Analysis
-
max time kernel
92s -
max time network
95s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
09-12-2020 18:28
General
-
Target
YyIUwQv.dll
-
Size
565KB
-
MD5
7099df90d162654fa9e3effa97279f51
-
SHA1
605233409966904822a2e356d662ef837f778396
-
SHA256
c513c300dd29b821c87623a3718a5d29186fb9bdabb61e42abe5c42cb944bb5f
-
SHA512
0623038f073dcb8930228f6866a073e9b6bbfaa79fc0f4ee652cb2b2fc2cb65f91028c33d38597504ad62adca00d477804a908034e82796fdf8e32cb378b8b53
Score
10/10
Malware Config
Extracted
Family
ursnif
Attributes
- dga_base_url
-
dga_crc
0
-
dga_season
0
- dga_tlds
- dns_servers
Signatures
-
Ursnif, Dreambot
Ursnif is a variant of the Gozi IFSB with more capabilities.
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 15 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\YyIUwQv.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\YyIUwQv.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 6083⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2368-3-0x0000000004590000-0x0000000004591000-memory.dmpFilesize
4KB
-
memory/2368-8-0x0000000004DF0000-0x0000000004DF1000-memory.dmpFilesize
4KB
-
memory/4016-2-0x0000000000000000-mapping.dmp
-
memory/4016-5-0x0000000000000000-mapping.dmp
-
memory/4016-4-0x0000000000000000-mapping.dmp
-
memory/4016-6-0x0000000000000000-mapping.dmp
-
memory/4016-7-0x0000000000000000-mapping.dmp
-
memory/4016-14-0x0000000000000000-mapping.dmp
-
memory/4016-13-0x0000000000000000-mapping.dmp
-
memory/4016-15-0x0000000000000000-mapping.dmp
-
memory/4016-16-0x0000000000000000-mapping.dmp
-
memory/4016-17-0x0000000000000000-mapping.dmp