ursnif_rm3 | 9e0cfd00991a3d387a78770a7748418b4d0ab978717f84a399d766b19a971df0

General

Target

9e0cfd00991a3d387a78770a7748418b4d0ab978717f84a399d766b19a971df0.dll
Size

132KB
MD5

b0f3a46adf98efb3a9ac7cead9b4fc5a
SHA1

01b0ece80907f2d9e500ada1cd2d555b782dd3a2
SHA256

9e0cfd00991a3d387a78770a7748418b4d0ab978717f84a399d766b19a971df0
SHA512

22076388da1305e1a9b7ad3257fde95b81118983c95b0025b3a4c848b6703257dbaeaad3da10dab7e66c18fdb7bc015dbf08f20ad0f37543f40e5b448779b6be

Score

10^/10

ursnif_rm3 banker trojan

Malware Config

Signatures

Ursnif RM3
A heavily modified version of Ursnif discovered in the wild.
banker trojan ursnif_rm3

Blocklisted process makes network request 8 IoCs

Processes:

rundll32.exe

flow	pid	process
11	1472	rundll32.exe
12	1472	rundll32.exe
13	1472	rundll32.exe
14	1472	rundll32.exe
29	1472	rundll32.exe
30	1472	rundll32.exe
49	1472	rundll32.exe
50	1472	rundll32.exe

Modifies Internet Explorer settings 1 TTPs 231 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEiexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000039e08b06c84715459283081ff7bb5a6000000000020000000000106600000001000020000000c0f2e31c4d8804d31f2eb0f3bbf93b5e7823f618a9ac595c534dc1e89688ac01000000000e8000000002000020000000ac9849eff0eacad8bc33cf4d0b63e1fa150ebf8ea8862068816138abeb2b322750010000f0c0ba30879b5396b5772acd06d585a1ce3c9873c96dca6ca399b86635e9b02eb3e84064e3a5890371e4a97909794621d03300e76efd5c914dba5b36fc12d6ee549d7591b98214b5ed24131818b81a765a0b004959097e38e5f2d396eea1b04005f848aae5ff2c411fcadaba8d81a00dd533aaa0a160df6f325950e8836876b800af5fd3795466778961393a83706a7d51a665fbaa9074d470e1a8c11d9ffefc28ccb154362d48691eab215900fdd463856d75386d2c7617a521647278a6e0a9ee52de47690873fb8ba1fda9d90530d65943c4ad22e63c5e6d7310ab26678f7d66bc85b6b8ccdb50a10f52b4b20bed78a4aa00870c82c56195ac6f94fa04b289ade2648e7a03f1453c4cc29da2f71981c54060caaf6b1d901ef89f76f758511b82b2d627f1de32b640476add3eaec86e90353a1c0ad78964864dcad1d4285fb4bf572f70ef2b4d3e985e097fa12a48b24000000024688fdcb192fec6973827873886e17347c8d44cba55be7d5fed238283547bda87f81cfa3f1b2ab4e13e4cc6b80dff683e99fd1a8543946b8a2bf0464b7d4b92	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CEF7AA41-53BF-11EB-8853-EAC4A56BD8AE} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F4C8A261-53BF-11EB-8853-EAC4A56BD8AE} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000039e08b06c84715459283081ff7bb5a6000000000020000000000106600000001000020000000ef00ed81828ed9a9c4851caeb2ad73b54d2fbb4da44b91c1803a9704bc7c4a46000000000e80000000020000200000004c68cffcc74369cf05ee7d286e24405ae4379597ab80b79a692ac9513bed07ee50010000802fd4b755dda35bea76263f37184102aaf6fd426d6b157bd85f6a20fab1cf8860c02646cda1b32f22693938851b2a559bec26509c782f182514bb0a674790e0cc63ebcd418958fd4cfaabea5e7e089a7c219d971ea02e708de16cf9936465e1caa8282dc38c213190d600a73194cdf545bcf02e290f3361a25ceb6db0336b4db8dc0de689bd57b3fe933e663d53b5d739f8bf1287202885bf4c6f75bcecf31cd39a1352b2e3411ebb9c165965015235ae53a36e3d785023570cca2f858ad0cfef0d7405a67b75b13a8266462a175acf0504fe2dc9c678a263e9925d050cfc90bf327366525c90ff4fac2c5fa4699acf9da74c2b866fe04ecb3916b1ec0d425e89fa8ac3e5ba10111082179519377e360f544d35355e7613279ce79f33f2db60aa60ceb9f7e11bc895cc32bf88fe9e372b1f37481924b6e6fd891c74597578fcf0d6156149d7b3d106e01606211274ab40000000e1916923c0084e3feafe5b002619864f470afc5652902c72e0d306eb56dcaa3ca237bbd94f79c75f247f91e38ffba50bda2cd4aadbc2c2ee2bd8cb5b29c95164	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000039e08b06c84715459283081ff7bb5a60000000000200000000001066000000010000200000007df3a361b2de8d63cd17a68ba46fb17dfc82896eb76172e0711c798a43fbc531000000000e80000000020000200000007c573f8ce1b42e0eee4102abe358dcaf45e5dad7a4452c4f0a63d3519add0c7350010000b4b92c9e8b9c1b3488fa605847d10ce4ad78aed7fb0e187ccbc4f155da651ff802744d0c4305908256671f45d53c059b7478ab52da487e85ef2fa205b0fba0792011deeb137eb6a0c43df94ddef1f0514396816aecdf4d9bc854a6484ec58989fbd75e67555bb5ee3bba6625a04a0d5a29fe2a95e17fbacf0bb8ea8eb162fcb560ac20c6dc6a27b05f59bfaa64fb83a269be0e0e550a082cc40a7380dec618badfa01f466e8f90ba15b0e56c9dedda2b9ecb418273379503ab64ee73032bb38aae7fa6406ae157909242a1ff1a1e8bdff5c6a112c53ab47580248e0633db51500ca9ec1e40d13090358d277d71fe6d05e08549392408b005caa2ef43bede31a9db838825cdceed276e1392712488d9dd8d44480b7e6afb2475be7ec9be99f4b935625d093405ecad09baf618e66b8f6f3f3b1542311700e520e7c540003ac8afc4c3b02167214c8b1731f3fd6ee0040040000000f15ed9434d55b782f03ef38c7e44794f4629ee78301b85e862f70ed6535e19de283db47e6fafd67db603b3b5f2b95580a5d023efdb0863f4d206555b2a3413aa	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 8 IoCs

Processes:

iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exe

pid process

856 iexplore.exe
1164 iexplore.exe
936 iexplore.exe
1896 iexplore.exe
1920 iexplore.exe
1664 iexplore.exe
1440 iexplore.exe
516 iexplore.exe

Suspicious use of SetWindowsHookEx 32 IoCs

Processes:

iexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXE

pid	process
856	iexplore.exe
856	iexplore.exe
664	IEXPLORE.EXE
664	IEXPLORE.EXE
1164	iexplore.exe
1164	iexplore.exe
1624	IEXPLORE.EXE
1624	IEXPLORE.EXE
936	iexplore.exe
936	iexplore.exe
1448	IEXPLORE.EXE
1448	IEXPLORE.EXE
1896	iexplore.exe
1896	iexplore.exe
560	IEXPLORE.EXE
560	IEXPLORE.EXE
1920	iexplore.exe
1920	iexplore.exe
1924	IEXPLORE.EXE
1924	IEXPLORE.EXE
1664	iexplore.exe
1664	iexplore.exe
948	IEXPLORE.EXE
948	IEXPLORE.EXE
1440	iexplore.exe
1440	iexplore.exe
1572	IEXPLORE.EXE
1572	IEXPLORE.EXE
516	iexplore.exe
516	iexplore.exe
592	IEXPLORE.EXE
592	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 39 IoCs

Processes:

rundll32.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exe

description	pid	process	target process
PID 1944 wrote to memory of 1472	1944	rundll32.exe	rundll32.exe
PID 1944 wrote to memory of 1472	1944	rundll32.exe	rundll32.exe
PID 1944 wrote to memory of 1472	1944	rundll32.exe	rundll32.exe
PID 1944 wrote to memory of 1472	1944	rundll32.exe	rundll32.exe
PID 1944 wrote to memory of 1472	1944	rundll32.exe	rundll32.exe
PID 1944 wrote to memory of 1472	1944	rundll32.exe	rundll32.exe
PID 1944 wrote to memory of 1472	1944	rundll32.exe	rundll32.exe
PID 856 wrote to memory of 664	856	iexplore.exe	IEXPLORE.EXE
PID 856 wrote to memory of 664	856	iexplore.exe	IEXPLORE.EXE
PID 856 wrote to memory of 664	856	iexplore.exe	IEXPLORE.EXE
PID 856 wrote to memory of 664	856	iexplore.exe	IEXPLORE.EXE
PID 1164 wrote to memory of 1624	1164	iexplore.exe	IEXPLORE.EXE
PID 1164 wrote to memory of 1624	1164	iexplore.exe	IEXPLORE.EXE
PID 1164 wrote to memory of 1624	1164	iexplore.exe	IEXPLORE.EXE
PID 1164 wrote to memory of 1624	1164	iexplore.exe	IEXPLORE.EXE
PID 936 wrote to memory of 1448	936	iexplore.exe	IEXPLORE.EXE
PID 936 wrote to memory of 1448	936	iexplore.exe	IEXPLORE.EXE
PID 936 wrote to memory of 1448	936	iexplore.exe	IEXPLORE.EXE
PID 936 wrote to memory of 1448	936	iexplore.exe	IEXPLORE.EXE
PID 1896 wrote to memory of 560	1896	iexplore.exe	IEXPLORE.EXE
PID 1896 wrote to memory of 560	1896	iexplore.exe	IEXPLORE.EXE
PID 1896 wrote to memory of 560	1896	iexplore.exe	IEXPLORE.EXE
PID 1896 wrote to memory of 560	1896	iexplore.exe	IEXPLORE.EXE
PID 1920 wrote to memory of 1924	1920	iexplore.exe	IEXPLORE.EXE
PID 1920 wrote to memory of 1924	1920	iexplore.exe	IEXPLORE.EXE
PID 1920 wrote to memory of 1924	1920	iexplore.exe	IEXPLORE.EXE
PID 1920 wrote to memory of 1924	1920	iexplore.exe	IEXPLORE.EXE
PID 1664 wrote to memory of 948	1664	iexplore.exe	IEXPLORE.EXE
PID 1664 wrote to memory of 948	1664	iexplore.exe	IEXPLORE.EXE
PID 1664 wrote to memory of 948	1664	iexplore.exe	IEXPLORE.EXE
PID 1664 wrote to memory of 948	1664	iexplore.exe	IEXPLORE.EXE
PID 1440 wrote to memory of 1572	1440	iexplore.exe	IEXPLORE.EXE
PID 1440 wrote to memory of 1572	1440	iexplore.exe	IEXPLORE.EXE
PID 1440 wrote to memory of 1572	1440	iexplore.exe	IEXPLORE.EXE
PID 1440 wrote to memory of 1572	1440	iexplore.exe	IEXPLORE.EXE
PID 516 wrote to memory of 592	516	iexplore.exe	IEXPLORE.EXE
PID 516 wrote to memory of 592	516	iexplore.exe	IEXPLORE.EXE
PID 516 wrote to memory of 592	516	iexplore.exe	IEXPLORE.EXE
PID 516 wrote to memory of 592	516	iexplore.exe	IEXPLORE.EXE

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9e0cfd00991a3d387a78770a7748418b4d0ab978717f84a399d766b19a971df0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1944

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9e0cfd00991a3d387a78770a7748418b4d0ab978717f84a399d766b19a971df0.dll,#1
2⤵
- Blocklisted process makes network request
PID:1472

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:856

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:856 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:664

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1164

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1164 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1624

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:936

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:936 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1448

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1896

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1896 CREDAT:275457 /prefetch:2
2⤵
- Suspicious use of SetWindowsHookEx
PID:560

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1920

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1920 CREDAT:275457 /prefetch:2
2⤵
- Suspicious use of SetWindowsHookEx
PID:1924

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1664

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1664 CREDAT:275457 /prefetch:2
2⤵
- Suspicious use of SetWindowsHookEx
PID:948

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1440

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1440 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1572

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:516

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:516 CREDAT:275457 /prefetch:2
2⤵
- Suspicious use of SetWindowsHookEx
PID:592

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/328-4-0x000007FEF6080000-0x000007FEF62FA000-memory.dmp

Filesize
2.5MB

Download
memory/560-8-0x0000000000000000-mapping.dmp

Download
memory/592-12-0x0000000000000000-mapping.dmp

Download
memory/664-5-0x0000000000000000-mapping.dmp

Download
memory/948-10-0x0000000000000000-mapping.dmp

Download
memory/1448-7-0x0000000000000000-mapping.dmp

Download
memory/1472-2-0x0000000000000000-mapping.dmp

Download
memory/1472-3-0x0000000000170000-0x0000000000182000-memory.dmp

Filesize
72KB

Download
memory/1572-11-0x0000000000000000-mapping.dmp

Download
memory/1624-6-0x0000000000000000-mapping.dmp

Download
memory/1924-9-0x0000000000000000-mapping.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads