flash

6yDD19jMIu.dll

Status: finished
Submission Time: 11.10.2021 22:24:17
Malicious
Trojan
Evader
Ursnif

Comments

Tags

  • BRT
  • dll
  • geo
  • Gozi
  • ISFB
  • ITA
  • Ursnif

Details

  • Analysis ID:
    500309
  • API (Web) ID:
    867881
  • Analysis Started:
    11.10.2021 22:33:26
  • Analysis Finished:
    11.10.2021 22:58:27
  • MD5:
    903cf677ba834a968b42bd71e4626a9d
  • SHA1:
    c751f3ab4612917d15967fc1f0591e674c2e56ca
  • SHA256:
    b601a3c9c3a3df9043ea82733f1da5b413207d7585ca6b18baa8a4d923ce92d8
  • Technologies:
Full Report Management Report IOC Report Engine Info Verdict Score Reports

System: Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211

malicious
96/100

System: Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Run Condition: Run with higher sleep bypass

malicious
96/100

malicious
6/66

IPs

IP Country Detection
52.97.219.162
United States
52.97.137.114
United States
40.97.161.50
United States
Click to see the 5 hidden entries
52.98.214.82
United States
52.97.223.66
United States
40.101.124.210
United States
52.98.208.114
United States
13.82.28.61
United States

Domains

Name IP Detection
areuranel.website
0.0.0.0
breuranel.website
0.0.0.0
msn.com
13.82.28.61
Click to see the 6 hidden entries
outlook.com
40.97.161.50
HHN-efz.ms-acdc.office.com
52.97.223.66
FRA-efz.ms-acdc.office.com
40.101.124.210
www.msn.com
0.0.0.0
www.outlook.com
0.0.0.0
outlook.office365.com
0.0.0.0

URLs

Name Detection
https://areuranel.website/
https://areuranel.website/liopolo/gPZADesC/LIHFYPg1nfeS6qR4dfr58Og/poTvfxxfV9/7jcxdAxrxlBGvHHC2/KE8j
https://outlook.office365.com
Click to see the 56 hidden entries
https://www.outlook.com/signup/liopolo/bJlCFRYLHvFIRqYTrU/8RRkttIEA/t1_2BP9O_2BAm85KU_2B/aSpxz3oD7DS
https://outlook.com/signup/liopolo/bJlCFRYLHvFIRqYTrU/8RRkttIEA/t1_2BP9O_2BAm85KU_2B/aSpxz3oD7DS4GgXePzf/ia7vS0WgwZtA22jtnk2sgM/8aNHELsXc5Ipi/BMZNGN2v/65JiDOn3VthO9IJqFpTTW9Q/9POmMR2_2B/F79Rk5g05Py2gD_2B/JwjLpqa35mrg/bt4uvVPD_2F/UqHQdzYFCQmMXc/ZX0Xxi4W.jre
https://breuranel.website/liopolo/Gu5CX9rKtqJTGdubC/vfDJzFOCWocD/fyvnSBIy2J4/FhQlzlOfNqSLAT/n_2BCGU5
https://msn.com/f
https://msn.com/e
https://www.msn.com/?refurl=%2fmail%2fliopolo%2fBqQVObz8g5lnocL%2frDmP1N8TTzvhY7vp6N%2fRS6H6xMUu%2fq
https://www.outlook.com/signup/liopolo/xrfnn2_2FjAWwzmSPV2sJmp/tknhXbcO6a/ZAGJ1q_2FdrKNOunT/MWqXv5zFFG9p/by8Zf_2FtJ3/xEG2AHiWNHzGMb/5U7AZq2hWTtx5Gp_2FLrT/Jtvmik5RsI3BKCJG/qiPKwJPTBUSBiQw/RY1j9J90egtogWV_2B/CgPW8RXFg/49h8H9fZxytN8Y5j4Ua3/YD4Lz_2BMKncbFniIjR/do3Cf1aCJb1FbLOESe_2B/MC.jre
https://outlook.office365.com/signup/liopolo/HeNOXEGhcO/DJiYgDwUOxUtDS_2F/jyyD8scRCvd_/2FyMxtVOaJ3/wtHE98SGLfSVcY/aYMs8f2LumXTliKvTeXJ_/2BDCwHs2R0k_2FBp/TwUdZVU_2BFy7BU/7Kl_2FOBfWpmXbV5T3/HLfF4XU2w/vHhM4pKHjDGx_2BGh5XJ/k3tEoRB4M6D1Hg77dr2/GhhYGYGyvzjf8tA7M4_2Fz/PcKN.jre
https://outlook.com/signup/liopolo/HeNOXEGhcO/DJiYgDwUOxUtDS_2F/jyyD8scRCvd_/2FyMxtVOaJ3/wtHE98SGLfS
https://outlook.office365.com/signup/liopolo/bJlCFRYLHvFIRqYTrU/8RRkttIEA/t1_2BP9O_2BAm85KU_2B/aSpxz3oD7DS4GgXePzf/ia7vS0WgwZtA22jtnk2sgM/8aNHELsXc5Ipi/BMZNGN2v/65JiDOn3VthO9IJqFpTTW9Q/9POmMR2_2B/F79Rk5g05Py2gD_2B/JwjLpqa35mrg/bt4uvVPD_2F/UqHQdzYFCQmMXc/ZX0Xxi4W.jre
https://www.outlook.com/signup/liopolo/3VnYAYtkPZmdkRft/PhukctoSJxkO8c8/Lye7Mz0DUphRm7HFMS/Ert7vY9a_
https://blogs.msn.com/
https://msn.com/mail/liopolo/wy2L0fN2E5PVQV/dJuGUeMmesCePLL0l7Wgt/WGkNYevXDY_2B8SF/CdMZYMX0E7B4luP/Ul2jmINaYu2Q2Tpowu/zFWfPWe10/HWR9Tc92PXi2sPWtdN4v/UdHW73hHNRRgj93MpeR/gAwjHz21J0PRcDvLd3I609/yvRpibRLzjrjt/tNfBhMKC/cc7JRbI6tVdqBgZvAlBLjz4/UmIafwR6sLy9/c9juhd.jre
https://deff.nelreports.net/api/report?cat=msn
https://www.msn.com/en-us//api/modules/fetch"
https://outlook.office365.com/signup/liopolo/xrfnn2_2FjAWwzmSPV2sJmp/tknhXbcO6a/ZAGJ1q_2FdrKNOunT/MW
http://ogp.me/ns/fb#
https://www.msn.com/&
https://outlook.com/signup/liopolo/xrfnn2_2FjAWwzmSPV2sJmp/tknhXbcO6a/ZAGJ1q_2FdrKNOunT/MWqXv5zFFG9p/by8Zf_2FtJ3/xEG2AHiWNHzGMb/5U7AZq2hWTtx5Gp_2FLrT/Jtvmik5RsI3BKCJG/qiPKwJPTBUSBiQw/RY1j9J90egtogWV_2B/CgPW8RXFg/49h8H9fZxytN8Y5j4Ua3/YD4Lz_2BMKncbFniIjR/do3Cf1aCJb1FbLOESe_2B/MC.jre
https://www.msn.com/mail/liopolo/BqQVObz8g5lnocL/rDmP1N8TTzvhY7vp6N/RS6H6xMUu/qA1CfJ9oDnQhRUYDGgyu/M
https://msn.com/
https://breuranel.website/8
