=
Joe Sandbox Cloud Basic
Register Login
sloganpng
We are hiring! Windows Kernel Developer (Remote), apply here!
flash

rXN8OIpbzz.dll

Status: finished
Submission Time: 2022-05-04 12:40:29 +02:00
Malicious
Trojan
Evader
Ursnif

Comments

Tags

  • dll
  • gozi_ifsb
  • ursnif
  • 3000

Details

  • Analysis ID:
    620156
  • API (Web) ID:
    987660
  • Analysis Started:
    2022-05-04 12:40:41 +02:00
  • Analysis Finished:
    2022-05-04 12:54:38 +02:00
  • MD5:
    6e21e2268df053e95557a2157ff33103
  • SHA1:
    efeefb5833b881475bd421da29719d578babb90c
  • SHA256:
    22a462b2da9c893b5f37dbbc19697d6aeaa28758c2338fca3a806e8d9d3ac483
  • Technologies:
Full Report Management Report IOC Report Engine Info Verdict Score Reports

malicious

System: Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211

malicious
100/100

malicious
17/42

IPs

IP Country Detection
185.189.151.28
 Switzerland

Domains

Name IP Detection
l-0007.l-dc-msedge.net
 13.107.43.16

URLs

Name Detection
http://185.189.151.28/drew/cVbBCVAVC_2BrfCTTliq4D/TR89j_2FDMhBC/Rx3lDg61/HvgZB2J7R7VD_2FxHgth09P/H_2Fp_2B0K/lT2QuoqZm8BQycZwQ/H4nFd1cHmG_2/B8ivI_2F0O9/bJq8uYFSa5v9Ij/oSxEbcCz5_2FkNItSz7M7/RsUqbQcn0xtbFLfk/s_2BoKVrnDqJChc/UQqpJa6I6sYnVdkvyr/aVGGIz6zI/ZEQtOcGy53_2B5iYxze_/2BYqRtgImRp7tBA6q9P/SewC3o45SwnJ_2BNfdtGRr/1q9JxgDBH/3.jlk
http://185.189.151.28/drew/SE7WZ12eEzLDbcY/ReHD9U37IHMRdNMyX0/f61fYgNDH/xkc3DHorIjF18_2BtcDI/NMTbVOfmJtH6P_2FDxg/fYP24ZJpA_2BXAD0LiynfR/sY7KfedmKK4eh/fSjWb6Xu/fAf6iEN7Rblzydam2OSbiSx/Vw6Cb_2Bbg/Vc9aYir_2By_2BYAt/7uRRpr7mVOmx/v_2F66pvHXt/nmtBefhmAX5DJk/ied6XVEApSsG8HlMS4KeZ/kP7pKEMCKNfzyZum/QUL8CnndyLC0Xcl/NmgSkYn.jlk
http://185.189.151.28/drew/21j59p5h/aMY7pIvB814fHQzA54TmstP/6F84QjrY8T/SpaWCfEUD_2FnWXvC/rEqVxZeDiGmB/EVC7r5ALKWg/9SLUGnIzpxcWYM/xuMBfgGVcmtRuQEdnu_2F/z6aCj8Veiw_2FLpI/klXzvSCm2R4EgNj/tX1BLPzJEB4fd6nZGQ/ASaXUuL8G/Cb1hq1kHRkSzUSxa9avd/CLUWUoeV5nKWyDrb3Sa/Aw0B4o70zU_2B7Hjx9TwWi/5WU7_2FRUtVgO/Qd4d0Z1_2Bvo/b7ociWkm.jlk
Click to see the 9 hidden entries
http://185.189.151.28/
http://https://file://USER.ID%lu.exe/upd
http://185.189.151.28/drew/21j59p5h/aMY7pIvB814fHQzA54TmstP/6F84QjrY8T/SpaWCfEUD_2FnWXvC/rEqVxZeDiGm
http://schemas.mi
http://185.189.151.28/drew/SE7WZ12eEzLDbcY/ReHD9U37IHMRdNMyX0/f61fYgNDH/xkc3DHorIjF18_2BtcDI/NMTbVOf
http://185.189.151.28/drew/cVbBCVAVC_2BrfCTTliq4D/TR89j_2FDMhBC/Rx3lDg61/HvgZB2J7R7VD_2FxHgth09P/H_2
http://constitution.org/usdeclar.txt
http://schemas.micr
http://constitution.org/usdeclar.txtC:

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
 data
 #
C:\Users\user\AppData\Local\Temp\CSC41D8DEC26D8340F3B72514D252AF5890.TMP
 MSVC .res
 #
C:\Users\user\AppData\Local\Temp\CSCFB39A903173B4FAEAF71F3E48EC5D0FF.TMP
 MSVC .res
 #
Click to see the 12 hidden entries
C:\Users\user\AppData\Local\Temp\RES3047.tmp
 Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x482, 9 symbols
 #
C:\Users\user\AppData\Local\Temp\RES4508.tmp
 Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x482, 9 symbols
 #
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ae2dmfll.luf.psm1
 very short file (no magic)
 #
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_r45uapby.kca.ps1
 very short file (no magic)
 #
C:\Users\user\AppData\Local\Temp\nthaltvx.0.cs
 UTF-8 Unicode (with BOM) text
 #
C:\Users\user\AppData\Local\Temp\nthaltvx.cmdline
 UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators
 #
C:\Users\user\AppData\Local\Temp\nthaltvx.dll
 PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\nthaltvx.out
 UTF-8 Unicode (with BOM) text, with very long lines, with CRLF, CR line terminators
 #
C:\Users\user\AppData\Local\Temp\zn133k50.0.cs
 UTF-8 Unicode (with BOM) text
 #
C:\Users\user\AppData\Local\Temp\zn133k50.cmdline
 UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators
 #
C:\Users\user\AppData\Local\Temp\zn133k50.dll
 PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\zn133k50.out
 UTF-8 Unicode (with BOM) text, with very long lines, with CRLF, CR line terminators
 #