ursnif_rm3 | f4c0e5c6f0deef58b93fb675108501bdffca205910f15253fe007a399532d6e5

General

Target

l1o2c3o4m5o6t7i8v.exe
Size

453KB
MD5

ecee3f4d2b76bd477d527ab4afb664e0
SHA1

4939e3539b20d667bfc0803f9997065cd58e64be
SHA256

f4c0e5c6f0deef58b93fb675108501bdffca205910f15253fe007a399532d6e5
SHA512

76f314e0b6ff412022b5b49575ff6e09068086e940e2c0264aa91814fb8e4e65fcd2e35d6287e70972569ac4e179679b0c3e90f2e066313e8df823af56f4b4c7

Score

10^/10

banker trojan ursnif_rm3

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 24 IoCs

Processes:

iexplore.exeIEXPLORE.EXEIEXPLORE.EXE

pid	process
1516	iexplore.exe
1516	iexplore.exe
1868	IEXPLORE.EXE
1868	IEXPLORE.EXE
1516	iexplore.exe
1516	iexplore.exe
1580	IEXPLORE.EXE
1580	IEXPLORE.EXE
1516	iexplore.exe
1516	iexplore.exe
1868	IEXPLORE.EXE
1868	IEXPLORE.EXE
1516	iexplore.exe
1516	iexplore.exe
1868	IEXPLORE.EXE
1868	IEXPLORE.EXE
1516	iexplore.exe
1516	iexplore.exe
1868	IEXPLORE.EXE
1868	IEXPLORE.EXE
1516	iexplore.exe
1516	iexplore.exe
1868	IEXPLORE.EXE
1868	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 6 IoCs

Processes:

iexplore.exe

pid process

1516 iexplore.exe
1516 iexplore.exe
1516 iexplore.exe
1516 iexplore.exe
1516 iexplore.exe
1516 iexplore.exe

Modifies Internet Explorer settings 1 TTPs 37 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9ACC4FD1-C251-11EA-8E31-CE94C9E5ACDD} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001b0829a874ca164698fa08cb019bbab8000000000200000000001066000000010000200000009a0adabc639f9c74079830767ca301a305bda8649d099eef54547768eef8fb72000000000e800000000200002000000038349f885889a0624015e70bbd4a3ac8f476b79e3063f3065ae5fe7d362dd0ed20000000fb9048513f6a510a7ed57ac89c216ef1d87d172d96dd195c9c7c5df1fdc9365140000000a04b49154c1c61e8129f9a7253ca3bc67c614daabfc786eda449388551f9617ee98fc08d6c6c1f7c38ea1617999c5539adf58606b2a5782ee80ab5630110b7ac	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80d50c665e56d601	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "301111608"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001b0829a874ca164698fa08cb019bbab800000000020000000000106600000001000020000000d1257f86992e7490c95838b3a0a0533a707018d84374c440a6a8bd477a214153000000000e800000000200002000000035a57c89876adde2e2dbadb6daefc633725a7cd155f499c5dc24b3c3939f60bb90000000d7ff03e64e208a775f5b2c8db51b4ae369d3387c0d60b8f26c2346140bec452380aab57c953703c7ae43d25b744f8b7da58662857b484b34df91d6f7065cb4d6b209c30da759778f791e71ff1ad60bec21b64b2ff509298a70ef88831ae3857c8036ad4eefee23a02ec74e8a585145b65497d921bf4772a3a666c3ddd1253f71cab646ae1b1c8247b4481d668fae5363400000003890de8131f44f1cadaa98cedb11f26134c496eeb8dd0cd83908c2c3531c8a00d8b22ab873ddfc8bae809184f5e6e5c20e40f23c3c60790fa45869844bd46d0d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Ursnif RM3
A heavily modified version of Ursnif discovered in the wild.
banker trojan ursnif_rm3

Checks whether UAC is enabled 3 IoCs

Processes:

iexplore.exeIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	iexplore.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	IEXPLORE.EXE
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1516 wrote to memory of 1868	1516	iexplore.exe	IEXPLORE.EXE
PID 1516 wrote to memory of 1868	1516	iexplore.exe	IEXPLORE.EXE
PID 1516 wrote to memory of 1868	1516	iexplore.exe	IEXPLORE.EXE
PID 1516 wrote to memory of 1868	1516	iexplore.exe	IEXPLORE.EXE
PID 1516 wrote to memory of 1580	1516	iexplore.exe	IEXPLORE.EXE
PID 1516 wrote to memory of 1580	1516	iexplore.exe	IEXPLORE.EXE
PID 1516 wrote to memory of 1580	1516	iexplore.exe	IEXPLORE.EXE
PID 1516 wrote to memory of 1580	1516	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\l1o2c3o4m5o6t7i8v.exe
"C:\Users\Admin\AppData\Local\Temp\l1o2c3o4m5o6t7i8v.exe"
1⤵
PID:1464

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of FindShellTrayWindow
- Modifies Internet Explorer settings
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:1516

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1516 CREDAT:275457 /prefetch:2
2⤵
- Suspicious use of SetWindowsHookEx
- Modifies Internet Explorer settings
- Checks whether UAC is enabled
PID:1868

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1516 CREDAT:275468 /prefetch:2
2⤵
- Suspicious use of SetWindowsHookEx
- Modifies Internet Explorer settings
- Checks whether UAC is enabled
PID:1580

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\9MKZZ4ZJ.txt

Download Submit
memory/1464-0-0x0000000000280000-0x0000000000290000-memory.dmp

Filesize
64KB

Download
memory/1580-2-0x0000000000000000-mapping.dmp

Download
memory/1868-1-0x0000000000000000-mapping.dmp

Download
memory/1868-4-0x0000000001070000-0x0000000001071000-memory.dmp

Filesize
4KB

Download
memory/1868-6-0x0000000001080000-0x0000000001081000-memory.dmp

Filesize
4KB

Download
memory/1868-8-0x0000000001080000-0x0000000001081000-memory.dmp

Filesize
4KB

Download
memory/1868-10-0x0000000001080000-0x0000000001081000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads