Edit tour

Windows Analysis Report
pzG0rkIchr.dll

Overview

General Information

Sample Name:	pzG0rkIchr.dll
Analysis ID:	752975
MD5:	d6ef4778f7dc9c31a0a2a989ef42d2fd
SHA1:	5dad8394ef37d5a006674589754f7a3187d303b1
SHA256:	54de1f2c26a63a8f6b7f8d5de99f8ebd4093959ab07f027db1985d0652258736
Tags:	exeLDR4
Infos:

Detection

Ursnif

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected Ursnif

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Snort IDS alert for network traffic

Performs DNS queries to domains with low reputation

One or more processes crash

Contains functionality to check if a debugger is running (IsDebuggerPresent)

May sleep (evasive loops) to hinder dynamic analysis

Internet Provider seen in connection with other malware

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

Tries to load missing DLLs

Checks if the current process is being debugged

Registers a DLL

Launches processes in debugging mode, may be used to hinder debugging

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

loaddll64.exe (PID: 1556 cmdline: loaddll64.exe "C:\Users\user\Desktop\pzG0rkIchr.dll" MD5: C676FC0263EDD17D4CE7D644B8F3FCD6)

conhost.exe (PID: 4696 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 1076 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\pzG0rkIchr.dll",#1 MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

rundll32.exe (PID: 5268 cmdline: rundll32.exe "C:\Users\user\Desktop\pzG0rkIchr.dll",#1 MD5: 73C519F050C20580F8A62C849D49215A)

regsvr32.exe (PID: 2356 cmdline: regsvr32.exe /s C:\Users\user\Desktop\pzG0rkIchr.dll MD5: D78B75FC68247E8A63ACBA846182740E)

rundll32.exe (PID: 5264 cmdline: rundll32.exe C:\Users\user\Desktop\pzG0rkIchr.dll,DllRegisterServer MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 6044 cmdline: rundll32.exe C:\Users\user\Desktop\pzG0rkIchr.dll,ItsnPq5v MD5: 73C519F050C20580F8A62C849D49215A)

WerFault.exe (PID: 5572 cmdline: C:\Windows\system32\WerFault.exe -u -p 6044 -s 276 MD5: 2AFFE478D86272288BBEF5A00BBEF6A0)

rundll32.exe (PID: 6136 cmdline: rundll32.exe C:\Users\user\Desktop\pzG0rkIchr.dll,QlqYo259k MD5: 73C519F050C20580F8A62C849D49215A)

WerFault.exe (PID: 5404 cmdline: C:\Windows\system32\WerFault.exe -u -p 6136 -s 304 MD5: 2AFFE478D86272288BBEF5A00BBEF6A0)

WerFault.exe (PID: 680 cmdline: C:\Windows\system32\WerFault.exe -u -p 6136 -s 304 MD5: 2AFFE478D86272288BBEF5A00BBEF6A0)

cleanup

Malware Configuration

Threatname: Ursnif

{"c2_domain": ["https://gigimas.xyz", "https://reaso.xyz"], "botnet": "202206061", "aes key": "eq2opFFpGzpd2p9t", "sleep time": "20", "request time": "30", "host keep time": "120", "host shift time": "120"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
Process Memory Space: loaddll64.exe PID: 1556	JoeSecurity_Ursnifv4	Yara detected Ursnif	Joe Security
Process Memory Space: regsvr32.exe PID: 2356	JoeSecurity_Ursnifv4	Yara detected Ursnif	Joe Security
Process Memory Space: rundll32.exe PID: 5268	JoeSecurity_Ursnifv4	Yara detected Ursnif	Joe Security
Process Memory Space: rundll32.exe PID: 5264	JoeSecurity_Ursnifv4	Yara detected Ursnif	Joe Security

Snort Signatures

ET TROJAN Observed DNS Query to Ursnif Domain (gigimas .xyz) - Source IP: 192.168.2.4 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.48.8.8.864906532039645 11/24/22-05:22:35.810533
SID:	2039645
Source Port:	64906
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed DNS Query to Ursnif Domain (gigimas .xyz) - Source IP: 192.168.2.4 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.48.8.8.861007532039645 11/24/22-05:20:02.978332
SID:	2039645
Source Port:	61007
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed DNS Query to Ursnif Domain (gigimas .xyz) - Source IP: 192.168.2.4 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.48.8.8.861124532039645 11/24/22-05:21:04.451832
SID:	2039645
Source Port:	61124
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed DNS Query to Ursnif Domain (gigimas .xyz) - Source IP: 192.168.2.4 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.48.8.8.859444532039645 11/24/22-05:21:34.871041
SID:	2039645
Source Port:	59444
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed DNS Query to Ursnif Domain (gigimas .xyz) - Source IP: 192.168.2.4 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.48.8.8.855570532039645 11/24/22-05:22:05.359167
SID:	2039645
Source Port:	55570
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed DNS Query to Ursnif Domain (gigimas .xyz) - Source IP: 192.168.2.4 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.48.8.8.860686532039645 11/24/22-05:20:33.386749
SID:	2039645
Source Port:	60686
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed DNS Query to Ursnif Domain (gigimas .xyz) - Source IP: 192.168.2.4 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.48.8.8.859446532039645 11/24/22-05:23:06.390786
SID:	2039645
Source Port:	59446
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: pzG0rkIchr.dll	Virustotal: Detection: 57%			Perma Link
Source: pzG0rkIchr.dll	ReversingLabs: Detection: 73%

Antivirus detection for URL or domain

Source: https://reaso.xyz

Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Source: gigimas.xyz	Virustotal: Detection: 14%			Perma Link
Source: https://gigimas.xyz	Virustotal: Detection: 11%			Perma Link

Source: 4.3.rundll32.exe.17b359400d0.0.raw.unpack

Malware Configuration Extractor: Ursnif {"c2_domain": ["https://gigimas.xyz", "https://reaso.xyz"], "botnet": "202206061", "aes key": "eq2opFFpGzpd2p9t", "sleep time": "20", "request time": "30", "host keep time": "120", "host shift time": "120"}

Source: pzG0rkIchr.dll

Static PE information: certificate valid

Source: pzG0rkIchr.dll

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: UxTheme.pdb source: WerFault.exe, 0000000D.00000003.375045922.000001EA8FE97000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000D.00000003.375091188.000001EA8FE97000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: gdi32.pdb source: WerFault.exe, 0000000D.00000003.375083510.000001EA8FE94000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000D.00000003.375037408.000001EA8FE91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: kernelbase.pdb0 source: WerFault.exe, 0000000D.00000003.359316080.000001EA8F2F7000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000D.00000003.370137520.000001EA8F2F7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: bcryptprimitives.pdb8 source: WerFault.exe, 0000000D.00000003.375037408.000001EA8FE91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: oleaut32.pdb"V source: WerFault.exe, 0000000D.00000003.375045922.000001EA8FE97000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000D.00000003.375091188.000001EA8FE97000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 0000000D.00000003.375045922.000001EA8FE97000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000D.00000003.375091188.000001EA8FE97000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rpcrt4.pdb source: WerFault.exe, 0000000D.00000003.375037408.000001EA8FE91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 0000000D.00000003.375037408.000001EA8FE91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: kernelbase.pdb8 source: WerFault.exe, 0000000D.00000003.375037408.000001EA8FE91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ucrtbase.pdb8 source: WerFault.exe, 0000000D.00000003.375037408.000001EA8FE91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: shcore.pdb8 source: WerFault.exe, 0000000D.00000003.375037408.000001EA8FE91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 0000000D.00000003.375037408.000001EA8FE91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: combase.pdb8 source: WerFault.exe, 0000000D.00000003.375037408.000001EA8FE91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: elbase.pdb source: WerFault.exe, 0000000D.00000002.379074933.000001EA8D552000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000D.00000003.370270156.000001EA8D563000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: win32u.pdb8 source: WerFault.exe, 0000000D.00000003.375083510.000001EA8FE94000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000D.00000003.375037408.000001EA8FE91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 0000000D.00000003.375037408.000001EA8FE91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msctf.pdb source: WerFault.exe, 0000000D.00000003.375045922.000001EA8FE97000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000D.00000003.375091188.000001EA8FE97000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: gdi32full.pdb8 source: WerFault.exe, 0000000D.00000003.375083510.000001EA8FE94000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000D.00000003.375037408.000001EA8FE91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: gdi32.pdb8 source: WerFault.exe, 0000000D.00000003.375083510.000001EA8FE94000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000D.00000003.375037408.000001EA8FE91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: user32.pdb source: WerFault.exe, 0000000D.00000003.375037408.000001EA8FE91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 0000000D.00000003.375077557.000001EA8FE90000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rundll32.pdb8 source: WerFault.exe, 0000000D.00000003.375037408.000001EA8FE91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rpcrt4.pdb8 source: WerFault.exe, 0000000D.00000003.375037408.000001EA8FE91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 0000000D.00000003.375037408.000001EA8FE91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: imagehlp.pdb8 source: WerFault.exe, 0000000D.00000003.375037408.000001EA8FE91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: WerFault.exe, 0000000D.00000003.370270156.000001EA8D563000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000D.00000003.373102112.000001EA8F2EA000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000D.00000003.359276516.000001EA8F2EA000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000D.00000003.375037408.000001EA8FE91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 0000000D.00000003.375037408.000001EA8FE91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: kernel32.pdb source: WerFault.exe, 0000000D.00000003.371722395.000001EA8F2F1000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000D.00000003.370270156.000001EA8D563000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000D.00000003.359287144.000001EA8F2F1000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000D.00000003.375037408.000001EA8FE91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dwmapi.pdb6V source: WerFault.exe, 0000000D.00000003.375045922.000001EA8FE97000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000D.00000003.375091188.000001EA8FE97000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rundll32.pdb source: WerFault.exe, 0000000D.00000003.359149665.000001EA8F2E4000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000D.00000003.370270156.000001EA8D563000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000D.00000003.375037408.000001EA8FE91000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000D.00000003.359079833.000001EA8F379000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msvcrt.pdb8 source: WerFault.exe, 0000000D.00000003.375037408.000001EA8FE91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: oleaut32.pdb source: WerFault.exe, 0000000D.00000003.375045922.000001EA8FE97000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000D.00000003.375091188.000001EA8FE97000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msctf.pdb!V source: WerFault.exe, 0000000D.00000003.375045922.000001EA8FE97000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000D.00000003.375091188.000001EA8FE97000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb8 source: WerFault.exe, 0000000D.00000003.375037408.000001EA8FE91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: imagehlp.pdb source: WerFault.exe, 0000000D.00000003.375037408.000001EA8FE91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: win32u.pdb source: WerFault.exe, 0000000D.00000003.375083510.000001EA8FE94000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000D.00000003.375037408.000001EA8FE91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: gdi32full.pdb source: WerFault.exe, 0000000D.00000003.375083510.000001EA8FE94000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000D.00000003.375037408.000001EA8FE91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: kernel32.pdb8 source: WerFault.exe, 0000000D.00000003.375037408.000001EA8FE91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: user32.pdb8 source: WerFault.exe, 0000000D.00000003.375037408.000001EA8FE91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dwmapi.pdb source: WerFault.exe, 0000000D.00000003.375045922.000001EA8FE97000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000D.00000003.375091188.000001EA8FE97000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb0 source: WerFault.exe, 0000000D.00000003.373102112.000001EA8F2EA000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000D.00000003.359276516.000001EA8F2EA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: kernelbase.pdb source: WerFault.exe, 0000000D.00000003.359316080.000001EA8F2F7000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000D.00000003.370137520.000001EA8F2F7000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000D.00000003.375037408.000001EA8FE91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: kernel32.pdb0 source: WerFault.exe, 0000000D.00000003.371722395.000001EA8F2F1000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000D.00000003.359287144.000001EA8F2F1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: imm32.pdb source: WerFault.exe, 0000000D.00000003.375077557.000001EA8FE90000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC130EFB70 FindFirstFileExA,
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFC130EFB70 FindFirstFileExA,
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFC130EFB70 FindFirstFileExA,

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\regsvr32.exe	Network Connect: 185.250.148.35 443
Source: C:\Windows\System32\regsvr32.exe	Domain query: gigimas.xyz

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2039645 ET TROJAN Observed DNS Query to Ursnif Domain (gigimas .xyz) 192.168.2.4:61007 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2039645 ET TROJAN Observed DNS Query to Ursnif Domain (gigimas .xyz) 192.168.2.4:60686 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2039645 ET TROJAN Observed DNS Query to Ursnif Domain (gigimas .xyz) 192.168.2.4:61124 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2039645 ET TROJAN Observed DNS Query to Ursnif Domain (gigimas .xyz) 192.168.2.4:59444 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2039645 ET TROJAN Observed DNS Query to Ursnif Domain (gigimas .xyz) 192.168.2.4:55570 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2039645 ET TROJAN Observed DNS Query to Ursnif Domain (gigimas .xyz) 192.168.2.4:64906 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2039645 ET TROJAN Observed DNS Query to Ursnif Domain (gigimas .xyz) 192.168.2.4:59446 -> 8.8.8.8:53

Performs DNS queries to domains with low reputation

Source: C:\Windows\System32\regsvr32.exe	DNS query: gigimas.xyz
Source: C:\Windows\System32\regsvr32.exe	DNS query: gigimas.xyz
Source: C:\Windows\System32\regsvr32.exe	DNS query: gigimas.xyz
Source: C:\Windows\System32\regsvr32.exe	DNS query: gigimas.xyz

Source: Joe Sandbox View

ASN Name: FIRSTDC-ASRU FIRSTDC-ASRU

Source: Joe Sandbox View

IP Address: 185.250.148.35 185.250.148.35

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: pzG0rkIchr.dll	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: WerFault.exe, 0000000D.00000002.379355430.000001EA8F2E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: WerFault.exe, 0000000D.00000002.379355430.000001EA8F2E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: pzG0rkIchr.dll	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: pzG0rkIchr.dll	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: pzG0rkIchr.dll	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: pzG0rkIchr.dll	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: pzG0rkIchr.dll	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: pzG0rkIchr.dll	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: pzG0rkIchr.dll	String found in binary or memory: http://ocsp.comodoca.com0
Source: pzG0rkIchr.dll	String found in binary or memory: http://ocsp.sectigo.com0
Source: loaddll64.exe, 00000000.00000003.631018067.0000020164340000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000002.641761210.00000000021BD000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000002.641543041.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.357258070.0000017B374A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.357488590.00000201A4290000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gigimas.xyz
Source: regsvr32.exe, 00000003.00000003.466330233.00000000007E8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000003.596495160.00000000007E8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000003.595788178.0000000000815000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000003.531293534.00000000007E8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000002.641484903.0000000000813000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000003.596407001.0000000000813000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000002.641359278.00000000007E8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000003.466249755.00000000007A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gigimas.xyz/
Source: regsvr32.exe, 00000003.00000003.466330233.00000000007E8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000003.596506826.000000000078D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000003.596495160.00000000007E8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000003.531293534.00000000007E8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000002.641359278.00000000007E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gigimas.xyz/index.html
Source: regsvr32.exe, 00000003.00000003.596495160.00000000007E8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000002.641359278.00000000007E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gigimas.xyz/index.html5F
Source: regsvr32.exe, 00000003.00000003.466312748.00000000007DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gigimas.xyz/index.html9Pu/Jl
Source: regsvr32.exe, 00000003.00000002.641214444.00000000007C6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000003.596466270.00000000007C6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000003.531265696.00000000007C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gigimas.xyz/index.htmlT
Source: regsvr32.exe, 00000003.00000002.641004710.0000000000785000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gigimas.xyz/index.htmlm
Source: regsvr32.exe, 00000003.00000003.531293534.00000000007E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gigimas.xyz:443/index.html
Source: regsvr32.exe, 00000003.00000003.596495160.00000000007E8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000002.641359278.00000000007E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gigimas.xyz:443/index.htmlY_
Source: regsvr32.exe, 00000003.00000002.641761210.00000000021BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gigimas.xyzhttps://reaso.xyz
Source: loaddll64.exe, 00000000.00000003.631032238.0000020164342000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000002.641554871.00000000020E2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.357262173.0000017B374A2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.357492545.00000201A4292000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://http://Mozilla/5.0
Source: regsvr32.exe, 00000003.00000002.641761210.00000000021BD000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000002.641543041.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.357258070.0000017B374A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.357488590.00000201A4290000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reaso.xyz
Source: pzG0rkIchr.dll	String found in binary or memory: https://sectigo.com/CPS0

Source: unknown

DNS traffic detected: queries for: gigimas.xyz

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected Ursnif

Source: Yara match	File source: Process Memory Space: loaddll64.exe PID: 1556, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: regsvr32.exe PID: 2356, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 5268, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 5264, type: MEMORYSTR

E-Banking Fraud

Yara detected Ursnif

Source: Yara match	File source: Process Memory Space: loaddll64.exe PID: 1556, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: regsvr32.exe PID: 2356, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 5268, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 5264, type: MEMORYSTR

Source: C:\Windows\System32\rundll32.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6044 -s 276

