Analysis
-
max time kernel
16s -
max time network
113s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
09-11-2020 20:55
General
-
Target
Cherokee.dll
-
Size
556KB
-
MD5
51303064fdcc6f69898e9f20ed0dde74
-
SHA1
456fead88c60451a31fc8b6345842a18c5b9fbc8
-
SHA256
1963d310983cb5e188c7e293f1beb638d035a0abef3aea105885d280c0a65090
-
SHA512
6f0cfd7c77a0b3f9f660465ffec4b928a14fa0e0e66a2d27f73592ee8f78ab73336f0173f4670a97abf39b83812ea9dddee5c332fb9ae28c09dd84cd9f8c161c
Score
10/10
Malware Config
Extracted
Family
ursnif
Attributes
- dga_base_url
-
dga_crc
0
-
dga_season
0
- dga_tlds
- dns_servers
Signatures
-
Ursnif, Dreambot
Ursnif is a variant of the Gozi IFSB with more capabilities.
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Cherokee.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Cherokee.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1076 -s 6243⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
-
Filesize
64KB
-
-
-
-
-
Filesize
4KB
-
Filesize
4KB