ursnif | c513c300dd29b821c87623a3718a5d29186fb9bdabb61e42abe5c42cb944bb5f

Analysis

Target

YyIUwQv.dll
Size

565KB
MD5

7099df90d162654fa9e3effa97279f51
SHA1

605233409966904822a2e356d662ef837f778396
SHA256

c513c300dd29b821c87623a3718a5d29186fb9bdabb61e42abe5c42cb944bb5f
SHA512

0623038f073dcb8930228f6866a073e9b6bbfaa79fc0f4ee652cb2b2fc2cb65f91028c33d38597504ad62adca00d477804a908034e82796fdf8e32cb378b8b53

Score

10^/10

Family

ursnif

Attributes

Ursnif, Dreambot
Ursnif is a variant of the Gozi IFSB with more capabilities.
banker trojan ursnif
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2388 3692 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2388	3692	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

Processes:

WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2388 WerFault.exe
Token: SeBackupPrivilege 2388 WerFault.exe
Token: SeDebugPrivilege 2388 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4040 wrote to memory of 3692	4040	rundll32.exe	rundll32.exe
PID 4040 wrote to memory of 3692	4040	rundll32.exe	rundll32.exe
PID 4040 wrote to memory of 3692	4040	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\YyIUwQv.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\YyIUwQv.dll,#1
  2⤵
  PID:3692
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3692 -s 608
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2388

memory/2388-3-0x0000000004FA0000-0x0000000004FA1000-memory.dmp

Filesize
4KB

Download
memory/2388-8-0x0000000005920000-0x0000000005921000-memory.dmp

Filesize
4KB

Download
memory/3692-2-0x0000000000000000-mapping.dmp

Download
memory/3692-4-0x0000000000000000-mapping.dmp

Download
memory/3692-5-0x0000000000000000-mapping.dmp

Download
memory/3692-6-0x0000000000000000-mapping.dmp

Download
memory/3692-7-0x0000000000000000-mapping.dmp

Download