5_2_04AF33AA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AFBDAA		5_2_04AFBDAA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AFB4AA		5_2_04AFB4AA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AFA6BB		5_2_04AFA6BB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF59E4		5_2_04AF59E4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AFA4FC		5_2_04AFA4FC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF1BF7		5_2_04AF1BF7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF7FF1		5_2_04AF7FF1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF21C0		5_2_04AF21C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AFA3DD		5_2_04AFA3DD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF75DC		5_2_04AF75DC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF2E21		5_2_04AF2E21
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF810A		5_2_04AF810A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF2D03		5_2_04AF2D03
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AFC217		5_2_04AFC217
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF204B		5_2_04AF204B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF2F59		5_2_04AF2F59
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF1458		5_2_04AF1458
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AFA257		5_2_04AFA257
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF1556		5_2_04AF1556
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10002264		5_2_10002264

Contains functionality to call native functions

Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_10001B89 NtMapViewOfSection,		1_2_10001B89
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_100018D1 GetProcAddress,NtCreateSection,memset,		1_2_100018D1
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_10002485 NtQueryVirtualMemory,		1_2_10002485
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00F93CA1 NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose,		1_2_00F93CA1
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00F981CD NtQueryVirtualMemory,		1_2_00F981CD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_01373CA1 NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose,		4_2_01373CA1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_013781CD NtQueryVirtualMemory,		4_2_013781CD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10002485 NtQueryVirtualMemory,		5_2_10002485

Sample is known by Antivirus

Source: 0f.dll	Metadefender: Detection: 24%
Source: 0f.dll	ReversingLabs: Detection: 78%

Reads software policies

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Contains functionality to enum processes or threads

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_00F919E7 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

1_2_00F919E7

Runs a DLL by calling functions

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\0f.dll,Start

Spawns processes

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\0f.dll'
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\0f.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\0f.dll,Start
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\0f.dll',#1
Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:2988 CREDAT:17410 /prefetch:2
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\0f.dll',#1			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\0f.dll,Start			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\0f.dll',#1			Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:2988 CREDAT:17410 /prefetch:2			Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Windows\System32\loaddll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Creates files inside the user directory

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High

Jump to behavior

Creates temporary files

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DFCB4F6EF3903B6C34.TMP

Jump to behavior

Classification label

Source: classification engine

Classification label: mal96.troj.winDLL@10/19@3/0

Reads ini files

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Data Obfuscation:

Uses code obfuscation techniques (call, push, ret)

Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_02E9810A push ebp; mov dword ptr [esp], FFFF0000h		1_2_02E98113
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_02E9810A push dword ptr [ebp-04h]; mov dword ptr [esp], eax		1_2_02E99137
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_02E9810A push dword ptr [ebp-0Ch]; mov dword ptr [esp], ecx		1_2_02E991AC
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_02E9810A push dword ptr [ebp-04h]; mov dword ptr [esp], esp		1_2_02E991E2
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_02E9810A push esi; mov dword ptr [esp], 000FFFFFh		1_2_02E99204
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_02E9810A push 00000000h; mov dword ptr [esp], esi		1_2_02E99293
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_02E95B06 push 00000000h; mov dword ptr [esp], ebp		1_2_02E95B45
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_02E95B06 push edi; mov dword ptr [esp], 00000003h		1_2_02E95B69
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_02E95B06 push ebx; mov dword ptr [esp], 00F00000h		1_2_02E95B72
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_10002200 push ecx; ret		1_2_10002209
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_10002253 push ecx; ret		1_2_10002263
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00F9A2D8 pushad ; iretd		1_2_00F9A2D9
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00F9A2D4 pushad ; iretd		1_2_00F9A2D9
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00F9A294 pushad ; iretd		1_2_00F9A2D9
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00F9B67C push ss; retf		1_2_00F9B690
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00F97C20 push ecx; ret		1_2_00F97C29
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00F97F97 push ecx; ret		1_2_00F97FA7
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00F9A169 pushad ; iretd		1_2_00F9A2D9
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00F9B163 push edx; iretd		1_2_00F9B164
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_05155B06 push 00000000h; mov dword ptr [esp], ebp		4_2_05155B45
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_05155B06 push edi; mov dword ptr [esp], 00000003h		4_2_05155B69
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_05155B06 push ebx; mov dword ptr [esp], 00F00000h		4_2_05155B72
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0515810A push ebp; mov dword ptr [esp], FFFF0000h		4_2_05158113
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0515810A push dword ptr [ebp-04h]; mov dword ptr [esp], eax		4_2_05159137
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0515810A push dword ptr [ebp-0Ch]; mov dword ptr [esp], ecx		4_2_051591AC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0515810A push dword ptr [ebp-04h]; mov dword ptr [esp], esp		4_2_051591E2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0515810A push esi; mov dword ptr [esp], 000FFFFFh		4_2_05159204
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0515810A push 00000000h; mov dword ptr [esp], esi		4_2_05159293
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0137B163 push edx; iretd		4_2_0137B164
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_01377F97 push ecx; ret		4_2_01377FA7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_01377C20 push ecx; ret		4_2_01377C29

PE file contains sections with non-standard names

Source: 0f.dll

Static PE information: section name: .code

Contains functionality to dynamically determine API calls

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_10001F31 LoadLibraryA,GetProcAddress,

1_2_10001F31

Hooking and other Techniques for Hiding and Protection:

