ursnif | b9127a38c105987631df3a245c009dc9519bb790e27e8fd6de682b89f76d7db8

Analysis

Target

u03062020.bin.dll
Size

576KB
MD5

436098e705e0c18a156441ac979a4a9c
SHA1

15d678fb01192792852aef1d96a2b915d75a1034
SHA256

b9127a38c105987631df3a245c009dc9519bb790e27e8fd6de682b89f76d7db8
SHA512

319321bab1b61408fd0a82cc1a16d85e39eb28d2d22e26153912a5f768b925baf0ce8b811d2c69f81804d5db1c2d421030f1c7e93fa1af5a97390654b7f759b7

Score

10^/10

Family

ursnif

Attributes

Ursnif, Dreambot
Ursnif is a variant of the Gozi IFSB with more capabilities.
banker trojan ursnif

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4020	1232	WerFault.exe	69

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1108 wrote to memory of 1232	1108	rundll32.exe	69
PID 1108 wrote to memory of 1232	1108	rundll32.exe	69
PID 1108 wrote to memory of 1232	1108	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\u03062020.bin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\u03062020.bin.dll,#1
  2⤵
  PID:1232
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1232 -s 648
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4020

memory/1232-1-0x00000000033E0000-0x00000000033F0000-memory.dmp

Filesize
64KB

Download
memory/4020-2-0x0000000005040000-0x0000000005041000-memory.dmp

Filesize
4KB

Download
memory/4020-8-0x00000000059C0000-0x00000000059C1000-memory.dmp

Filesize
4KB

Download