ursnif | 2b6fcb1b4cfb00114d2a79ae86e3406585df4ae8616e3d235c987a5100ae0ded

Analysis

Target

100000.dll
Size

50KB
MD5

15c83c1ea197eb1889921fc281bf10c3
SHA1

ef95a71fdca5820529d3dcb986ef1170e2a9fdd1
SHA256

2b6fcb1b4cfb00114d2a79ae86e3406585df4ae8616e3d235c987a5100ae0ded
SHA512

4ab0c1075246a9cb188d1e1c932df1c2b12f30032d1f6159a93bba0abea2714975916c57549a1fb2c90597c53420c09855626cbb27551364d49ef68fadd9e43e

Score

10^/10

Family

ursnif

Botnet

4779

37.10.71.42

loaidifds.club

Attributes

rsa_pubkey.base64

serpent.plain

Ursnif, Dreambot
Ursnif is a variant of the Gozi IFSB with more capabilities.
banker trojan ursnif
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4072 3740 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4072	3740	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 4072 WerFault.exe
Token: SeBackupPrivilege 4072 WerFault.exe
Token: SeDebugPrivilege 4072 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3568 wrote to memory of 3740	3568	rundll32.exe	rundll32.exe
PID 3568 wrote to memory of 3740	3568	rundll32.exe	rundll32.exe
PID 3568 wrote to memory of 3740	3568	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\100000.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3568
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\100000.dll,#1
  2⤵
  PID:3740
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 588
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4072

memory/3740-0-0x0000000000000000-mapping.dmp

Download
memory/3740-1-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/3740-3-0x0000000000000000-mapping.dmp

Download
memory/3740-4-0x0000000000000000-mapping.dmp

Download
memory/3740-6-0x0000000000000000-mapping.dmp

Download
memory/4072-2-0x0000000004A40000-0x0000000004A41000-memory.dmp

Filesize
4KB

Download
memory/4072-5-0x00000000053B0000-0x00000000053B1000-memory.dmp

Filesize
4KB

Download