ursnif | decc5373395af97614b932bb9bd99d8febd84cfd8ca09cc7d765f187c9253907 | Triage

Resubmissions

23-08-2021 18:19

210823-zsnm2vq9pj 10

24-12-2020 08:17

201224-d3h89dhrs2 10

Analysis

max time kernel
90s
max time network
110s
platform
windows10_x64
resource
win10v20201028
submitted
24-12-2020 08:17

Sharing

Report Analysis Logs

General

Target

5e320cafb35de3e8f8c8c5878fe399143eda3b5a8b2076171754c97f350135a6.dll
Size

619KB
MD5

06369d24c347761e4c618f4759c0de01
SHA1

b76ab3c1e5a5fbe177030fd6e4a2c082c2f43264
SHA256

5e320cafb35de3e8f8c8c5878fe399143eda3b5a8b2076171754c97f350135a6
SHA512

c2efe5c5d999961a345a06d49361e5fb7cfa6f8ca13ec1d919279c99fa8863394157b2f6c9695922fc172d5322157360549f1a048fff648f2cab9d7fe7436547

Score

10^/10

ursnif banker trojan

Malware Config

Extracted

Family

ursnif

Attributes

dga_base_url
dga_crc
0
dga_season
0
dga_tlds
dns_servers

Signatures

Ursnif, Dreambot
Ursnif is a variant of the Gozi IFSB with more capabilities.
banker trojan ursnif
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3464 804 WerFault.exe rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
3464	WerFault.exe
3464	WerFault.exe
3464	WerFault.exe
3464	WerFault.exe
3464	WerFault.exe
3464	WerFault.exe
3464	WerFault.exe
3464	WerFault.exe
3464	WerFault.exe
3464	WerFault.exe
3464	WerFault.exe
3464	WerFault.exe
3464	WerFault.exe
3464	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3464 WerFault.exe
Token: SeBackupPrivilege 3464 WerFault.exe
Token: SeDebugPrivilege 3464 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3304 wrote to memory of 804	3304	rundll32.exe	rundll32.exe
PID 3304 wrote to memory of 804	3304	rundll32.exe	rundll32.exe
PID 3304 wrote to memory of 804	3304	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e320cafb35de3e8f8c8c5878fe399143eda3b5a8b2076171754c97f350135a6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3304

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e320cafb35de3e8f8c8c5878fe399143eda3b5a8b2076171754c97f350135a6.dll,#1
2⤵
PID:804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 804 -s 612
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3464

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/804-2-0x0000000000000000-mapping.dmp

Download
memory/804-5-0x0000000000000000-mapping.dmp

Download
memory/804-4-0x0000000000000000-mapping.dmp

Download
memory/804-6-0x0000000000000000-mapping.dmp

Download
memory/804-7-0x0000000000000000-mapping.dmp

Download
memory/3464-3-0x0000000004140000-0x0000000004141000-memory.dmp

Filesize
4KB

Download