https://outlook.office365.com/signup/liopolo/bJlCFRYLHvFIRqYTrU/8RRkttIEA/t1_2BP9O_2BAm85KU_2B/aSpxz
https://outlook.office365.com/
https://outlook.com/
https://www.msn.com/mail/liopolo/M47eTWImwyNJIXk/bvBUnXDqSGJkSqnZ1W/IoQdQ6MHW/B7zE09Qn2ChgYQ2HLYH_/2
https://www.outlook.com/signup
https://www.outlook.com/signup/liopolo/3VnYAYtkPZmdkRft/PhukctoSJxkO8c8/Lye7Mz0DUphRm7HFMS/Ert7vY9a_/2Fh6kZ4AO5iovULa_2Bg/RWwMy2ZM2sR1_2FjWVo/tVrVc9cE14VzsJSo6j4pki/JUlhlBWv0cOdb/WT8dwYTw/fsNrVB4ij0f115XNZnOJrEB/Ph8kPiXFtx/k7Vhu_2FqmJ2l_2BS/kcHYGhIgQQBE/6Lz_2BcD7nm/sGFf8Kc2PZ_2B/1_2F.jre
https://outlook.office365.com/$
https://outlook.office365.com/signup/liopolo/3VnYAYtkPZmdkRft/PhukctoSJxkO8c8/Lye7Mz0DUphRm7HFMS/Ert7vY9a_/2Fh6kZ4AO5iovULa_2Bg/RWwMy2ZM2sR1_2FjWVo/tVrVc9cE14VzsJSo6j4pki/JUlhlBWv0cOdb/WT8dwYTw/fsNrVB4ij0f115XNZnOJrEB/Ph8kPiXFtx/k7Vhu_2FqmJ2l_2BS/kcHYGhIgQQBE/6Lz_2BcD7nm/sGFf8Kc2PZ_2B/1_2F.jre
https://breuranel.website/X
https://msn.com/mail/liopolo/ytBZeomNqV/HSfS_2F75u1_2Bgzu/fw3T9nUGqtyA/MnMc49Ew1bU/TR75BNg3t5wK_2/FZ_2BhHpRHjaoiOWsJCdm/IP7BzqL3kfOIwEpd/0v6vAk1XTaQKS4Q/4t76RFSHOBJGuOI3un/dPzfZGf9x/VMluKaNPNp_2BEHsWys0/7w8R7Qn2JCyyYRXwFiA/UZytNi_2F_2BVoKUDorTiy/Fo.jre
https://outlook.office365.com/;
https://web.vortex.data.msn.com/collect/v1/t.gif?name=%27Ms.Webi.PageView%27&ver=%272.1%27&a
https://breuranel.website/liopolo/VQCuXOMQ58gaep/wQcyE3XNRkOUslXiuIoRn/thqxftgA7_2FvfGU/paR5aKKlYUJw
https://outlook.office365.com/C
https://www.outlook.com/signup/liopolo/bJlCFRYLHvFIRqYTrU/8RRkttIEA/t1_2BP9O_2BAm85KU_2B/aSpxz3oD7DS4GgXePzf/ia7vS0WgwZtA22jtnk2sgM/8aNHELsXc5Ipi/BMZNGN2v/65JiDOn3VthO9IJqFpTTW9Q/9POmMR2_2B/F79Rk5g05Py2gD_2B/JwjLpqa35mrg/bt4uvVPD_2F/UqHQdzYFCQmMXc/ZX0Xxi4W.jre
https://outlook.office365.com/signup/liopolo/3VnYAYtkPZmdkRft/PhukctoSJxkO8c8/Lye7Mz0DUphRm7HFMS/Ert
https://www.msn.com/mail/liopolo/wy2L0fN2E5PVQV/dJuGUeMmesCePLL0l7Wgt/WGkNYevXDY_2B8SF/CdMZYMX0E7B4l
https://www.msn.com/
https://outlook.office365.com/Q
https://msn.com/mail/liopolo/wy2L0fN2E5PVQV/dJuGUeMmesCePLL0l7Wgt/WGkNYevXDY_2B8SF/CdMZYMX0E7B4luP/U
https://msn.com/mail/liopolo/BqQVObz8g5lnocL/rDmP1N8TTzvhY7vp6N/RS6H6xMUu/qA1CfJ9oDnQhRUYDGgyu/Mnijq
https://www.msn.com/?refurl=%2fmail%2fliopolo%2fytBZeomNqV%2fHSfS_2F75u1_2Bgzu%2ffw3T9nUGqtyA%2fMnMc
https://mem.gfx.ms/meversion/?partner=msn&market=en-us"
https://www.msn.com/?refurl=%2fmail%2fliopolo%2fwy2L0fN2E5PVQV%2fdJuGUeMmesCePLL0l7Wgt%2fWGkNYevXDY_
https://msn.com/mail/liopolo/BqQVObz8g5lnocL/rDmP1N8TTzvhY7vp6N/RS6H6xMUu/qA1CfJ9oDnQhRUYDGgyu/MnijqTPatYoqwLU2Gjp/CUGc0n_2BeItdu5kr8poMa/AhSBnyUxBLy2z/WL6kh9Er/V_2FntCaBAYN2Q0pmQz73pS/plPX31iyVH/sliN48qRh7bzwYOXL/_2Bf1goPp5sf/LxXLhBSZnu3/MQi2YcecwkM/9zZah40u0/3pu.jre
