Play interactive tour

Edit tour

Windows Analysis Report 1e60aca0000.dll

Overview

General Information

Sample Name:	1e60aca0000.dll
Analysis ID:	547693
MD5:	f09f51fb30891aa93446c01018e92d49
SHA1:	28e62b9495bf58b7ff183c327a6eaa3ac7461b5b
SHA256:	68f2f77b88e5575b360d05f84ff11a026a62fa42f48aeec2cd44523692e40a6a
Tags:	exegozi
Infos:
Most interesting Screenshot:

Detection

Ursnif

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected Ursnif

Sigma detected: Suspicious Call by Ordinal

PE file does not import any functions

Tries to load missing DLLs

Program does not show much activity (idle)

Creates a process in suspended mode (likely to inject code)

Checks if the current process is being debugged

Classification

Process Tree

System is w10x64

loaddll64.exe (PID: 6308 cmdline: loaddll64.exe "C:\Users\user\Desktop\1e60aca0000.dll" MD5: 4E8A40CAD6CCC047914E3A7830A2D8AA)

cmd.exe (PID: 6316 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\1e60aca0000.dll",#1 MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

rundll32.exe (PID: 6352 cmdline: rundll32.exe "C:\Users\user\Desktop\1e60aca0000.dll",#1 MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 6340 cmdline: rundll32.exe C:\Users\user\Desktop\1e60aca0000.dll,#1 MD5: 73C519F050C20580F8A62C849D49215A)

cleanup

Malware Configuration

Threatname: Ursnif

{"RSA Public Key": "1ez6ZX9GBMHuzrxYcEvmkX0k1/y/WRE5hgthXVQ4P44VmZDRyl+qzgB3X8mQxx9hX87voxwb+7CbnJcCZ4hp/XwNIs0rUcJj4wwNctiIvZb8gIPsgWrAjjXLGMBCWjpmhIdWmYD7oSqxAb7ciAuhtWabiveV3OFwUuMRDbNtONTWpz/J4JVtQJ3XBbp99SutX5vbOPhgKBI3aszrv+0c1EkjrakCFHlOqMs8bjEjNDxrhaBWjOM1EU17zvHVkK7hxDkKQ5buzWmjrzDZEEWnvM3aa5uVRR1v44XnbolU0ltUakCZT4sH963oonk1uijxExj7eWoI4x+donYvsc/nFxNyfe6c/mfSKb7U2RhPG4g=", "c2_domain": ["art.microsoftsofymicrosoftsoft.at", "r23cirt55ysvtdvl.onion", "poi.redhatbabby.at", "fgx.dangerboy.at", "pop.biopiof.at", "l46t3vgvmtx5wxe6.onion", "apr.intoolkom.at"], "ip_check_url": ["curlmyip.net"], "serpent_key": "KCVH9K5GZjoxwKSf", "server": "580", "sleep_time": "10", "SetWaitableTimer_value(CRC_CONFIGTIMEOUT)": "600", "time_value": "600", "SetWaitableTimer_value(CRC_TASKTIMEOUT)": "300", "SetWaitableTimer_value(CRC_SENDTIMEOUT)": "300", "SetWaitableTimer_value(CRC_KNOCKERTIMEOUT)": "300", "not_use(CRC_BCTIMEOUT)": "10", "botnet": "505050", "SetWaitableTimer_value": "60"}

Yara Overview

Initial Sample

Source	Rule	Description	Author	Strings
1e60aca0000.dll	JoeSecurity_Ursnif_2	Yara detected Ursnif	Joe Security

Sigma Overview

System Summary:

Sigma detected: Suspicious Call by Ordinal

Show sources

Source: Process started

Author: Florian Roth: Data: Command: rundll32.exe C:\Users\user\Desktop\1e60aca0000.dll,#1, CommandLine: rundll32.exe C:\Users\user\Desktop\1e60aca0000.dll,#1, CommandLine|base64offset|contains: , Image: C:\Windows\System32\rundll32.exe, NewProcessName: C:\Windows\System32\rundll32.exe, OriginalFileName: C:\Windows\System32\rundll32.exe, ParentCommandLine: loaddll64.exe "C:\Users\user\Desktop\1e60aca0000.dll", ParentImage: C:\Windows\System32\loaddll64.exe, ParentProcessId: 6308, ProcessCommandLine: rundll32.exe C:\Users\user\Desktop\1e60aca0000.dll,#1, ProcessId: 6340

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus / Scanner detection for submitted sample

