Windows Analysis Report 248c6f40000.dll

ID:	551795
Product:	CloudBasic
Start time:	15:08:09
Start date:	12.01.2022
Sample:	248c6f40000.dll
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	a1ec2c3298bc890d9febb65cad765ed9
SHA1:	23e897e0a782ed018493b0f420653de81416e650
SHA256:	1e772d61e7d3a7a8ee9770e1f28d11c8130b0657d60eb9cd8c95ecd8931ebdb9
Filetype:	Win64 Dynamic Link Library (generic) (102004/3) 84.88%

Name	Type	MD5	SHA1	SHA256

AV Detection:

Antivirus / Scanner detection for submitted sample

Source: 248c6f40000.dll

Avira: detected

Found malware configuration

Source: 248c6f40000.dll

Malware Configuration Extractor: Ursnif {"RSA Public Key": "qJ1kPoMlraIzwv3codImebn7w+YrU8DGSEbPIUgoOweySW+9oxNs6FEg5rJvyj+K7XGv3snzn5Di7OJfzWWZfRvARRX85pJYlyMRo0/DwGUaS1N350fNDcrXcC+cMnIyqScesdTZTT3I4UGl/4eaH2nD9M3QEBNhxM9oc4sY20SSs/pkG9D0KhuSF1te4bhlucQ+KFpZ02KcWVU4TeE2VEAgiWrjF1Y8G7UeFRWoeCZR7ZUT6Y2O8Scj/5r03Sm3I11vs6nuSszdMAQkYTAfj3fgm6t4wajaiSB8PacCWh04qEHtIdt5MwitFwfOQ/HHeI8ICFQtYdH1z2/KH1gmintjR8z+We+cZoHIHCs3E3g=", "c2_domain": ["io.immontyr.com", "cd1.averlokir.com", "6n6szrxfwwahcgpv.onion", "app.irolano.com", "irq.clickclckjack.at", "fs.abertok.at", "rpc.ikaryto.com", "5k4vglet4rv655tg.onion"], "ip_check_url": ["curlmyip.net"], "serpent_key": "Rk7B02ibiSe2cMoF", "server": "770", "sleep_time": "10", "SetWaitableTimer_value(CRC_CONFIGTIMEOUT)": "600", "time_value": "600", "SetWaitableTimer_value(CRC_TASKTIMEOUT)": "300", "SetWaitableTimer_value(CRC_SENDTIMEOUT)": "300", "SetWaitableTimer_value(CRC_KNOCKERTIMEOUT)": "300", "not_use(CRC_BCTIMEOUT)": "10", "botnet": "1000", "SetWaitableTimer_value": "60"}

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected Ursnif

Source: Yara match

File source: 248c6f40000.dll, type: SAMPLE

E-Banking Fraud:

Yara detected Ursnif

Source: Yara match

File source: 248c6f40000.dll, type: SAMPLE

System Summary:

PE file does not import any functions

Source: 248c6f40000.dll

Static PE information: No import functions for PE file found

Tries to load missing DLLs

Source: C:\Windows\System32\loaddll64.exe	Section loaded: .dll			Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: .dll			Jump to behavior

PE file has an executable .text section and no other executable section

Source: 248c6f40000.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads software policies

Source: C:\Windows\System32\loaddll64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Classification label

Source: classification engine

Classification label: mal68.troj.winDLL@7/0@0/0

Runs a DLL by calling functions

Source: C:\Windows\System32\loaddll64.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\248c6f40000.dll,#1

Spawns processes

Source: unknown	Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\248c6f40000.dll"
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\248c6f40000.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\248c6f40000.dll,#1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\248c6f40000.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\248c6f40000.dll",#1			Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\248c6f40000.dll,#1			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\248c6f40000.dll",#1			Jump to behavior

Found GUI installer (many successful clicks)

Source: C:\Windows\System32\rundll32.exe	Automated click: OK
Source: C:\Windows\System32\rundll32.exe	Automated click: OK

PE file has a high image base, often used for DLLs

Source: 248c6f40000.dll

Static PE information: Image base 0x180000000 > 0x60000000

Hooking and other Techniques for Hiding and Protection:

Yara detected Ursnif

Source: Yara match

File source: 248c6f40000.dll, type: SAMPLE

Disables application error messsages (SetErrorMode)

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Program does not show much activity (idle)

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Anti Debugging:

Program does not show much activity (idle)

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Checks if the current process is being debugged

Source: C:\Windows\System32\loaddll64.exe

Process queried: DebugPort

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\248c6f40000.dll",#1

Jump to behavior

Stealing of Sensitive Information:

Yara detected Ursnif

Source: Yara match

File source: 248c6f40000.dll, type: SAMPLE

Remote Access Functionality:

Yara detected Ursnif

Source: Yara match

File source: 248c6f40000.dll, type: SAMPLE