Yara detected Ursnif

Source: Yara match	File source: 00000001.00000003.739535676.00000000040A8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.739521647.00000000040A8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.739458564.00000000040A8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.739502896.00000000040A8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.739363916.00000000040A8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.813265596.00000000040A8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.739321134.00000000040A8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.739404580.00000000040A8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.739481698.00000000040A8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 5268, type: MEMORYSTR
Source: Yara match	File source: 1.2.loaddll32.exe.38f94a0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.10000000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.f60000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.38f94a0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.11f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.1370000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.rundll32.exe.5bb94a0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.10000000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.a30000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.f90000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.rundll32.exe.5bb94a0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000003.706311406.0000000005BB9000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.706735766.00000000011F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.809626071.0000000000A30000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.813125689.00000000038F9000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.810063319.0000000000F60000.00000004.00000001.sdmp, type: MEMORY

Disables application error messsages (SetErrorMode)

Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\System32\loaddll32.exe

Last function: Thread delayed

Contains functionality to enumerate / list files inside a directory

Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00F94E9C Wow64EnableWow64FsRedirection,RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,memset,CreateFileA,GetFileTime,CloseHandle,StrRChrA,lstrcat,FindFirstFileA,FindFirstFileA,CompareFileTime,CompareFileTime,FindClose,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,StrChrA,memcpy,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,FindClose,HeapFree,HeapFree,		1_2_00F94E9C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_01374E9C Wow64EnableWow64FsRedirection,RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,memset,CreateFileA,GetFileTime,CloseHandle,StrRChrA,lstrcat,FindFirstFileA,FindFirstFileA,CompareFileTime,CompareFileTime,FindClose,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,StrChrA,memcpy,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,FindClose,HeapFree,HeapFree,		4_2_01374E9C

Anti Debugging:

Contains functionality to read the PEB

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 5_2_04AF2D03 xor edx, dword ptr fs:[00000030h]

5_2_04AF2D03

Contains functionality to dynamically determine API calls

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_10001F31 LoadLibraryA,GetProcAddress,

1_2_10001F31

HIPS / PFW / Operating System Protection Evasion:

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\0f.dll',#1

Jump to behavior

May try to detect the Windows Explorer process (often used for injection)

Source: loaddll32.exe, 00000001.00000002.812552888.0000000001620000.00000002.00020000.sdmp, rundll32.exe, 00000005.00000002.812702968.00000000033A0000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: loaddll32.exe, 00000001.00000002.812552888.0000000001620000.00000002.00020000.sdmp, rundll32.exe, 00000005.00000002.812702968.00000000033A0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: loaddll32.exe, 00000001.00000002.812552888.0000000001620000.00000002.00020000.sdmp, rundll32.exe, 00000005.00000002.812702968.00000000033A0000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: loaddll32.exe, 00000001.00000002.812552888.0000000001620000.00000002.00020000.sdmp, rundll32.exe, 00000005.00000002.812702968.00000000033A0000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Contains functionality to query locales information (e.g. system language)

Source: C:\Windows\System32\loaddll32.exe	Code function: GetLocaleInfoA,GetSystemDefaultUILanguage,VerLanguageNameA,		1_2_10001566
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoA,GetSystemDefaultUILanguage,VerLanguageNameA,		5_2_10001566

Queries the installation date of Windows

Source: C:\Windows\System32\loaddll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Jump to behavior

Contains functionality to query CPU information (cpuid)

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_00F93946 cpuid

1_2_00F93946

Queries the cryptographic machine GUID

Source: C:\Windows\System32\loaddll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Contains functionality to query windows version

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_1000146C CreateEventA,GetVersion,GetCurrentProcessId,OpenProcess,GetLastError,

1_2_1000146C

Contains functionality to query local / system time

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_100017A7 SetThreadPriority,GetSystemTime,SwitchToThread,Sleep,GetLongPathNameW,GetLongPathNameW,GetLongPathNameW,WaitForSingleObject,GetExitCodeThread,CloseHandle,GetLastError,GetLastError,

1_2_100017A7

Contains functionality to query the account / user name

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_00F93946 wsprintfA,RtlAllocateHeap,GetUserNameW,RtlAllocateHeap,GetUserNameW,HeapFree,GetComputerNameW,GetComputerNameW,RtlAllocateHeap,GetComputerNameW,HeapFree,

1_2_00F93946

Stealing of Sensitive Information:

Yara detected Ursnif

Source: Yara match	File source: 00000001.00000003.739535676.00000000040A8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.739521647.00000000040A8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.739458564.00000000040A8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.739502896.00000000040A8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.739363916.00000000040A8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.813265596.00000000040A8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.739321134.00000000040A8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.739404580.00000000040A8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.739481698.00000000040A8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 5268, type: MEMORYSTR
Source: Yara match	File source: 1.2.loaddll32.exe.38f94a0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.10000000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.f60000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.38f94a0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.11f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.1370000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.rundll32.exe.5bb94a0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.10000000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.a30000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.f90000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.rundll32.exe.5bb94a0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000003.706311406.0000000005BB9000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.706735766.00000000011F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.809626071.0000000000A30000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.813125689.00000000038F9000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.810063319.0000000000F60000.00000004.00000001.sdmp, type: MEMORY

Remote Access Functionality:

Yara detected Ursnif

Source: Yara match	File source: 00000001.00000003.739535676.00000000040A8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.739521647.00000000040A8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.739458564.00000000040A8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.739502896.00000000040A8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.739363916.00000000040A8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.813265596.00000000040A8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.739321134.00000000040A8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.739404580.00000000040A8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.739481698.00000000040A8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 5268, type: MEMORYSTR
Source: Yara match	File source: 1.2.loaddll32.exe.38f94a0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.10000000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.f60000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.38f94a0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.11f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.1370000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.rundll32.exe.5bb94a0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.10000000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.a30000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.f90000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.rundll32.exe.5bb94a0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000003.706311406.0000000005BB9000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.706735766.00000000011F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.809626071.0000000000A30000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.813125689.00000000038F9000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.810063319.0000000000F60000.00000004.00000001.sdmp, type: MEMORY