ursnif | 4f61fcafad37cc40632ad85e4f8aa503d63700761e49db19c122bffa7084e4ec

Analysis

Target

y.rb.dll
Size

421KB
MD5

838c6c76b5f43793ba6a966ff3cfe1bf
SHA1

e3e98f6f780c54a86af046a8612b984dbbe16a24
SHA256

4f61fcafad37cc40632ad85e4f8aa503d63700761e49db19c122bffa7084e4ec
SHA512

cc09c8b79f082046341adc5142ac9c22eea8ef3941d703b3f03a9a3cedf59920eeebfe83d89a6ee8e074ec7168156208b461a18f66c5ceb80b6d6def36eab6be

Score

10^/10

Family

ursnif

Attributes

Ursnif, Dreambot
Ursnif is a variant of the Gozi IFSB with more capabilities.
banker trojan ursnif
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3680 4780 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3680	4780	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3680 WerFault.exe
Token: SeBackupPrivilege 3680 WerFault.exe
Token: SeDebugPrivilege 3680 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4768 wrote to memory of 4780	4768	rundll32.exe	rundll32.exe
PID 4768 wrote to memory of 4780	4768	rundll32.exe	rundll32.exe
PID 4768 wrote to memory of 4780	4768	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\y.rb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\y.rb.dll,#1
  2⤵
  PID:4780
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 628
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3680

memory/3680-2-0x00000000045E0000-0x00000000045E1000-memory.dmp

Filesize
4KB

Download
memory/3680-8-0x0000000004960000-0x0000000004961000-memory.dmp

Filesize
4KB

Download
memory/4780-0-0x0000000000000000-mapping.dmp

Download
memory/4780-1-0x0000000002E70000-0x0000000002E80000-memory.dmp

Filesize
64KB

Download
memory/4780-3-0x0000000000000000-mapping.dmp

Download
memory/4780-4-0x0000000000000000-mapping.dmp

Download
memory/4780-5-0x0000000000000000-mapping.dmp

Download
memory/4780-6-0x0000000000000000-mapping.dmp

Download