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000201640C37E0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000201640C6DF0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000201640CA918
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000201640C4540
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000201640C5638
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000201640C204C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000201640C9D6C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000201640C34A4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000201640C31C0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000201640C3CD8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000201640C7FD4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC130E5840
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC130E6D50
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC130E9BA0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC130E83C0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC130F6808
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC130E6820
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC130FF290
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC130E42A0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC130E76E0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC130E1B10
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC130FB370
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC130FB9B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC130F75E0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC130F1E14
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC130E4C80
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC130E90B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC130EDCAC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC130E5CC0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC130FF8F0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC130F98F0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC130E1520
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC130F8D50
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC13100D70
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC130EF964
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00739D6C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00735638
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_007337E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00733CD8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_007331C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00734540
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0073204C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0073A918
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00736DF0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00737FD4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_007334A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFC130E5840
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFC130F75E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFC130E6D50
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFC130E9BA0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFC130E83C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFC130F6808
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFC130E6820
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFC130FF290
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFC130E42A0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFC130E76E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFC130E1B10
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFC130FB370
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFC130FB9B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFC130F1E14
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFC130E4C80
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFC130E90B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFC130EDCAC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFC130E5CC0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFC130FF8F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFC130F98F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFC130E1520
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFC130F8D50
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFC13100D70
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFC130EF964
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000017B359E37E0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000017B359E34A4
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000017B359E3CD8
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000017B359E7FD4
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000017B359E31C0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000017B359E6DF0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000017B359EA918
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000017B359E5638
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000017B359E204C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000017B359E4540
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000017B359E9D6C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_00000201A29A37E0
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_00000201A29A9D6C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_00000201A29A31C0
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_00000201A29A34A4
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_00000201A29A7FD4
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_00000201A29A3CD8
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_00000201A29A6DF0
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_00000201A29AA918
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_00000201A29A4540
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_00000201A29A5638
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_00000201A29A204C
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFC130E9BA0
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFC130E83C0
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFC130F6808
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFC130E6820
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFC130E5840
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFC130FF290
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFC130E42A0
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFC130E76E0
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFC130E1B10
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFC130FB370
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFC130FB9B0
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFC130F75E0
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFC130F1E14
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFC130E4C80
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFC130E90B0
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFC130EDCAC
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFC130E5CC0
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFC130FF8F0
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFC130F98F0
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFC130E1520
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFC130E6D50
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFC130F8D50
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFC13100D70
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFC130EF964

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000201640CA0AC CreateFileW,NtQueryDirectoryFile,
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0073A0AC CreateFileW,NtQueryDirectoryFile,
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000017B359EA0AC CreateFileW,NtQueryDirectoryFile,
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_00000201A29AA0AC CreateFileW,NtQueryDirectoryFile,

Source: C:\Windows\System32\regsvr32.exe

Section loaded: sfc.dll

Source: pzG0rkIchr.dll	Virustotal: Detection: 57%
Source: pzG0rkIchr.dll	ReversingLabs: Detection: 73%

Source: pzG0rkIchr.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\pzG0rkIchr.dll"
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\pzG0rkIchr.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\pzG0rkIchr.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\pzG0rkIchr.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\pzG0rkIchr.dll,DllRegisterServer
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\pzG0rkIchr.dll,ItsnPq5v
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\pzG0rkIchr.dll,QlqYo259k
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6044 -s 276
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6136 -s 304
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6136 -s 304
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\pzG0rkIchr.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\pzG0rkIchr.dll
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\pzG0rkIchr.dll,DllRegisterServer
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\pzG0rkIchr.dll,ItsnPq5v
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\pzG0rkIchr.dll,QlqYo259k
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\pzG0rkIchr.dll",#1
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6136 -s 304

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WERDC43.tmp

Jump to behavior

Source: classification engine

Classification label: mal92.troj.evad.winDLL@19/8@4/2

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\pzG0rkIchr.dll",#1

Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6044
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4696:120:WilError_01
Source: C:\Windows\System32\regsvr32.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\ManagerMui
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6136

Source: C:\Windows\System32\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: pzG0rkIchr.dll

Static PE information: Image base 0x180000000 > 0x60000000

Source: pzG0rkIchr.dll

Static PE information: certificate valid

Source: pzG0rkIchr.dll

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source: pzG0rkIchr.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: UxTheme.pdb source: WerFault.exe, 0000000D.00000003.375045922.000001EA8FE97000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000D.00000003.375091188.000001EA8FE97000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: gdi32.pdb source: WerFault.exe, 0000000D.00000003.375083510.000001EA8FE94000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000D.00000003.375037408.000001EA8FE91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: kernelbase.pdb0 source: WerFault.exe, 0000000D.00000003.359316080.000001EA8F2F7000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000D.00000003.370137520.000001EA8F2F7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: bcryptprimitives.pdb8 source: WerFault.exe, 0000000D.00000003.375037408.000001EA8FE91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: oleaut32.pdb"V source: WerFault.exe, 0000000D.00000003.375045922.000001EA8FE97000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000D.00000003.375091188.000001EA8FE97000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 0000000D.00000003.375045922.000001EA8FE97000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000D.00000003.375091188.000001EA8FE97000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rpcrt4.pdb source: WerFault.exe, 0000000D.00000003.375037408.000001EA8FE91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 0000000D.00000003.375037408.000001EA8FE91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: kernelbase.pdb8 source: WerFault.exe, 0000000D.00000003.375037408.000001EA8FE91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ucrtbase.pdb8 source: WerFault.exe, 0000000D.00000003.375037408.000001EA8FE91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: shcore.pdb8 source: WerFault.exe, 0000000D.00000003.375037408.000001EA8FE91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 0000000D.00000003.375037408.000001EA8FE91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: combase.pdb8 source: WerFault.exe, 0000000D.00000003.375037408.000001EA8FE91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: elbase.pdb source: WerFault.exe, 0000000D.00000002.379074933.000001EA8D552000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000D.00000003.370270156.000001EA8D563000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: win32u.pdb8 source: WerFault.exe, 0000000D.00000003.375083510.000001EA8FE94000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000D.00000003.375037408.000001EA8FE91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 0000000D.00000003.375037408.000001EA8FE91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msctf.pdb source: WerFault.exe, 0000000D.00000003.375045922.000001EA8FE97000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000D.00000003.375091188.000001EA8FE97000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: gdi32full.pdb8 source: WerFault.exe, 0000000D.00000003.375083510.000001EA8FE94000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000D.00000003.375037408.000001EA8FE91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: gdi32.pdb8 source: WerFault.exe, 0000000D.00000003.375083510.000001EA8FE94000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000D.00000003.375037408.000001EA8FE91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: user32.pdb source: WerFault.exe, 0000000D.00000003.375037408.000001EA8FE91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 0000000D.00000003.375077557.000001EA8FE90000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rundll32.pdb8 source: WerFault.exe, 0000000D.00000003.375037408.000001EA8FE91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rpcrt4.pdb8 source: WerFault.exe, 0000000D.00000003.375037408.000001EA8FE91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 0000000D.00000003.375037408.000001EA8FE91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: imagehlp.pdb8 source: WerFault.exe, 0000000D.00000003.375037408.000001EA8FE91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: WerFault.exe, 0000000D.00000003.370270156.000001EA8D563000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000D.00000003.373102112.000001EA8F2EA000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000D.00000003.359276516.000001EA8F2EA000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000D.00000003.375037408.000001EA8FE91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 0000000D.00000003.375037408.000001EA8FE91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: kernel32.pdb source: WerFault.exe, 0000000D.00000003.371722395.000001EA8F2F1000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000D.00000003.370270156.000001EA8D563000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000D.00000003.359287144.000001EA8F2F1000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000D.00000003.375037408.000001EA8FE91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dwmapi.pdb6V source: WerFault.exe, 0000000D.00000003.375045922.000001EA8FE97000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000D.00000003.375091188.000001EA8FE97000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rundll32.pdb source: WerFault.exe, 0000000D.00000003.359149665.000001EA8F2E4000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000D.00000003.370270156.000001EA8D563000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000D.00000003.375037408.000001EA8FE91000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000D.00000003.359079833.000001EA8F379000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msvcrt.pdb8 source: WerFault.exe, 0000000D.00000003.375037408.000001EA8FE91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: oleaut32.pdb source: WerFault.exe, 0000000D.00000003.375045922.000001EA8FE97000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000D.00000003.375091188.000001EA8FE97000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msctf.pdb!V source: WerFault.exe, 0000000D.00000003.375045922.000001EA8FE97000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000D.00000003.375091188.000001EA8FE97000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb8 source: WerFault.exe, 0000000D.00000003.375037408.000001EA8FE91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: imagehlp.pdb source: WerFault.exe, 0000000D.00000003.375037408.000001EA8FE91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: win32u.pdb source: WerFault.exe, 0000000D.00000003.375083510.000001EA8FE94000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000D.00000003.375037408.000001EA8FE91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: gdi32full.pdb source: WerFault.exe, 0000000D.00000003.375083510.000001EA8FE94000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000D.00000003.375037408.000001EA8FE91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: kernel32.pdb8 source: WerFault.exe, 0000000D.00000003.375037408.000001EA8FE91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: user32.pdb8 source: WerFault.exe, 0000000D.00000003.375037408.000001EA8FE91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dwmapi.pdb source: WerFault.exe, 0000000D.00000003.375045922.000001EA8FE97000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000D.00000003.375091188.000001EA8FE97000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb0 source: WerFault.exe, 0000000D.00000003.373102112.000001EA8F2EA000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000D.00000003.359276516.000001EA8F2EA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: kernelbase.pdb source: WerFault.exe, 0000000D.00000003.359316080.000001EA8F2F7000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000D.00000003.370137520.000001EA8F2F7000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000D.00000003.375037408.000001EA8FE91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: kernel32.pdb0 source: WerFault.exe, 0000000D.00000003.371722395.000001EA8F2F1000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000D.00000003.359287144.000001EA8F2F1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: imm32.pdb source: WerFault.exe, 0000000D.00000003.375077557.000001EA8FE90000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FFC130FB9B0 LoadLibraryA,GetProcAddress,

Source: C:\Windows\System32\loaddll64.exe

Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\pzG0rkIchr.dll

Hooking and other Techniques for Hiding and Protection

Yara detected Ursnif

Source: Yara match	File source: Process Memory Space: loaddll64.exe PID: 1556, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: regsvr32.exe PID: 2356, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 5268, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 5264, type: MEMORYSTR

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX

Source: C:\Windows\System32\loaddll64.exe TID: 1568	Thread sleep time: -120000s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 2516	Thread sleep time: -60000s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 2768	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\regsvr32.exe	Last function: Thread delayed

Source: C:\Windows\System32\rundll32.exe

API coverage: 3.7 %

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC130EFB70 FindFirstFileExA,
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFC130EFB70 FindFirstFileExA,
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFC130EFB70 FindFirstFileExA,

Source: C:\Windows\System32\loaddll64.exe

Thread delayed: delay time: 120000

Source: C:\Windows\System32\loaddll64.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\System32\loaddll64.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\System32\loaddll64.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\System32\regsvr32.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\System32\regsvr32.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\System32\regsvr32.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\System32\rundll32.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\System32\rundll32.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\System32\rundll32.exe	API call chain: ExitProcess graph end node

Source: WerFault.exe, 0000000D.00000003.376776710.000001EA8F378000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000D.00000003.376906678.000001EA8F37C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllqCWW
Source: regsvr32.exe, 00000003.00000002.641033491.000000000078E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000003.596506826.000000000078D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: WerFault.exe, 0000000D.00000003.378482368.000001EA8F388000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000D.00000002.379511936.000001EA8F368000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: regsvr32.exe, 00000003.00000003.466330233.00000000007E8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000003.596495160.00000000007E8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000003.531293534.00000000007E8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000003.401143685.00000000007E8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000002.641359278.00000000007E8000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000D.00000002.379494368.000001EA8F35C000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000D.00000003.378323908.000001EA8F35C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: regsvr32.exe, 00000003.00000003.466330233.00000000007E8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000003.596495160.00000000007E8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000003.531293534.00000000007E8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000003.401143685.00000000007E8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000002.641359278.00000000007E8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWa[g6

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FFC130EBC0C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FFC130FB9B0 LoadLibraryA,GetProcAddress,

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FFC130E2380 GetProcessHeap,HeapAlloc,CreateFileA,TryEnterCriticalSection,

Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort

Source: C:\Windows\System32\rundll32.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6136 -s 304

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC130EBC0C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC130EE374 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFC130F6DA4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFC130EBC0C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFC130EE374 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFC130F6DA4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFC130EBC0C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFC130EE374 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFC130F6DA4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\regsvr32.exe	Network Connect: 185.250.148.35 443
Source: C:\Windows\System32\regsvr32.exe	Domain query: gigimas.xyz

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\pzG0rkIchr.dll",#1
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6136 -s 304

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FFC130F65F0 cpuid

Source: C:\Windows\System32\regsvr32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FFC130FED60 CreateNamedPipeA,

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FFC130EBB08 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

Stealing of Sensitive Information

Yara detected Ursnif

Source: Yara match	File source: Process Memory Space: loaddll64.exe PID: 1556, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: regsvr32.exe PID: 2356, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 5268, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 5264, type: MEMORYSTR

Remote Access Functionality

Yara detected Ursnif

Source: Yara match	File source: Process Memory Space: loaddll64.exe PID: 1556, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: regsvr32.exe PID: 2356, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 5268, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 5264, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Native API	1 DLL Side-Loading	112 Process Injection	1 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	12 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	21 Virtualization/Sandbox Evasion	LSASS Memory	31 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	112 Process Injection	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	2 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Regsvr32	NTDS	1 Remote System Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Rundll32	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 DLL Side-Loading	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
pzG0rkIchr.dll	57%	Virustotal		Browse
pzG0rkIchr.dll	73%	ReversingLabs	Win64.Trojan.Tnega

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
gigimas.xyz	14%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://gigimas.xyz	0%	Avira URL Cloud	safe
https://gigimas.xyz	11%	Virustotal		Browse
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	0%	URL Reputation	safe
https://gigimas.xyz/index.html9Pu/Jl	0%	Avira URL Cloud	safe
https://gigimas.xyz/index.html5F	0%	Avira URL Cloud	safe
https://gigimas.xyz/index.html	0%	Avira URL Cloud	safe
https://gigimas.xyz/index.htmlT	0%	Avira URL Cloud	safe
https://http://Mozilla/5.0	0%	Avira URL Cloud	safe
https://gigimas.xyzhttps://reaso.xyz	0%	Avira URL Cloud	safe
https://gigimas.xyz/index.htmlm	0%	Avira URL Cloud	safe
https://gigimas.xyz:443/index.htmlY_	0%	Avira URL Cloud	safe
https://gigimas.xyz:443/index.html	0%	Avira URL Cloud	safe
https://gigimas.xyz/	0%	Avira URL Cloud	safe
https://reaso.xyz	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
gigimas.xyz	185.250.148.35	true	true	14%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://gigimas.xyz	loaddll64.exe, 00000000.00000003.631018067.0000020164340000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000002.641761210.00000000021BD000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000002.641543041.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.357258070.0000017B374A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.357488590.00000201A4290000.00000004.00000020.00020000.00000000.sdmp	true	11%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	pzG0rkIchr.dll	false	URL Reputation: safe	unknown
https://sectigo.com/CPS0	pzG0rkIchr.dll	false	URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	pzG0rkIchr.dll	false	URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	pzG0rkIchr.dll	false	URL Reputation: safe	unknown
http://ocsp.sectigo.com0	pzG0rkIchr.dll	false	URL Reputation: safe	unknown
https://gigimas.xyz/index.html9Pu/Jl	regsvr32.exe, 00000003.00000003.466312748.00000000007DD000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://gigimas.xyz/index.html5F	regsvr32.exe, 00000003.00000003.596495160.00000000007E8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000002.641359278.00000000007E8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://http://Mozilla/5.0	loaddll64.exe, 00000000.00000003.631032238.0000020164342000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000002.641554871.00000000020E2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.357262173.0000017B374A2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.357492545.00000201A4292000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	pzG0rkIchr.dll	false	URL Reputation: safe	unknown
https://gigimas.xyz/index.html	regsvr32.exe, 00000003.00000003.466330233.00000000007E8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000003.596506826.000000000078D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000003.596495160.00000000007E8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000003.531293534.00000000007E8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000002.641359278.00000000007E8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://gigimas.xyz/index.htmlT	regsvr32.exe, 00000003.00000002.641214444.00000000007C6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000003.596466270.00000000007C6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000003.531265696.00000000007C6000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	pzG0rkIchr.dll	false	URL Reputation: safe	unknown
https://gigimas.xyzhttps://reaso.xyz	regsvr32.exe, 00000003.00000002.641761210.00000000021BD000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://gigimas.xyz/index.htmlm	regsvr32.exe, 00000003.00000002.641004710.0000000000785000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	pzG0rkIchr.dll	false	URL Reputation: safe	unknown
https://gigimas.xyz/	regsvr32.exe, 00000003.00000003.466330233.00000000007E8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000003.596495160.00000000007E8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000003.595788178.0000000000815000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000003.531293534.00000000007E8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000002.641484903.0000000000813000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000003.596407001.0000000000813000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000002.641359278.00000000007E8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000003.466249755.00000000007A9000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://gigimas.xyz:443/index.htmlY_	regsvr32.exe, 00000003.00000003.596495160.00000000007E8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000002.641359278.00000000007E8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://reaso.xyz	regsvr32.exe, 00000003.00000002.641761210.00000000021BD000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000002.641543041.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.357258070.0000017B374A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.357488590.00000201A4290000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://gigimas.xyz:443/index.html	regsvr32.exe, 00000003.00000003.531293534.00000000007E8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.250.148.35	gigimas.xyz	Russian Federation		48430	FIRSTDC-ASRU	true

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	752975
Start date and time:	2022-11-24 05:29:36 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 27s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	pzG0rkIchr.dll
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal92.troj.evad.winDLL@19/8@4/2
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 78% (good quality ratio 69.5%) Quality average: 59.8% Quality standard deviation: 32.6%
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .dll Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.65.92
Excluded domains from analysis (whitelisted): fs.microsoft.com, onedsblobprdeus17.eastus.cloudapp.azure.com, login.live.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, watson.telemetry.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtProtectVirtualMemory calls found.

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_pzG_206411b7d18c8b51ef308e99261d801f59953bc0_4f0e5919_15ebd55f\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7599332074807373
Encrypted:	false
SSDEEP:	96:YImFlZZFiWpJPnyijs55P7HfgpXIQcQdc6/RcENcw3VXaXz+HbHgSQgJPbJIDV9+:nm3FiYJKgHz9XpjEI/u7sGOS274ltC
MD5:	4D7AD4D16E977190A93A4217F65D5552
SHA1:	4C633364E29B27CC5520425ACF90D722D0615F55
SHA-256:	538A208795EC006468C02E86FF3F447417F354986183D6CF0BB1202C6DCD6B33
SHA-512:	E9A45DA51EF7DB62A595D2FA006C1FD4E4E2B307822E7AED13001CA6517DBFDA7B4D9ECB4B77B11784C4F5ADA883C7DB69F9E028D3C6D9B95023BD486973B102
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.1.3.7.7.0.2.8.9.3.4.1.7.5.1.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.1.3.7.7.0.2.9.0.4.3.5.3.8.3.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.4.5.a.7.c.8.e.-.c.e.f.3.-.4.d.d.a.-.9.e.b.5.-.3.1.5.6.4.a.f.2.e.c.5.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.e.c.2.f.5.9.5.-.e.a.9.0.-.4.6.7.7.-.b.6.a.3.-.f.0.b.e.2.d.9.9.5.5.b.5.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.p.z.G.0.r.k.I.c.h.r...d.l.l.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.7.f.8.-.0.0.0.1.-.0.0.1.f.-.2.0.5.2.-.d.3.f.1.0.8.0.0.d.9.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.2.f.3.4.c.c.f.d.d.8.1.4.1.a.e.e.e.2.e.8.9.f.f.b.0.7.0.c.e.2.3.9.c.7.d.0.0.7.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_pzG_738eef979a666465c6051ddd5fef4b7e70c91a_4f0e5919_15905d59\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7588806812185113
Encrypted:	false
SSDEEP:	96:EtaFiDJPnycjs551DW9SspXIQcQQGc6bcEKcw3UUeXaXz+HbHgSQgJPbph88WpOX:sciDJKWH1fQ4Ucjpe/u7sGOS274lt9
MD5:	970AE762D984AB0562EF2DDEE4F7F71C
SHA1:	BB145548E992EC8183CD51D92E4C3494DE7B0EC1
SHA-256:	402CD5EB9A3A996EB553A8C5485895A3AD576D1556CCCB08E20366B7A3C00A40
SHA-512:	794C6926A380144449AA7C24BA1407D67EA8A41F89ABAD333313D324799DBC1F4C76D52F49A91D112AF60FCA87CA01F12F0F7648B4AAB095A5AB367A8DDE84AA
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.6.4.....E.v.e.n.t.T.i.m.e.=.1.3.3.1.3.7.7.0.2.5.5.9.0.6.7.1.6.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.1.3.7.7.0.2.7.4.4.0.6.6.7.6.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.9.e.6.c.7.3.8.-.b.f.f.7.-.4.b.6.8.-.b.7.e.a.-.0.d.5.0.5.d.9.5.7.9.4.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.4.9.2.a.f.f.d.-.7.3.5.e.-.4.c.a.7.-.a.0.e.b.-.9.9.7.a.b.a.e.1.b.4.1.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.p.z.G.0.r.k.I.c.h.r...d.l.l.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.7.9.c.-.0.0.0.1.-.0.0.1.f.-.0.3.9.0.-.a.1.e.e.0.8.0.0.d.9.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.2.f.3.4.c.c.f.d.d.8.1.4.1.a.e.e.e.2.e.8.9.f.f.b.0.7.0.c.e.2.3.9.c.7.d.0.0.7.0.6.!.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER148A.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8606
Entropy (8bit):	3.6917131740684326
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNibXpiH6YmObgmf9lpSDUf9CpDz89bv7QfAFm:RrlsNiLpiH6Yvbgmf9lpSWv8fv
MD5:	A25026BF04BD3F85B66322DD4EACE463
SHA1:	3E6F42AACBDC7749C351F4040836974F0FE849E8
SHA-256:	EF29167FAC14085CEDC2B51E3DD871909F41CF22CD799EE08F16E10BC5F25340
SHA-512:	7AF918F7B179540C5C0250F8E7C698AEFA2B7873F29B792D886EA8256C447CA561DA47EC2668FB3972F8F954F438D84DF8C98E8C447248C17C7FD927D4793FD3
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.0.4.4.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1BBF.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4852
Entropy (8bit):	4.453732860738506
Encrypted:	false
SSDEEP:	48:cvIwSD8zs/JgtBI9C0Wgc8sqYjHs8fm8M4JCXCODFSoyq8vhObZESC5S6d:uITfhEtgrsqYTRJeWqVv6d
MD5:	36514A65B9F12B58AFD0BBEC14BB306B
SHA1:	708D342C0B5E7C27C165196A66BA72199935C035
SHA-256:	1E2FDEB64300A379966992E05CDCED721176C203B2AEA77D8521699282520391
SHA-512:	0042E849F66066FE1C66E48516FCD7B735C49DB80A33C73C025965CC1544002AD8246D1716241A37BD1855EF92F2DB6540A3373E1D7E89B58447CAD2420BA6A9
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1794161" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCC66.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Nov 24 13:31:29 2022, 0x1205a4 type
Category:	dropped
Size (bytes):	57126
Entropy (8bit):	1.6752029810543265
Encrypted:	false
SSDEEP:	192:QRENUeRlXOC5Ky21na9OBQpyomWlAgh0l:XeC0VQ9Oupy
MD5:	15A22FD2F4CA8ECE4C09E779E8BF5301
SHA1:	CF2A33C45D5845C636A662FBC221FF128EFFE3D2
SHA-256:	32AE357A2D002F95865AC8D24FA48BEEC756DF4547D071DA783E4676C7DE6702
SHA-512:	532611BDCDEE7F036330CAEB750CA8681D325436E10FF99A3F12B55C97ABC60D206C7105F426E3E76A10F88F9B2EE8D5C000E752DEDA295729A94B0DC84161D6
Malicious:	false
Preview:	MDMP....... .......1r.c.........................................)..........T.......8...........T...............F...........T...........@....................................................................U...........B..............Lw.....................T............r.c.............................0..................P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCF55.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8528
Entropy (8bit):	3.6927747114398133
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNiXByMiO6Ymf7lay5gmfQeSiR9CprRA89bNz14fsDvm:RrlsNixNiO6YOngmfQeSh9Nzafl
MD5:	62C5858D004322A987DA836EAAFCF3D0
SHA1:	92F1D11A4FFAF0BC607AD9D80B0733B9C0AF776C
SHA-256:	E4ADEDF6BDB44F7A887C8FAEFA13E8932F54043F510FC6E6F6C9AD763A3D5E0E
SHA-512:	2244B303A7B773AE32265E693A04F0DA0A6A1BD91CF90B58BD31F51770ECA29D0D7A8DEB1E80090473442B0E03FCDBAB3F6A377970F38D5F9211160FD7739682
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.1.3.6.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD021.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4733
Entropy (8bit):	4.475037901948798
Encrypted:	false
SSDEEP:	48:cvIwSD8zsKJgtBI9C0Wgc8sqYjK8fm8M4JCXCO/Flyq85m2knZESC5Sgd:uITfYEtgrsqYLJCTnVvgd
MD5:	B4E9E6B35D1BFAE0CB99ADA1D8BA4FB0
SHA1:	000AD3F75949E7EB512EA021578BBCF408B9AB13
SHA-256:	256C84BFDE399833C36F0B05ED98CD72BC1507AE7C28D6DE773C33253673138B
SHA-512:	A55F7E52226C64C2A45E23FA853E1DA40F9D8DC41F8488A1F634AEB597EE0EE61056CC453C7AAA61B35751E720B0504EA500D7A0FE7652D988AC45BBACE39349
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1794162" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDC43.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Nov 24 13:31:09 2022, 0x1205a4 type
Category:	dropped
Size (bytes):	31470
Entropy (8bit):	2.120966153641428
Encrypted:	false
SSDEEP:	96:5U8oyl8/7PSDKwNULtCTy+poi7C5VZ5ro8189EzF5oFPV4sGvTWIXmIf4ywMGVl9:FoyWocCTyOC5KwzzoAtkUWa
MD5:	53678B23171E44FF503435C4B6EE4E82
SHA1:	CBBF51D8D6EC4215E00C23AE2CB2DDEE3D01CF47
SHA-256:	EBE61E60D7251461BAA6A84830EBD1CA17739D2616F7DB1BD0555EBCE7BE7F4A
SHA-512:	EAFB2D40ACE89BDF7B02C147E9C69D9FADEBD0000C1260C46078197DA96E561B571A5BEC7D653A614A8BAEE730299C8F78C5FA7380557B3F3D86542FA0324D6A
Malicious:	false
Preview:	MDMP....... ........r.c............4...........L...H.......$...........T...z...........`.......8...........T...........(....o...........................................................................................U...........B......<.......Lw......................T............q.c.............................0..................P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy (8bit):	6.637392883592079
TrID:	Win64 Dynamic Link Library (generic) (102004/3) 86.43% Win64 Executable (generic) (12005/4) 10.17% Generic Win/DOS Executable (2004/3) 1.70% DOS Executable Generic (2002/1) 1.70% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.01%
File name:	pzG0rkIchr.dll
File size:	290568
MD5:	d6ef4778f7dc9c31a0a2a989ef42d2fd
SHA1:	5dad8394ef37d5a006674589754f7a3187d303b1
SHA256:	54de1f2c26a63a8f6b7f8d5de99f8ebd4093959ab07f027db1985d0652258736
SHA512:	997b57424364ff661d80ca6efc5b7e91f2204d1ed7c4d784ee7d6134bc06952c993de038d6a25c71a7949b08ddd8cc5d167f8c753379f69ee1b6b49342fafa63
SSDEEP:	6144:wHyvumb1p7CC8VoxOJbceNOHI2Tse2RTggR/Znv+yit:Smbrgu2so2TVwcK/ZnG/t
TLSH:	ED54BF41F3D904A6D9138D3D8857562BEBF13C212214DA5F8B50C36A6F37BA1E739B22
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......!5..eT..eT..eT....Z.`T....X..T....Y.hT..^...bT..^...qT..^...uT....`.fT..eT...T......gT......dT......dT..RicheT..........PE..d..

File Icon


Icon Hash:	74f0e4ecccdce0e4

Static PE Info

General

Entrypoint:	0x18000b6ec
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x180000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, DLL
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x62C42DD7 [Tue Jul 5 12:25:59 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	4270d9bbb54b179372d82277269282e6

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=Sectigo Public Code Signing CA R36, O=Sectigo Limited, C=GB
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	7/5/2021 5:00:00 PM 7/6/2022 4:59:59 PM
Subject Chain	CN=NAILS UNLIMITED LIMITED, O=NAILS UNLIMITED LIMITED, L=DORCHESTER, S=Dorset, C=GB
Version:	3
Thumbprint MD5:	71834A68FD130C9D08796B4F19A6FC67
Thumbprint SHA-1:	CA69087AAAA087346202AD16228337130511C4C5
Thumbprint SHA-256:	F13E4801E13898E839183E3305E1DDA7F4C0EBF6EAF7553E18C1DDD4EDC94470
Serial:	2F96A89BFEC6E44DD224E8FD7E72D9BB

Entrypoint Preview

Instruction
dec eax
mov dword ptr [esp+08h], ebx
dec eax
mov dword ptr [esp+10h], esi
push edi
dec eax
sub esp, 20h
dec ecx
mov edi, eax
mov ebx, edx
dec eax
mov esi, ecx
cmp edx, 01h
jne 00007FBFC4794AE7h
call 00007FBFC4794EE0h
dec esp
mov eax, edi
mov edx, ebx
dec eax
mov ecx, esi
dec eax
mov ebx, dword ptr [esp+30h]
dec eax
mov esi, dword ptr [esp+38h]
dec eax
add esp, 20h
pop edi
jmp 00007FBFC479495Ch
int3
int3
int3
dec eax
sub esp, 28h
call 00007FBFC4795378h
test eax, eax
je 00007FBFC4794B03h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007FBFC4794AE7h
dec eax
cmp ecx, eax
je 00007FBFC4794AF6h
xor eax, eax
dec eax
cmpxchg dword ptr [00038A68h], ecx
jne 00007FBFC4794AD0h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007FBFC4794AD9h
int3
int3
int3
dec eax
sub esp, 28h
call 00007FBFC479533Ch
test eax, eax
je 00007FBFC4794AE9h
call 00007FBFC479515Fh
jmp 00007FBFC4794AFBh
call 00007FBFC4795324h
mov ecx, eax
call 00007FBFC4796A91h
test eax, eax
je 00007FBFC4794AE6h
xor al, al
jmp 00007FBFC4794AE9h
call 00007FBFC4796E18h
mov al, 01h
dec eax
add esp, 28h
ret
dec eax
sub esp, 28h
xor ecx, ecx
call 00007FBFC4794C26h
test al, al
setne al
dec eax
add esp, 28h
ret
int3
int3

Rich Headers

Programming Language:

[C++] VS2015 UPD3.1 build 24215
[EXP] VS2015 UPD3.1 build 24215
[LNK] VS2015 UPD3.1 build 24215

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x371c0	0x94	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x37254	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x46000	0x15cc	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x44600	0x2908
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x49000	0x618	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x34dd0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x34df0	0x94	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x23000	0x2a8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x21390	0x21400	False	0.6091694078947368	zlib compressed data	6.321988758719223	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x23000	0x14b40	0x14c00	False	0.5551228350903614	data	5.589680054404924	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x38000	0xd378	0xc200	False	0.581286243556701	data	4.475772855701728	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x46000	0x15cc	0x1600	False	0.49556107954545453	data	5.3249872988992655	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.gfids	0x48000	0x94	0x200	False	0.248046875	data	1.4095612964443904	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x49000	0x618	0x800	False	0.54150390625	data	4.760086879502757	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL

Import

KERNEL32.dll

CreateFileA, LockFile, ReadFile, SetEndOfFile, UnlockFile, CloseHandle, PeekNamedPipe, HeapCreate, HeapAlloc, HeapFree, GetProcessHeap, HeapWalk, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, TryEnterCriticalSection, DeleteCriticalSection, WaitForSingleObject, ExitProcess, CreateThread, VirtualAlloc, GetProcAddress, CreateFileMappingA, LoadLibraryA, CreateNamedPipeA, CallNamedPipeA, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, IsProcessorFeaturePresent, GetModuleHandleW, RtlUnwindEx, InterlockedFlushSList, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, GetCurrentProcess, TerminateProcess, GetModuleHandleExW, GetModuleFileNameA, MultiByteToWideChar, WideCharToMultiByte, LCMapStringW, FindClose, FindFirstFileExA, FindNextFileA, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetStdHandle, GetFileType, GetStringTypeW, CreateFileW, HeapSize, HeapReAlloc, SetStdHandle, FlushFileBuffers, WriteFile, GetConsoleCP, GetConsoleMode, ReadConsoleW, SetFilePointerEx, WriteConsoleW, RaiseException

Exports

Name	Ordinal	Address
DllRegisterServer	1	0x180002380
ItsnPq5v	2	0x180002390
QlqYo259k	3	0x180017c20
XeFnYZ409	4	0x1800175e0

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.48.8.8.864906532039645 11/24/22-05:22:35.810533	UDP	2039645	ET TROJAN Observed DNS Query to Ursnif Domain (gigimas .xyz)	64906	53	192.168.2.4	8.8.8.8
192.168.2.48.8.8.861007532039645 11/24/22-05:20:02.978332	UDP	2039645	ET TROJAN Observed DNS Query to Ursnif Domain (gigimas .xyz)	61007	53	192.168.2.4	8.8.8.8
192.168.2.48.8.8.861124532039645 11/24/22-05:21:04.451832	UDP	2039645	ET TROJAN Observed DNS Query to Ursnif Domain (gigimas .xyz)	61124	53	192.168.2.4	8.8.8.8
192.168.2.48.8.8.859444532039645 11/24/22-05:21:34.871041	UDP	2039645	ET TROJAN Observed DNS Query to Ursnif Domain (gigimas .xyz)	59444	53	192.168.2.4	8.8.8.8
192.168.2.48.8.8.855570532039645 11/24/22-05:22:05.359167	UDP	2039645	ET TROJAN Observed DNS Query to Ursnif Domain (gigimas .xyz)	55570	53	192.168.2.4	8.8.8.8
192.168.2.48.8.8.860686532039645 11/24/22-05:20:33.386749	UDP	2039645	ET TROJAN Observed DNS Query to Ursnif Domain (gigimas .xyz)	60686	53	192.168.2.4	8.8.8.8
192.168.2.48.8.8.859446532039645 11/24/22-05:23:06.390786	UDP	2039645	ET TROJAN Observed DNS Query to Ursnif Domain (gigimas .xyz)	59446	53	192.168.2.4	8.8.8.8

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 24, 2022 05:31:42.779120922 CET	49713	443	192.168.2.3	185.250.148.35
Nov 24, 2022 05:31:42.779216051 CET	443	49713	185.250.148.35	192.168.2.3
Nov 24, 2022 05:31:42.779381990 CET	49713	443	192.168.2.3	185.250.148.35
Nov 24, 2022 05:31:42.783556938 CET	49713	443	192.168.2.3	185.250.148.35
Nov 24, 2022 05:31:42.783611059 CET	443	49713	185.250.148.35	192.168.2.3
Nov 24, 2022 05:31:42.841033936 CET	443	49713	185.250.148.35	192.168.2.3
Nov 24, 2022 05:31:42.848084927 CET	49714	443	192.168.2.3	185.250.148.35
Nov 24, 2022 05:31:42.848155022 CET	443	49714	185.250.148.35	192.168.2.3
Nov 24, 2022 05:31:42.848277092 CET	49714	443	192.168.2.3	185.250.148.35
Nov 24, 2022 05:31:42.849534035 CET	49714	443	192.168.2.3	185.250.148.35
Nov 24, 2022 05:31:42.849570036 CET	443	49714	185.250.148.35	192.168.2.3
Nov 24, 2022 05:31:42.906461954 CET	443	49714	185.250.148.35	192.168.2.3
Nov 24, 2022 05:31:42.909106970 CET	49715	443	192.168.2.3	185.250.148.35
Nov 24, 2022 05:31:42.909188032 CET	443	49715	185.250.148.35	192.168.2.3
Nov 24, 2022 05:31:42.910044909 CET	49715	443	192.168.2.3	185.250.148.35
Nov 24, 2022 05:31:42.910046101 CET	49715	443	192.168.2.3	185.250.148.35
Nov 24, 2022 05:31:42.910130024 CET	443	49715	185.250.148.35	192.168.2.3
Nov 24, 2022 05:31:42.965094090 CET	443	49715	185.250.148.35	192.168.2.3
Nov 24, 2022 05:31:42.970076084 CET	49716	443	192.168.2.3	185.250.148.35
Nov 24, 2022 05:31:42.970132113 CET	443	49716	185.250.148.35	192.168.2.3
Nov 24, 2022 05:31:42.970264912 CET	49716	443	192.168.2.3	185.250.148.35
Nov 24, 2022 05:31:42.971513033 CET	49716	443	192.168.2.3	185.250.148.35
Nov 24, 2022 05:31:42.971546888 CET	443	49716	185.250.148.35	192.168.2.3
Nov 24, 2022 05:31:43.027291059 CET	443	49716	185.250.148.35	192.168.2.3
Nov 24, 2022 05:32:13.139549971 CET	49717	443	192.168.2.3	185.250.148.35
Nov 24, 2022 05:32:13.139607906 CET	443	49717	185.250.148.35	192.168.2.3
Nov 24, 2022 05:32:13.139703989 CET	49717	443	192.168.2.3	185.250.148.35
Nov 24, 2022 05:32:13.140322924 CET	49717	443	192.168.2.3	185.250.148.35
Nov 24, 2022 05:32:13.140345097 CET	443	49717	185.250.148.35	192.168.2.3
Nov 24, 2022 05:32:13.197118044 CET	443	49717	185.250.148.35	192.168.2.3
Nov 24, 2022 05:32:13.198286057 CET	49718	443	192.168.2.3	185.250.148.35
Nov 24, 2022 05:32:13.198349953 CET	443	49718	185.250.148.35	192.168.2.3
Nov 24, 2022 05:32:13.198457003 CET	49718	443	192.168.2.3	185.250.148.35
Nov 24, 2022 05:32:13.198988914 CET	49718	443	192.168.2.3	185.250.148.35
Nov 24, 2022 05:32:13.199012041 CET	443	49718	185.250.148.35	192.168.2.3
Nov 24, 2022 05:32:13.256309032 CET	443	49718	185.250.148.35	192.168.2.3
Nov 24, 2022 05:32:13.257666111 CET	49719	443	192.168.2.3	185.250.148.35
Nov 24, 2022 05:32:13.257718086 CET	443	49719	185.250.148.35	192.168.2.3
Nov 24, 2022 05:32:13.257812023 CET	49719	443	192.168.2.3	185.250.148.35
Nov 24, 2022 05:32:13.258507013 CET	49719	443	192.168.2.3	185.250.148.35
Nov 24, 2022 05:32:13.258538961 CET	443	49719	185.250.148.35	192.168.2.3
Nov 24, 2022 05:32:13.315129042 CET	443	49719	185.250.148.35	192.168.2.3
Nov 24, 2022 05:32:13.322362900 CET	49720	443	192.168.2.3	185.250.148.35
Nov 24, 2022 05:32:13.322433949 CET	443	49720	185.250.148.35	192.168.2.3
Nov 24, 2022 05:32:13.322513103 CET	49720	443	192.168.2.3	185.250.148.35
Nov 24, 2022 05:32:13.323424101 CET	49720	443	192.168.2.3	185.250.148.35
Nov 24, 2022 05:32:13.323457956 CET	443	49720	185.250.148.35	192.168.2.3
Nov 24, 2022 05:32:13.379005909 CET	443	49720	185.250.148.35	192.168.2.3
Nov 24, 2022 05:32:43.484684944 CET	49721	443	192.168.2.3	185.250.148.35
Nov 24, 2022 05:32:43.484752893 CET	443	49721	185.250.148.35	192.168.2.3
Nov 24, 2022 05:32:43.484850883 CET	49721	443	192.168.2.3	185.250.148.35
Nov 24, 2022 05:32:43.485667944 CET	49721	443	192.168.2.3	185.250.148.35
Nov 24, 2022 05:32:43.485697031 CET	443	49721	185.250.148.35	192.168.2.3
Nov 24, 2022 05:32:43.541486025 CET	443	49721	185.250.148.35	192.168.2.3
Nov 24, 2022 05:32:43.542974949 CET	49722	443	192.168.2.3	185.250.148.35
Nov 24, 2022 05:32:43.543049097 CET	443	49722	185.250.148.35	192.168.2.3
Nov 24, 2022 05:32:43.543201923 CET	49722	443	192.168.2.3	185.250.148.35
Nov 24, 2022 05:32:43.543780088 CET	49722	443	192.168.2.3	185.250.148.35
Nov 24, 2022 05:32:43.543811083 CET	443	49722	185.250.148.35	192.168.2.3
Nov 24, 2022 05:32:43.601726055 CET	443	49722	185.250.148.35	192.168.2.3
Nov 24, 2022 05:32:43.611546993 CET	49723	443	192.168.2.3	185.250.148.35
Nov 24, 2022 05:32:43.611643076 CET	443	49723	185.250.148.35	192.168.2.3
Nov 24, 2022 05:32:43.611826897 CET	49723	443	192.168.2.3	185.250.148.35
Nov 24, 2022 05:32:43.612270117 CET	49723	443	192.168.2.3	185.250.148.35
Nov 24, 2022 05:32:43.612310886 CET	443	49723	185.250.148.35	192.168.2.3
Nov 24, 2022 05:32:43.669603109 CET	443	49723	185.250.148.35	192.168.2.3
Nov 24, 2022 05:32:43.671479940 CET	49724	443	192.168.2.3	185.250.148.35
Nov 24, 2022 05:32:43.671566963 CET	443	49724	185.250.148.35	192.168.2.3
Nov 24, 2022 05:32:43.671897888 CET	49724	443	192.168.2.3	185.250.148.35
Nov 24, 2022 05:32:43.672238111 CET	49724	443	192.168.2.3	185.250.148.35
Nov 24, 2022 05:32:43.672307014 CET	443	49724	185.250.148.35	192.168.2.3
Nov 24, 2022 05:32:43.729829073 CET	443	49724	185.250.148.35	192.168.2.3
Nov 24, 2022 05:33:13.901851892 CET	49725	443	192.168.2.3	185.250.148.35
Nov 24, 2022 05:33:13.901915073 CET	443	49725	185.250.148.35	192.168.2.3
Nov 24, 2022 05:33:13.902000904 CET	49725	443	192.168.2.3	185.250.148.35
Nov 24, 2022 05:33:13.902689934 CET	49725	443	192.168.2.3	185.250.148.35
Nov 24, 2022 05:33:13.902705908 CET	443	49725	185.250.148.35	192.168.2.3
Nov 24, 2022 05:33:13.958076000 CET	443	49725	185.250.148.35	192.168.2.3
Nov 24, 2022 05:33:13.960711002 CET	49726	443	192.168.2.3	185.250.148.35
Nov 24, 2022 05:33:13.960813999 CET	443	49726	185.250.148.35	192.168.2.3
Nov 24, 2022 05:33:13.961004019 CET	49726	443	192.168.2.3	185.250.148.35
Nov 24, 2022 05:33:13.962261915 CET	49726	443	192.168.2.3	185.250.148.35
Nov 24, 2022 05:33:13.962327957 CET	443	49726	185.250.148.35	192.168.2.3
Nov 24, 2022 05:33:14.020241976 CET	443	49726	185.250.148.35	192.168.2.3
Nov 24, 2022 05:33:14.022346973 CET	49727	443	192.168.2.3	185.250.148.35
Nov 24, 2022 05:33:14.022407055 CET	443	49727	185.250.148.35	192.168.2.3
Nov 24, 2022 05:33:14.022514105 CET	49727	443	192.168.2.3	185.250.148.35
Nov 24, 2022 05:33:14.023082972 CET	49727	443	192.168.2.3	185.250.148.35
Nov 24, 2022 05:33:14.023117065 CET	443	49727	185.250.148.35	192.168.2.3
Nov 24, 2022 05:33:14.079648018 CET	443	49727	185.250.148.35	192.168.2.3
Nov 24, 2022 05:33:14.083456993 CET	49728	443	192.168.2.3	185.250.148.35
Nov 24, 2022 05:33:14.083499908 CET	443	49728	185.250.148.35	192.168.2.3
Nov 24, 2022 05:33:14.083667040 CET	49728	443	192.168.2.3	185.250.148.35
Nov 24, 2022 05:33:14.084922075 CET	49728	443	192.168.2.3	185.250.148.35
Nov 24, 2022 05:33:14.084939003 CET	443	49728	185.250.148.35	192.168.2.3
Nov 24, 2022 05:33:14.142575026 CET	443	49728	185.250.148.35	192.168.2.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 24, 2022 05:31:42.716654062 CET	53975	53	192.168.2.3	8.8.8.8
Nov 24, 2022 05:31:42.749726057 CET	53	53975	8.8.8.8	192.168.2.3
Nov 24, 2022 05:32:13.117352009 CET	51139	53	192.168.2.3	8.8.8.8
Nov 24, 2022 05:32:13.137461901 CET	53	51139	8.8.8.8	192.168.2.3
Nov 24, 2022 05:32:43.461288929 CET	52955	53	192.168.2.3	8.8.8.8
Nov 24, 2022 05:32:43.481966019 CET	53	52955	8.8.8.8	192.168.2.3
Nov 24, 2022 05:33:13.880306959 CET	60582	53	192.168.2.3	8.8.8.8
Nov 24, 2022 05:33:13.900351048 CET	53	60582	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 24, 2022 05:31:42.716654062 CET	192.168.2.3	8.8.8.8	0xefb3	Standard query (0)	gigimas.xyz	A (IP address)	IN (0x0001)	false
Nov 24, 2022 05:32:13.117352009 CET	192.168.2.3	8.8.8.8	0x493d	Standard query (0)	gigimas.xyz	A (IP address)	IN (0x0001)	false
Nov 24, 2022 05:32:43.461288929 CET	192.168.2.3	8.8.8.8	0x7cb8	Standard query (0)	gigimas.xyz	A (IP address)	IN (0x0001)	false
Nov 24, 2022 05:33:13.880306959 CET	192.168.2.3	8.8.8.8	0xb47a	Standard query (0)	gigimas.xyz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 24, 2022 05:31:42.749726057 CET	8.8.8.8	192.168.2.3	0xefb3	No error (0)	gigimas.xyz	185.250.148.35	A (IP address)	IN (0x0001)	false
Nov 24, 2022 05:32:13.137461901 CET	8.8.8.8	192.168.2.3	0x493d	No error (0)	gigimas.xyz	185.250.148.35	A (IP address)	IN (0x0001)	false
Nov 24, 2022 05:32:43.481966019 CET	8.8.8.8	192.168.2.3	0x7cb8	No error (0)	gigimas.xyz	185.250.148.35	A (IP address)	IN (0x0001)	false
Nov 24, 2022 05:33:13.900351048 CET	8.8.8.8	192.168.2.3	0xb47a	No error (0)	gigimas.xyz	185.250.148.35	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	05:30:30
Start date:	24/11/2022
Path:	C:\Windows\System32\loaddll64.exe
Wow64 process (32bit):	false
Commandline:	loaddll64.exe "C:\Users\user\Desktop\pzG0rkIchr.dll"
Imagebase:	0x7ff719eb0000
File size:	139776 bytes
MD5 hash:	C676FC0263EDD17D4CE7D644B8F3FCD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: conhost.exePID: 4696, Parent PID: 1556

General

Target ID:	1
Start time:	05:30:31
Start date:	24/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: cmd.exePID: 1076, Parent PID: 1556

General

Target ID:	2
Start time:	05:30:31
Start date:	24/11/2022
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\pzG0rkIchr.dll",#1
Imagebase:	0x7ff707bb0000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: regsvr32.exePID: 2356, Parent PID: 1556

General

Target ID:	3
Start time:	05:30:31
Start date:	24/11/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	regsvr32.exe /s C:\Users\user\Desktop\pzG0rkIchr.dll
Imagebase:	0x7ff64da50000
File size:	24064 bytes
MD5 hash:	D78B75FC68247E8A63ACBA846182740E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: rundll32.exePID: 5268, Parent PID: 1076

General

Target ID:	4
Start time:	05:30:31
Start date:	24/11/2022
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\pzG0rkIchr.dll",#1
Imagebase:	0x7ff6f9b90000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: rundll32.exePID: 5264, Parent PID: 1556

General

Target ID:	5
Start time:	05:30:31
Start date:	24/11/2022
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\pzG0rkIchr.dll,DllRegisterServer
Imagebase:	0x7ff6f9b90000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: rundll32.exePID: 6044, Parent PID: 1556

General

Target ID:	6
Start time:	05:30:36
Start date:	24/11/2022
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\pzG0rkIchr.dll,ItsnPq5v
Imagebase:	0x7ff6f9b90000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: rundll32.exePID: 6136, Parent PID: 1556

General

Target ID:	8
Start time:	05:30:40
Start date:	24/11/2022
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\pzG0rkIchr.dll,QlqYo259k
Imagebase:	0x7ff6f9b90000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: WerFault.exePID: 5572, Parent PID: 6044

General

Target ID:	12
Start time:	05:30:50
Start date:	24/11/2022
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 6044 -s 276
Imagebase:	0x7ff679980000
File size:	494488 bytes
MD5 hash:	2AFFE478D86272288BBEF5A00BBEF6A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: WerFault.exePID: 5404, Parent PID: 6136

General

Target ID:	13
Start time:	05:30:50
Start date:	24/11/2022
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 6136 -s 304
Imagebase:	0x7ff679980000
File size:	494488 bytes
MD5 hash:	2AFFE478D86272288BBEF5A00BBEF6A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: WerFault.exePID: 680, Parent PID: 6136

General

Target ID:	14
Start time:	05:31:19
Start date:	24/11/2022
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 6136 -s 304
Imagebase:	0x7ff679980000
File size:	494488 bytes
MD5 hash:	2AFFE478D86272288BBEF5A00BBEF6A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Disassembly

⊘No disassembly

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. Regsvr32.exe is also a Microsoft signed binary.
Tactics:	Defense Evasion
Data Sources:	Loaded DLLs, Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report pzG0rkIchr.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Ursnif

Yara Signatures

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_pzG_206411b7d18c8b51ef308e99261d801f59953bc0_4f0e5919_15ebd55f\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_pzG_738eef979a666465c6051ddd5fef4b7e70c91a_4f0e5919_15905d59\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER148A.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1BBF.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCC66.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCF55.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD021.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDC43.tmp.dmp

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Rich Headers

Data Directories

Windows Analysis Report
pzG0rkIchr.dll