Play interactive tour

Edit tour

Windows Analysis Report 202c6770000.dll

Overview

General Information

Sample Name:	202c6770000.dll
Analysis ID:	547692
MD5:	4b76083e201810b0a6430846ca94250a
SHA1:	963f018eb2d3a6ae81c40486a63795cdf137be52
SHA256:	8cba0769d25a6cc0cd53961a53b1a13568446ea01f0d72724e15eaef087f314a
Tags:	exegozi
Infos:
Most interesting Screenshot:

Detection

Ursnif

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Yara detected Ursnif

Sigma detected: Suspicious Call by Ordinal

PE file does not import any functions

Tries to load missing DLLs

Program does not show much activity (idle)

Creates a process in suspended mode (likely to inject code)

Checks if the current process is being debugged

Classification

Process Tree

System is w10x64

loaddll64.exe (PID: 6580 cmdline: loaddll64.exe "C:\Users\user\Desktop\202c6770000.dll" MD5: 4E8A40CAD6CCC047914E3A7830A2D8AA)

cmd.exe (PID: 6588 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\202c6770000.dll",#1 MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

rundll32.exe (PID: 6108 cmdline: rundll32.exe "C:\Users\user\Desktop\202c6770000.dll",#1 MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 5128 cmdline: rundll32.exe C:\Users\user\Desktop\202c6770000.dll,#1 MD5: 73C519F050C20580F8A62C849D49215A)

cleanup

Malware Configuration

Threatname: Ursnif

{"RSA Public Key": "R+UxqbV/y+ZU1c0seFgwYm43sz1DSmatV8GC7d9ajlQ+vaAx2oxbmrXwev8mSqGGA/bUt2ZkpqSt/nxO6+/Ak7RHUIzazuikwj2CwtI2KIDL8nZsOoWBzTyOzo34t4SghKOmz0ogisuhvhvEfnzRtTwTwtCrGujd4Sa3+qw1BPxaNAN0DFEVfIrq201z4jAs", "c2_domain": ["lycos.com", "mail.yahoo.com", "193.56.255.251", "193.56.255.250", "193.56.255.249", "numolerunosell.online", "gumolerunosell.online", "rumolerunosell.online"], "dga_tld": "com ru org", "DGA_count": "10", "server": "12", "serpent_key": "10291029JSJUYNHG", "sleep_time": "60", "SetWaitableTimer_value(CRC_CONFIGTIMEOUT)": "600", "time_value": "1000", "SetWaitableTimer_value(CRC_TASKTIMEOUT)": "122", "SetWaitableTimer_value(CRC_SENDTIMEOUT)": "1000", "SetWaitableTimer_value(CRC_KNOCKERTIMEOUT)": "122", "not_use(CRC_BCTIMEOUT)": "10", "botnet": "4474", "SetWaitableTimer_value": "200"}

Yara Overview

Initial Sample

Source	Rule	Description	Author	Strings
202c6770000.dll	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security

Sigma Overview

System Summary:

Sigma detected: Suspicious Call by Ordinal

Show sources

Source: Process started

Author: Florian Roth: Data: Command: rundll32.exe C:\Users\user\Desktop\202c6770000.dll,#1, CommandLine: rundll32.exe C:\Users\user\Desktop\202c6770000.dll,#1, CommandLine|base64offset|contains: , Image: C:\Windows\System32\rundll32.exe, NewProcessName: C:\Windows\System32\rundll32.exe, OriginalFileName: C:\Windows\System32\rundll32.exe, ParentCommandLine: loaddll64.exe "C:\Users\user\Desktop\202c6770000.dll", ParentImage: C:\Windows\System32\loaddll64.exe, ParentProcessId: 6580, ProcessCommandLine: rundll32.exe C:\Users\user\Desktop\202c6770000.dll,#1, ProcessId: 5128

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 202c6770000.dll

Malware Configuration Extractor: Ursnif {"RSA Public Key": "R+UxqbV/y+ZU1c0seFgwYm43sz1DSmatV8GC7d9ajlQ+vaAx2oxbmrXwev8mSqGGA/bUt2ZkpqSt/nxO6+/Ak7RHUIzazuikwj2CwtI2KIDL8nZsOoWBzTyOzo34t4SghKOmz0ogisuhvhvEfnzRtTwTwtCrGujd4Sa3+qw1BPxaNAN0DFEVfIrq201z4jAs", "c2_domain": ["lycos.com", "mail.yahoo.com", "193.56.255.251", "193.56.255.250", "193.56.255.249", "numolerunosell.online", "gumolerunosell.online", "rumolerunosell.online"], "dga_tld": "com ru org", "DGA_count": "10", "server": "12", "serpent_key": "10291029JSJUYNHG", "sleep_time": "60", "SetWaitableTimer_value(CRC_CONFIGTIMEOUT)": "600", "time_value": "1000", "SetWaitableTimer_value(CRC_TASKTIMEOUT)": "122", "SetWaitableTimer_value(CRC_SENDTIMEOUT)": "1000", "SetWaitableTimer_value(CRC_KNOCKERTIMEOUT)": "122", "not_use(CRC_BCTIMEOUT)": "10", "botnet": "4474", "SetWaitableTimer_value": "200"}

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected Ursnif

Show sources

Source: Yara match

File source: 202c6770000.dll, type: SAMPLE

E-Banking Fraud:

Yara detected Ursnif

Show sources

Source: Yara match

File source: 202c6770000.dll, type: SAMPLE

System Summary:

Source: 202c6770000.dll

Static PE information: No import functions for PE file found

Source: C:\Windows\System32\loaddll64.exe	Section loaded: .dll
Source: C:\Windows\System32\loaddll64.exe	Section loaded: .dll

Source: 202c6770000.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: classification engine

Classification label: mal60.troj.winDLL@7/0@0/0

Source: C:\Windows\System32\loaddll64.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\202c6770000.dll,#1

Source: unknown	Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\202c6770000.dll"
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\202c6770000.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\202c6770000.dll,#1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\202c6770000.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\202c6770000.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\202c6770000.dll,#1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\202c6770000.dll",#1

Source: C:\Windows\System32\rundll32.exe	Automated click: OK
Source: C:\Windows\System32\rundll32.exe	Automated click: OK

Source: 202c6770000.dll

Static PE information: Image base 0x180000000 > 0x60000000

Hooking and other Techniques for Hiding and Protection:

Yara detected Ursnif

Show sources

Source: Yara match

File source: 202c6770000.dll, type: SAMPLE

Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\System32\loaddll64.exe

Process queried: DebugPort

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\202c6770000.dll",#1

Stealing of Sensitive Information:

Yara detected Ursnif

Show sources

Source: Yara match

File source: 202c6770000.dll, type: SAMPLE

Remote Access Functionality:

Yara detected Ursnif

Show sources

Source: Yara match

File source: 202c6770000.dll, type: SAMPLE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	DLL Side-Loading1	Process Injection11	Virtualization/Sandbox Evasion1	OS Credential Dumping	Security Software Discovery1	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	Data Obfuscation	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	DLL Side-Loading1	Rundll321	LSASS Memory	Virtualization/Sandbox Evasion1	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Process Injection11	Security Account Manager	System Information Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	DLL Side-Loading1	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report 202c6770000.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Ursnif

Yara Overview

Initial Sample

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails