ursnif | c513c300dd29b821c87623a3718a5d29186fb9bdabb61e42abe5c42cb944bb5f

Analysis

Target

YyIUwQv.dll
Size

565KB
MD5

7099df90d162654fa9e3effa97279f51
SHA1

605233409966904822a2e356d662ef837f778396
SHA256

c513c300dd29b821c87623a3718a5d29186fb9bdabb61e42abe5c42cb944bb5f
SHA512

0623038f073dcb8930228f6866a073e9b6bbfaa79fc0f4ee652cb2b2fc2cb65f91028c33d38597504ad62adca00d477804a908034e82796fdf8e32cb378b8b53

Score

10^/10

Family

ursnif

Attributes

Ursnif, Dreambot
Ursnif is a variant of the Gozi IFSB with more capabilities.
banker trojan ursnif

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2388	3692	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 15 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4040 wrote to memory of 3692	4040	rundll32.exe	68
PID 4040 wrote to memory of 3692	4040	rundll32.exe	68
PID 4040 wrote to memory of 3692	4040	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\YyIUwQv.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\YyIUwQv.dll,#1
  2⤵
  PID:3692
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3692 -s 608
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2388

memory/2388-3-0x0000000004FA0000-0x0000000004FA1000-memory.dmp

Filesize
4KB

Download
memory/2388-8-0x0000000005920000-0x0000000005921000-memory.dmp

Filesize
4KB

Download