https://outlook.office365.com/signup/liopolo/xrfnn2_2FjAWwzmSPV2sJmp/tknhXbcO6a/ZAGJ1q_2FdrKNOunT/MWqXv5zFFG9p/by8Zf_2FtJ3/xEG2AHiWNHzGMb/5U7AZq2hWTtx5Gp_2FLrT/Jtvmik5RsI3BKCJG/qiPKwJPTBUSBiQw/RY1j9J90egtogWV_2B/CgPW8RXFg/49h8H9fZxytN8Y5j4Ua3/YD4Lz_2BMKncbFniIjR/do3Cf1aCJb1FbLOESe_2B/MC.jre
https://outlook.com/signup/liopolo/3VnYAYtkPZmdkRft/PhukctoSJxkO8c8/Lye7Mz0DUphRm7HFMS/Ert7vY9a_/2Fh6kZ4AO5iovULa_2Bg/RWwMy2ZM2sR1_2FjWVo/tVrVc9cE14VzsJSo6j4pki/JUlhlBWv0cOdb/WT8dwYTw/fsNrVB4ij0f115XNZnOJrEB/Ph8kPiXFtx/k7Vhu_2FqmJ2l_2BS/kcHYGhIgQQBE/6Lz_2BcD7nm/sGFf8Kc2PZ_2B/1_2F.jre
https://www.outlook.com/signup/liopolo/HeNOXEGhcO/DJiYgDwUOxUtDS_2F/jyyD8scRCvd_/2FyMxtVOaJ3/wtHE98SGLfSVcY/aYMs8f2LumXTliKvTeXJ_/2BDCwHs2R0k_2FBp/TwUdZVU_2BFy7BU/7Kl_2FOBfWpmXbV5T3/HLfF4XU2w/vHhM4pKHjDGx_2BGh5XJ/k3tEoRB4M6D1Hg77dr2/GhhYGYGyvzjf8tA7M4_2Fz/PcKN.jre
http://ogp.me/ns#
https://breuranel.website/liopolo/oPGaMFzTwbyZJ3jE/9_2B3jdhd0kGHjG/n_2BHWHpJci47et543/_2B6aHUxi/oZM9
https://www.msn.com/?refurl=%2fmail%2fliopolo%2fM47eTWImwyNJIXk%2fbvBUnXDqSGJkSqnZ1W%2fIoQdQ6MHW%2fB
https://outlook.office365.com/m
https://outlook.com/signup/liopolo/HeNOXEGhcO/DJiYgDwUOxUtDS_2F/jyyD8scRCvd_/2FyMxtVOaJ3/wtHE98SGLfSVcY/aYMs8f2LumXTliKvTeXJ_/2BDCwHs2R0k_2FBp/TwUdZVU_2BFy7BU/7Kl_2FOBfWpmXbV5T3/HLfF4XU2w/vHhM4pKHjDGx_2BGh5XJ/k3tEoRB4M6D1Hg77dr2/GhhYGYGyvzjf8tA7M4_2Fz/PcKN.jre
https://outlook.office365.com/signup/liopolo/HeNOXEGhcO/DJiYgDwUOxUtDS_2F/jyyD8scRCvd_/2FyMxtVOaJ3/w

Dropped files

Name File Type Hashes Detection
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_4323c1d7a32576d87639b5d887c5a93fe7aab20_82810a17_085f59fb\Report.wer
Little-endian UTF-16 Unicode text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_b6db214dd89db871c3cf2d8284ebed8c4377271_82810a17_0ab3aee2\Report.wer
Little-endian UTF-16 Unicode text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_b6db214dd89db871c3cf2d8284ebed8c4377271_82810a17_10cbb47f\Report.wer
Little-endian UTF-16 Unicode text, with CRLF line terminators
#
Click to see the 9 hidden entries
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1498.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1CE3.tmp.dmp
Mini DuMP crash report, 15 streams, Tue Oct 12 05:36:21 2021, 0x1205a4 type
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER39F1.tmp.WERInternalMetadata.xml
XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3F13.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WERB0.tmp.dmp
Mini DuMP crash report, 15 streams, Tue Oct 12 05:36:11 2021, 0x1205a4 type
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WERB40.tmp.WERInternalMetadata.xml
XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF86.tmp.WERInternalMetadata.xml
XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF87.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WERFE20.tmp.dmp
Mini DuMP crash report, 15 streams, Tue Oct 12 05:36:09 2021, 0x1205a4 type
#