ursnif | decc5373395af97614b932bb9bd99d8febd84cfd8ca09cc7d765f187c9253907

Resubmissions

23-08-2021 18:19

24-12-2020 08:17

Target

5e320cafb35de3e8f8c8c5878fe399143eda3b5a8b2076171754c97f350135a6.dll
Size

619KB
MD5

06369d24c347761e4c618f4759c0de01
SHA1

b76ab3c1e5a5fbe177030fd6e4a2c082c2f43264
SHA256

5e320cafb35de3e8f8c8c5878fe399143eda3b5a8b2076171754c97f350135a6
SHA512

c2efe5c5d999961a345a06d49361e5fb7cfa6f8ca13ec1d919279c99fa8863394157b2f6c9695922fc172d5322157360549f1a048fff648f2cab9d7fe7436547

Score

10^/10

Family

ursnif

Attributes

Ursnif, Dreambot
Ursnif is a variant of the Gozi IFSB with more capabilities.
banker trojan ursnif

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3464	804	WerFault.exe	69

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3304 wrote to memory of 804	3304	rundll32.exe	69
PID 3304 wrote to memory of 804	3304	rundll32.exe	69
PID 3304 wrote to memory of 804	3304	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e320cafb35de3e8f8c8c5878fe399143eda3b5a8b2076171754c97f350135a6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3304
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e320cafb35de3e8f8c8c5878fe399143eda3b5a8b2076171754c97f350135a6.dll,#1
  2⤵
  PID:804
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 804 -s 612
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3464

memory/3464-3-0x0000000004140000-0x0000000004141000-memory.dmp

Filesize
4KB

Download