Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Zeip.dll

Overview

General Information

Sample Name:Zeip.dll
Analysis ID:790195
MD5:85fa54c2a97ad3a1f8bd64af62450511
SHA1:db92c0a81e8b27d222607e093ccc9d00485db119
SHA256:e609894b274a6c42e971e8082af8fd167ade4aef5d1a3816d5acea04839f0b35
Tags:dll
Infos:

Detection

Ursnif
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Yara detected Ursnif
System process connects to network (likely due to code injection or exploit)
Antivirus detection for URL or domain
Snort IDS alert for network traffic
Found API chain indicative of debugger detection
Machine Learning detection for sample
Found evasive API chain (may stop execution after checking system information)
Writes registry values via WMI
Uses 32bit PE files
Yara signature match
Antivirus or Machine Learning detection for unpacked file
One or more processes crash
Contains functionality to query locales information (e.g. system language)
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Contains functionality to query CPU information (cpuid)
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
Creates a DirectInput object (often for capturing keystrokes)
Found inlined nop instructions (likely shell or obfuscated code)
Sample file is different than original file name gathered from version info
Uses a known web browser user agent for HTTP communication
Found evasive API chain checking for process token information
Checks if the current process is being debugged
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
Uses Microsoft's Enhanced Cryptographic Provider
Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

  • System is w10x64
  • loaddll32.exe (PID: 5308 cmdline: loaddll32.exe "C:\Users\user\Desktop\Zeip.dll" MD5: 1F562FBF37040EC6C43C8D5EF619EA39)
    • conhost.exe (PID: 4904 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 244 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\Zeip.dll",#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • rundll32.exe (PID: 5412 cmdline: rundll32.exe "C:\Users\user\Desktop\Zeip.dll",#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
    • WerFault.exe (PID: 4124 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 408 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)
    • WerFault.exe (PID: 4808 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 416 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)
    • WerFault.exe (PID: 1700 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 444 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)
  • cleanup

Malware Configuration

Threatname: Ursnif

{"RSA Public Key": "nEv1xgiiSSEq+UsF/sH972dYWlbdaVOznM6pMFVoUS05gtglJzWNlT7nMktPHUwL6//kjiNOqc4tDzQZ19ymuBpLEGqUVvC4ejuRj/0ho+UjebbguqPlH5n0kxpUzAwMML4tOLtp9LPhNicxLWntxqAhB5vWoa98iW2MUoUphRHcd2dO72hrBAGA6DCyFxDcS8WlyxVQ7VBx1Nh+pbslLneoja8gI1kgMhn78GgHQk/qR1oUbrcP/HgzqcZ46oTj/Z8oDh7Uf+bI3Bv799doULwM1Koc6uZt/pcclNdWQSZWvlVfFozPuVvT9NaBray36Sn10KTAPhwPYdk+nFxrudJjVCtbXTj4F13byKvdsT0=", "c2_domain": ["trackingg-protectioon.cdn4.mozilla.net", "80.77.23.77", "trackingg-protectioon.cdn4.mozilla.net", "80.77.25.109", "protectioon.cdn4.mozilla.net", "170.130.165.182", "protectioon.cdn4.mozilla.net", "80.77.25.114"], "botnet": "20005", "server": "50", "serpent_key": "OFX3RdYc8A5rFAaL", "sleep_time": "3", "CONF_TIMEOUT": "5", "SetWaitableTimer_value": "0"}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000003.00000003.418603485.0000000005108000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_UrsnifYara detected UrsnifJoe Security
    00000003.00000003.418603485.0000000005108000.00000004.00000020.00020000.00000000.sdmpWindows_Trojan_Gozi_fd494041unknownunknown
    • 0xff0:$a1: /C ping localhost -n %u && del "%s"
    • 0xf20:$a2: /C "copy "%s" "%s" /y && "%s" "%s"
    • 0xec8:$a3: /C "copy "%s" "%s" /y && rundll32 "%s",%S"
    • 0xca8:$a5: filename="%.4u.%lu"
    • 0x803:$a7: version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s
    • 0x63a:$a8: %08X-%04X-%04X-%04X-%08X%04X
    • 0xa41:$a8: %08X-%04X-%04X-%04X-%08X%04X
    • 0xe72:$a9: &whoami=%s
    • 0xe5a:$a10: %u.%u_%u_%u_x%u
    • 0xc22:$a11: size=%u&hash=0x%08x
    • 0xc13:$a12: &uptime=%u
    • 0xda7:$a13: %systemroot%\system32\c_1252.nls
    • 0x1416:$a14: IE10RunOnceLastShown_TIMESTAMP
    00000003.00000003.418603485.0000000005108000.00000004.00000020.00020000.00000000.sdmpWindows_Trojan_Gozi_261f5ac5unknownunknown
    • 0xbd3:$a1: soft=%u&version=%u&user=%08x%08x%08x%08x&server=%u&id=%u&crc=%x
    • 0x803:$a2: version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s
    • 0xc74:$a3: Content-Disposition: form-data; name="upload_file"; filename="%.4u.%lu"
    • 0xafa:$a5: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT %u.%u%s)
    • 0xd4b:$a9: Software\AppDataLow\Software\Microsoft\
    • 0x1868:$a9: Software\AppDataLow\Software\Microsoft\
    00000003.00000003.418848530.0000000005108000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_UrsnifYara detected UrsnifJoe Security
      00000003.00000003.418848530.0000000005108000.00000004.00000020.00020000.00000000.sdmpWindows_Trojan_Gozi_fd494041unknownunknown
      • 0xff0:$a1: /C ping localhost -n %u && del "%s"
      • 0xf20:$a2: /C "copy "%s" "%s" /y && "%s" "%s"
      • 0xec8:$a3: /C "copy "%s" "%s" /y && rundll32 "%s",%S"
      • 0xca8:$a5: filename="%.4u.%lu"
      • 0x803:$a7: version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s
      • 0x63a:$a8: %08X-%04X-%04X-%04X-%08X%04X
      • 0xa41:$a8: %08X-%04X-%04X-%04X-%08X%04X
      • 0xe72:$a9: &whoami=%s
      • 0xe5a:$a10: %u.%u_%u_%u_x%u
      • 0xc22:$a11: size=%u&hash=0x%08x
      • 0xc13:$a12: &uptime=%u
      • 0xda7:$a13: %systemroot%\system32\c_1252.nls
      • 0x1416:$a14: IE10RunOnceLastShown_TIMESTAMP
      Click to see the 25 entries

      Sigma Signatures

      ⊘No Sigma rule has matched

      Snort Signatures

      Timestamp:192.168.2.680.77.23.7749728802033204 01/23/23-23:00:21.133917
      SID:2033204
      Source Port:49728
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.680.77.23.7749728802033203 01/23/23-23:00:21.133917
      SID:2033203
      Source Port:49728
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.680.77.25.10949733802033203 01/23/23-23:01:31.648906
      SID:2033203
      Source Port:49733
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.680.77.25.10949733802033204 01/23/23-23:01:31.648906
      SID:2033204
      Source Port:49733
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.6170.130.165.18249735802033203 01/23/23-23:02:42.232320
      SID:2033203
      Source Port:49735
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.6170.130.165.18249735802033204 01/23/23-23:02:42.232320
      SID:2033204
      Source Port:49735
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected

      Joe Sandbox Signatures

      Click to jump to signature section

      Show All Signature Results

      AV Detection

      barindex
      Multi AV Scanner detection for submitted file
      Source: Zeip.dllVirustotal: Detection: 31%Perma Link
      Antivirus detection for URL or domain
      Source: http://80.77.23.77/fonts/1c4TnFuCv/CcRXrQPe30HaMexmLpgF/4aupYBGHp_2BOME_2FG/0huvHbhao4TfaTiw3rk5b1/qAvira URL Cloud: Label: malware
      Source: http://80.77.23.77/fonts/1c4TnFuCv/CcRXrQPe30HaMexmLpgF/4aupYBGHp_2BOME_2FG/0huvHbhao4TfaTiw3rk5b1/q2ZxS3FX1_2FQ/CzfxjEWy/KpMrpyirWaYAf_2F58pSM7E/hql2_2Ff0P/Z_2FzTZSSRCDR8bjj/lvIYML_2BVAb/NDNuDcBuj0i/x8S9VCMsW3ok_2/BnlqZTWQkXRsJMXJ2eLuL/xrE8_2BMiM9wsQ1R/fYIgNLn5R2u2Ad3/7X_2FsIOWaCy11iw8h/jUscFfxSY/bywnHnDEPGzuSt6TUFwm/lh8gKMKhoVQ1xsZNS7s/DZZFZuGiVc6hKPbFFxnPb_/2Bv.bakAvira URL Cloud: Label: malware
      Machine Learning detection for sample
      Source: Zeip.dllJoe Sandbox ML: detected
      Source: 3.2.rundll32.exe.400000.0.unpackAvira: Label: TR/Crypt.ZPACK.Gen2
      Source: 00000003.00000002.773301251.0000000004A79000.00000004.00000020.00020000.00000000.sdmpMalware Configuration Extractor: Ursnif {"RSA Public Key": "nEv1xgiiSSEq+UsF/sH972dYWlbdaVOznM6pMFVoUS05gtglJzWNlT7nMktPHUwL6//kjiNOqc4tDzQZ19ymuBpLEGqUVvC4ejuRj/0ho+UjebbguqPlH5n0kxpUzAwMML4tOLtp9LPhNicxLWntxqAhB5vWoa98iW2MUoUphRHcd2dO72hrBAGA6DCyFxDcS8WlyxVQ7VBx1Nh+pbslLneoja8gI1kgMhn78GgHQk/qR1oUbrcP/HgzqcZ46oTj/Z8oDh7Uf+bI3Bv799doULwM1Koc6uZt/pcclNdWQSZWvlVfFozPuVvT9NaBray36Sn10KTAPhwPYdk+nFxrudJjVCtbXTj4F13byKvdsT0=", "c2_domain": ["trackingg-protectioon.cdn4.mozilla.net", "80.77.23.77", "trackingg-protectioon.cdn4.mozilla.net", "80.77.25.109", "protectioon.cdn4.mozilla.net", "170.130.165.182", "protectioon.cdn4.mozilla.net", "80.77.25.114"], "botnet": "20005", "server": "50", "serpent_key": "OFX3RdYc8A5rFAaL", "sleep_time": "3", "CONF_TIMEOUT": "5", "SetWaitableTimer_value": "0"}
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04B96EB4 CryptAcquireContextW,memcpy,CryptImportKey,CryptSetKeyParam,memcpy,CryptEncrypt,GetLastError,GetLastError,CryptDestroyKey,GetLastError,CryptReleaseContext,GetLastError,3_2_04B96EB4
      Source: Zeip.dllStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL
      Source: Binary string: ZR@4Hk*7L7H|SDs!u.pdb source: loaddll32.exe, 00000000.00000002.272862074.0000000000489000.00000002.00000001.01000000.00000003.sdmp, Zeip.dll