Show sources

Source: 1e60aca0000.dll

Avira: detected

Found malware configuration

Show sources

Source: 1e60aca0000.dll

Malware Configuration Extractor: Ursnif {"RSA Public Key": "1ez6ZX9GBMHuzrxYcEvmkX0k1/y/WRE5hgthXVQ4P44VmZDRyl+qzgB3X8mQxx9hX87voxwb+7CbnJcCZ4hp/XwNIs0rUcJj4wwNctiIvZb8gIPsgWrAjjXLGMBCWjpmhIdWmYD7oSqxAb7ciAuhtWabiveV3OFwUuMRDbNtONTWpz/J4JVtQJ3XBbp99SutX5vbOPhgKBI3aszrv+0c1EkjrakCFHlOqMs8bjEjNDxrhaBWjOM1EU17zvHVkK7hxDkKQ5buzWmjrzDZEEWnvM3aa5uVRR1v44XnbolU0ltUakCZT4sH963oonk1uijxExj7eWoI4x+donYvsc/nFxNyfe6c/mfSKb7U2RhPG4g=", "c2_domain": ["art.microsoftsofymicrosoftsoft.at", "r23cirt55ysvtdvl.onion", "poi.redhatbabby.at", "fgx.dangerboy.at", "pop.biopiof.at", "l46t3vgvmtx5wxe6.onion", "apr.intoolkom.at"], "ip_check_url": ["curlmyip.net"], "serpent_key": "KCVH9K5GZjoxwKSf", "server": "580", "sleep_time": "10", "SetWaitableTimer_value(CRC_CONFIGTIMEOUT)": "600", "time_value": "600", "SetWaitableTimer_value(CRC_TASKTIMEOUT)": "300", "SetWaitableTimer_value(CRC_SENDTIMEOUT)": "300", "SetWaitableTimer_value(CRC_KNOCKERTIMEOUT)": "300", "not_use(CRC_BCTIMEOUT)": "10", "botnet": "505050", "SetWaitableTimer_value": "60"}

Multi AV Scanner detection for submitted file

Show sources

Source: 1e60aca0000.dll

ReversingLabs: Detection: 34%

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected Ursnif

Show sources

Source: Yara match

File source: 1e60aca0000.dll, type: SAMPLE

E-Banking Fraud:

Yara detected Ursnif

Show sources

Source: Yara match

File source: 1e60aca0000.dll, type: SAMPLE

System Summary:

Source: 1e60aca0000.dll

Static PE information: No import functions for PE file found

Source: C:\Windows\System32\loaddll64.exe	Section loaded: .dll
Source: C:\Windows\System32\loaddll64.exe	Section loaded: .dll

Source: 1e60aca0000.dll

ReversingLabs: Detection: 34%

Source: 1e60aca0000.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: classification engine

Classification label: mal76.troj.winDLL@7/0@0/0

Source: C:\Windows\System32\loaddll64.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1e60aca0000.dll,#1

Source: unknown	Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\1e60aca0000.dll"
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\1e60aca0000.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1e60aca0000.dll,#1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\1e60aca0000.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\1e60aca0000.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1e60aca0000.dll,#1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\1e60aca0000.dll",#1

Source: C:\Windows\System32\rundll32.exe	Automated click: OK
Source: C:\Windows\System32\rundll32.exe	Automated click: OK

Source: 1e60aca0000.dll

Static PE information: Image base 0x180000000 > 0x60000000

Hooking and other Techniques for Hiding and Protection:

Yara detected Ursnif

Show sources

Source: Yara match

File source: 1e60aca0000.dll, type: SAMPLE

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\System32\loaddll64.exe

Process queried: DebugPort

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\1e60aca0000.dll",#1

Stealing of Sensitive Information:

Yara detected Ursnif

Show sources

Source: Yara match

File source: 1e60aca0000.dll, type: SAMPLE

Remote Access Functionality:

Yara detected Ursnif

Show sources

Source: Yara match

File source: 1e60aca0000.dll, type: SAMPLE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	DLL Side-Loading1	Process Injection11	Virtualization/Sandbox Evasion1	OS Credential Dumping	Security Software Discovery1	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	Data Obfuscation	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	DLL Side-Loading1	Rundll321	LSASS Memory	Virtualization/Sandbox Evasion1	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Process Injection11	Security Account Manager	System Information Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	DLL Side-Loading1	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report 1e60aca0000.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Ursnif

Yara Overview

Initial Sample

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails