Windows Analysis Report d780000.dll

ID:	552535
Product:	CloudBasic
Start time:	13:50:16
Start date:	13.01.2022
Sample:	d780000.dll
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	0c3b18bb45fc04d2b4f802e4a6a898f4
SHA1:	198fdda0ebc3eb6c4c0c3f235d4d2725f51ab688
SHA256:	640977f81ab253d45adb96d2e4a6fc2c634ef31b6747ade3acf2fe37238a7d34
Filetype:	Win64 Dynamic Link Library (generic) (102004/3) 84.88%

Name	Type	MD5	SHA1	SHA256

AV Detection:

Antivirus / Scanner detection for submitted sample

Source: d780000.dll

Avira: detected

Found malware configuration

Source: d780000.dll

Malware Configuration Extractor: Ursnif {"RSA Public Key": "R+UxqbV/y+ZU1c0seFgwYm43sz1DSmatV8GC7d9ajlQ+vaAx2oxbmrXwev8mSqGGA/bUt2ZkpqSt/nxO6+/Ak7RHUIzazuikwj2CwtI2KIDL8nZsOoWBzTyOzo34t4SghKOmz0ogisuhvhvEfnzRtTwTwtCrGujd4Sa3+qw1BPxaNAN0DFEVfIrq201z4jAs", "c2_domain": ["lycos.com", "mail.yahoo.com", "193.56.255.251", "193.56.255.250", "193.56.255.249", "numolerunosell.online", "gumolerunosell.online", "rumolerunosell.online"], "dga_tld": "com ru org", "DGA_count": "10", "server": "12", "serpent_key": "10291029JSJUYNHG", "sleep_time": "60", "SetWaitableTimer_value(CRC_CONFIGTIMEOUT)": "600", "time_value": "1000", "SetWaitableTimer_value(CRC_TASKTIMEOUT)": "122", "SetWaitableTimer_value(CRC_SENDTIMEOUT)": "1000", "SetWaitableTimer_value(CRC_KNOCKERTIMEOUT)": "122", "not_use(CRC_BCTIMEOUT)": "10", "botnet": "4474", "SetWaitableTimer_value": "200"}

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected Ursnif

Source: Yara match

File source: d780000.dll, type: SAMPLE

E-Banking Fraud:

Yara detected Ursnif

Source: Yara match

File source: d780000.dll, type: SAMPLE

System Summary:

PE file does not import any functions

Source: d780000.dll

Static PE information: No import functions for PE file found

Tries to load missing DLLs

Source: C:\Windows\System32\loaddll64.exe	Section loaded: .dll			Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: .dll			Jump to behavior

PE file has an executable .text section and no other executable section

Source: d780000.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads software policies

Source: C:\Windows\System32\loaddll64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Classification label

Source: classification engine

Classification label: mal68.troj.winDLL@7/0@0/0

Runs a DLL by calling functions

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\d780000.dll",#1

Spawns processes

Source: unknown	Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\d780000.dll"
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\d780000.dll",#1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\d780000.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\d780000.dll,#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\d780000.dll",#1			Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\d780000.dll,#1			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\d780000.dll",#1			Jump to behavior

Found GUI installer (many successful clicks)

Source: C:\Windows\System32\rundll32.exe	Automated click: OK
Source: C:\Windows\System32\rundll32.exe	Automated click: OK

PE file has a high image base, often used for DLLs

Source: d780000.dll

Static PE information: Image base 0x180000000 > 0x60000000

Hooking and other Techniques for Hiding and Protection:

Yara detected Ursnif

Source: Yara match

File source: d780000.dll, type: SAMPLE

Disables application error messsages (SetErrorMode)

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Program does not show much activity (idle)

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Anti Debugging:

Program does not show much activity (idle)

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Checks if the current process is being debugged

Source: C:\Windows\System32\loaddll64.exe

Process queried: DebugPort

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\d780000.dll",#1

Jump to behavior

Stealing of Sensitive Information:

Yara detected Ursnif

Source: Yara match

File source: d780000.dll, type: SAMPLE

Remote Access Functionality:

Yara detected Ursnif

Source: Yara match

File source: d780000.dll, type: SAMPLE