analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Ursnif110919.dll

Full analysis: https://app.any.run/tasks/c8d131ae-4441-4da7-ae2c-02e51c34cfc1
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Malware Trends Tracker     >>>
Analysis date: September 11, 2019, 08:48:42
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
trojan
gozi
ursnif
dreambot
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5:

E3D820AE9AE577083223AE5FFA77E257

SHA1:

93F732E9300A1A145C26872DAB4EFC373F497A1E

SHA256:

85B0230151CFF3D8257CB4A37A6B8312A154B9B54BB08D171260FDFC0EDC518A

SSDEEP:

3072:OTFGwcvnpLnCTmcqwPJ+T50PfMFMBCilJPjG+cG95ZSjQzfbO9c65QE6:uGwlm6J+FyMFMBC+Z6U/jq5QE6

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • rundll32.exe (PID: 3004)

    • Connects to CnC server

      • IEXPLORE.EXE (PID: 2116)

    • URSNIF was detected

      • IEXPLORE.EXE (PID: 2116)

  • SUSPICIOUS

    • Executed via COM

      • iexplore.exe (PID: 2932)

    • Uses RUNDLL32.EXE to load library

      • rundll32.exe (PID: 304)

  • INFO

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2932)

    • Reads the machine GUID from the registry

      • iexplore.exe (PID: 2932)

    • Changes internet zones settings

      • iexplore.exe (PID: 2932)

    • Manual execution by user

      • rundll32.exe (PID: 840)
      • rundll32.exe (PID: 2684)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2932)

    • Reads internet explorer settings

      • IEXPLORE.EXE (PID: 2116)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

ProductVersion: 12.8.6126.3930
LegalTrademarks: During High
InternalName: During High
LegalCopyright: Copyright 2005, Binary Tree Life Result character course
FileVersion: 12.8.6126.3930
FileDescription: During High
CompanyName: Binary Tree Life
Comments: pose Handsystem
CharacterSet: Unicode
LanguageCode: English (U.S.)
FileSubtype: -
ObjectFileType: Dynamic link library
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x0000
ProductVersionNumber: 12.8.6126.3930
FileVersionNumber: 12.8.6126.3930
Subsystem: Windows GUI
SubsystemVersion: 6
ImageVersion: -
OSVersion: 6
EntryPoint: 0x157b5
UninitializedDataSize: -
InitializedDataSize: 9560064
CodeSize: 134144
LinkerVersion: 12
PEType: PE32
TimeStamp: 2019:09:05 14:46:47+02:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 05-Sep-2019 12:46:47
Detected languages:
  • English - United States
Debug artifacts:
  • c:\Both\Before\get\Edge\Repeat\Back\Whether\now\Surepound.pdb
Comments: pose Handsystem
CompanyName: Binary Tree Life
FileDescription: During High
FileVersion: 12.8.6126.3930
LegalCopyright: Copyright 2005, Binary Tree Life Result character course
InternalName: During High
LegalTrademarks: During High
ProductVersion: 12.8.6126.3930

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000E8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 05-Sep-2019 12:46:47
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_DLL
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00020B13
0x00020C00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.95372
.rdata
0x00022000
0x0000D9FA
0x0000DA00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.63018
.data
0x00030000
0x0090DC0C
0x00005200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.72311
.rsrc
0x0093E000
0x00001028
0x00001200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
2.9912
.reloc
0x00940000
0x00001550
0x00001600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.54185

Resources

Title
Entropy
Size
Codepage
Language
Type
1
3.49949
812
UNKNOWN
English - United States
RT_VERSION
CONDITION
2.92593
300
UNKNOWN
English - United States
RT_DIALOG
GET
2.93572
234
UNKNOWN
English - United States
RT_DIALOG
GIRL
2.79925
234
UNKNOWN
English - United States
RT_DIALOG
INCLUDE
2.79306
266
UNKNOWN
English - United States
RT_DIALOG
ONLY
2.98979
328
UNKNOWN
English - United States
RT_DIALOG
PRETTY
2.72766
224
UNKNOWN
English - United States
RT_DIALOG
PUSH
2.79036
306
UNKNOWN
English - United States
RT_DIALOG
QUITE
2.69263
180
UNKNOWN
English - United States
RT_DIALOG
SENTENCE
2.81367
252
UNKNOWN
English - United States
RT_DIALOG

Imports

COMCTL32.dll
CRYPT32.dll
KERNEL32.dll
Secur32.dll
USER32.dll
ole32.dll

Exports

Title
Ordinal
Address
Collectcut
1
0x00013F66
Travelfast
2
0x00013F14
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
6
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start rundll32.exe no specs rundll32.exe no specs iexplore.exe #URSNIF iexplore.exe rundll32.exe no specs rundll32.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
304"C:\Windows\System32\rundll32.exe" "C:\Users\admin\Desktop\Ursnif110919.dll", CollectcutC:\Windows\System32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3004"C:\Windows\System32\rundll32.exe" "C:\Users\admin\Desktop\Ursnif110919.dll", CollectcutC:\Windows\SysWOW64\rundll32.exe—rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2932"C:\Program Files\Internet Explorer\iexplore.exe" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
2116"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2932 CREDAT:267521 /prefetch:2C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
840"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\Desktop\Ursnif110919.dllC:\Windows\system32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2684"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\Desktop\Ursnif110919.dllC:\Windows\system32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
492
Read events
411
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
2
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
2932iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF07B8A568F86A7EBF.TMP —
MD5:—
SHA256:—
2932iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFE79161D105DB0AAC.TMP —
MD5:—
SHA256:—
2932iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{0F87E10A-D471-11E9-9008-5254004AAD21}.dat —
MD5:—
SHA256:—
2932iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K78MRVB5\iecompatviewlist[1].xmlxml
MD5:274B970035092BC5446995C174A0E647
SHA256:A22E0F2BC2605F998CA6B782CA01FCC558C0CEE61A46A22C7A0B262293ABD806
2932iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xmlxml
MD5:274B970035092BC5446995C174A0E647
SHA256:A22E0F2BC2605F998CA6B782CA01FCC558C0CEE61A46A22C7A0B262293ABD806
2932iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{0F87E10C-D471-11E9-9008-5254004AAD21}.datbinary
MD5:A27D6DE4FD6C293D6B16A839B9FF5A6C
SHA256:4F203BA53E6E2CA45752FAD2FEA40135DCAF2FD509D8F6A8EB9201399A13CB24
2116IEXPLORE.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\UJFUX3OG\robot[1].pngimage
MD5:4C9ACF280B47CEF7DEF3FC91A34C7FFE
SHA256:5F9FC5B3FBDDF0E72C5C56CDCFC81C6E10C617D70B1B93FBE1E4679A8797BFF7
2116IEXPLORE.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\XLWA6BPE\googlelogo_color_150x54dp[1].pngimage
MD5:9D73B3AA30BCE9D8F166DE5178AE4338
SHA256:DBEF5E5530003B7233E944856C23D1437902A2D3568CDFD2BEAF2166E9CA9139
2932iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BDW1XBVN\urlblockindex[1].binbinary
MD5:FA518E3DFAE8CA3A0E495460FD60C791
SHA256:775853600060162C4B4E5F883F9FD5A278E61C471B3EE1826396B6D129499AA7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
8
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2932
iexplore.exe
GET
304
152.199.19.161:443
https://iecvlist.microsoft.com/ie11blocklist/1401746408/versionlistWin7.xml
US
—
—
whitelisted
2932
iexplore.exe
GET
200
152.199.19.161:443
https://r20swj13mr.microsoft.com/ieblocklist/v1/urlblocklist.bin
US
—
—
whitelisted
2932
iexplore.exe
GET
200
152.199.19.161:443
https://iecvlist.microsoft.com/IE11/1479242656000/iecompatviewlist.xml
US
xml
352 Kb
whitelisted
2116
IEXPLORE.EXE
GET
404
172.217.18.174:80
http://google.com/images/cZffxr3O6xF89YeB/du33Itm3lZKoora/QeJQkG3e9a6zYsE_2F/8clGxYL0y/MGzo_2BvzaHi3pxfxB4Q/qo87TA_2BvVvxtjptAY/_2Foz6AysvW3qshKCZH_2F/WZbe6iC7p4yzO/duFj5QJN/6JlZwH3N_2Brva_2FMyPlug/P.avi
US
html
1.71 Kb
whitelisted
2116
IEXPLORE.EXE
GET
200
172.217.18.4:80
http://www.google.com/images/errors/robot.png
US
image
6.18 Kb
whitelisted
2116
IEXPLORE.EXE
GET
200
172.217.18.4:80
http://www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png
US
image
3.10 Kb
whitelisted
2932
iexplore.exe
GET
200
152.199.19.161:443
https://r20swj13mr.microsoft.com/ieblocklist/v1/urlblockindex.bin
US
binary
16 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2116
IEXPLORE.EXE
172.217.18.4:80
www.google.com
Google Inc.
US
whitelisted
2116
IEXPLORE.EXE
172.217.18.174:80
google.com
Google Inc.
US
whitelisted
2932
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.18.174
whitelisted
www.google.com
  • 172.217.18.4
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted

Threats

PID
Process
Class
Message
2116
IEXPLORE.EXE
A Network Trojan was detected
MALWARE [PTsecurity] W32.Dreambot HTTP GET Check-in
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Ursnif110919.dll