Edit tour

Windows Analysis Report
pzG0rkIchr.exe

Overview

General Information

Sample Name:	pzG0rkIchr.exe (renamed file extension from exe to dll)
Analysis ID:	752975
MD5:	d6ef4778f7dc9c31a0a2a989ef42d2fd
SHA1:	5dad8394ef37d5a006674589754f7a3187d303b1
SHA256:	54de1f2c26a63a8f6b7f8d5de99f8ebd4093959ab07f027db1985d0652258736
Tags:	exeLDR4
Infos:

Detection

Ursnif

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected Ursnif

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Antivirus detection for URL or domain

Snort IDS alert for network traffic

Performs DNS queries to domains with low reputation

One or more processes crash

Contains functionality to check if a debugger is running (IsDebuggerPresent)

May sleep (evasive loops) to hinder dynamic analysis

Internet Provider seen in connection with other malware

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

Tries to load missing DLLs

Checks if the current process is being debugged

Registers a DLL

Launches processes in debugging mode, may be used to hinder debugging

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

loaddll64.exe (PID: 492 cmdline: loaddll64.exe "C:\Users\user\Desktop\pzG0rkIchr.dll" MD5: C676FC0263EDD17D4CE7D644B8F3FCD6)

conhost.exe (PID: 5284 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 5156 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\pzG0rkIchr.dll",#1 MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

rundll32.exe (PID: 1228 cmdline: rundll32.exe "C:\Users\user\Desktop\pzG0rkIchr.dll",#1 MD5: 73C519F050C20580F8A62C849D49215A)

regsvr32.exe (PID: 5172 cmdline: regsvr32.exe /s C:\Users\user\Desktop\pzG0rkIchr.dll MD5: D78B75FC68247E8A63ACBA846182740E)

rundll32.exe (PID: 400 cmdline: rundll32.exe C:\Users\user\Desktop\pzG0rkIchr.dll,DllRegisterServer MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 2100 cmdline: rundll32.exe C:\Users\user\Desktop\pzG0rkIchr.dll,ItsnPq5v MD5: 73C519F050C20580F8A62C849D49215A)

WerFault.exe (PID: 5904 cmdline: C:\Windows\system32\WerFault.exe -u -p 2100 -s 304 MD5: 2AFFE478D86272288BBEF5A00BBEF6A0)

WerFault.exe (PID: 5968 cmdline: C:\Windows\system32\WerFault.exe -u -p 2100 -s 304 MD5: 2AFFE478D86272288BBEF5A00BBEF6A0)

rundll32.exe (PID: 1308 cmdline: rundll32.exe C:\Users\user\Desktop\pzG0rkIchr.dll,QlqYo259k MD5: 73C519F050C20580F8A62C849D49215A)

WerFault.exe (PID: 5188 cmdline: C:\Windows\system32\WerFault.exe -u -p 1308 -s 304 MD5: 2AFFE478D86272288BBEF5A00BBEF6A0)

WerFault.exe (PID: 3260 cmdline: C:\Windows\system32\WerFault.exe -u -p 1308 -s 304 MD5: 2AFFE478D86272288BBEF5A00BBEF6A0)

cleanup

Malware Configuration

Threatname: Ursnif

{"c2_domain": ["https://gigimas.xyz", "https://reaso.xyz"], "botnet": "202206061", "aes key": "eq2opFFpGzpd2p9t", "sleep time": "20", "request time": "30", "host keep time": "120", "host shift time": "120"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
Process Memory Space: loaddll64.exe PID: 492	JoeSecurity_Ursnifv4	Yara detected Ursnif	Joe Security
Process Memory Space: regsvr32.exe PID: 5172	JoeSecurity_Ursnifv4	Yara detected Ursnif	Joe Security
Process Memory Space: rundll32.exe PID: 1228	JoeSecurity_Ursnifv4	Yara detected Ursnif	Joe Security
Process Memory Space: rundll32.exe PID: 400	JoeSecurity_Ursnifv4	Yara detected Ursnif	Joe Security

Snort Signatures

ET TROJAN Observed DNS Query to Ursnif Domain (gigimas .xyz) - Source IP: 192.168.2.4 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.48.8.8.864906532039645 11/24/22-05:22:35.810533
SID:	2039645
Source Port:	64906
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed DNS Query to Ursnif Domain (gigimas .xyz) - Source IP: 192.168.2.4 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.48.8.8.861007532039645 11/24/22-05:20:02.978332
SID:	2039645
Source Port:	61007
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed DNS Query to Ursnif Domain (gigimas .xyz) - Source IP: 192.168.2.4 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.48.8.8.861124532039645 11/24/22-05:21:04.451832
SID:	2039645
Source Port:	61124
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed DNS Query to Ursnif Domain (gigimas .xyz) - Source IP: 192.168.2.4 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.48.8.8.859444532039645 11/24/22-05:21:34.871041
SID:	2039645
Source Port:	59444
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed DNS Query to Ursnif Domain (gigimas .xyz) - Source IP: 192.168.2.4 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.48.8.8.855570532039645 11/24/22-05:22:05.359167
SID:	2039645
Source Port:	55570
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed DNS Query to Ursnif Domain (gigimas .xyz) - Source IP: 192.168.2.4 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.48.8.8.860686532039645 11/24/22-05:20:33.386749
SID:	2039645
Source Port:	60686
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed DNS Query to Ursnif Domain (gigimas .xyz) - Source IP: 192.168.2.4 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.48.8.8.859446532039645 11/24/22-05:23:06.390786
SID:	2039645
Source Port:	59446
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: pzG0rkIchr.dll

ReversingLabs: Detection: 73%

Antivirus detection for URL or domain

Source: https://reaso.xyz

Avira URL Cloud: Label: malware

Source: 3.3.regsvr32.exe.6cf200.1.raw.unpack

Malware Configuration Extractor: Ursnif {"c2_domain": ["https://gigimas.xyz", "https://reaso.xyz"], "botnet": "202206061", "aes key": "eq2opFFpGzpd2p9t", "sleep time": "20", "request time": "30", "host keep time": "120", "host shift time": "120"}

Source: pzG0rkIchr.dll

Static PE information: certificate valid

Source: pzG0rkIchr.dll

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: UxTheme.pdb source: WerFault.exe, 0000000B.00000003.395877568.000001716E477000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000B.00000003.396307800.000001716E477000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396853459.000001DFB5E17000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396775988.000001DFB5E17000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: gdi32.pdb source: WerFault.exe, 0000000B.00000003.396163566.000001716E474000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000B.00000003.395867216.000001716E471000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396822650.000001DFB5E14000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396760863.000001DFB5E11000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: kernelbase.pdb0 source: WerFault.exe, 0000000B.00000003.392399774.000001716D896000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.390485617.000001DFB52D7000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.392399063.000001DFB52D7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: bcryptprimitives.pdb8 source: WerFault.exe, 0000000B.00000003.395867216.000001716E471000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396760863.000001DFB5E11000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 0000000B.00000003.395877568.000001716E477000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000B.00000003.396307800.000001716E477000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396853459.000001DFB5E17000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396775988.000001DFB5E17000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rpcrt4.pdb source: WerFault.exe, 0000000B.00000003.395867216.000001716E471000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396760863.000001DFB5E11000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dwmapi.pdb: source: WerFault.exe, 0000000C.00000003.396853459.000001DFB5E17000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396775988.000001DFB5E17000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: se.pdb\ source: WerFault.exe, 0000000C.00000002.404139284.000001DFB33E2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 0000000B.00000003.395867216.000001716E471000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396760863.000001DFB5E11000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: kernelbase.pdb8 source: WerFault.exe, 0000000B.00000003.395867216.000001716E471000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396760863.000001DFB5E11000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ucrtbase.pdb8 source: WerFault.exe, 0000000B.00000003.395867216.000001716E471000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396760863.000001DFB5E11000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: shcore.pdb8 source: WerFault.exe, 0000000B.00000003.395867216.000001716E471000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396760863.000001DFB5E11000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 0000000B.00000003.395867216.000001716E471000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396760863.000001DFB5E11000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: combase.pdb8 source: WerFault.exe, 0000000B.00000003.395867216.000001716E471000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396760863.000001DFB5E11000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: win32u.pdb8 source: WerFault.exe, 0000000B.00000003.396163566.000001716E474000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000B.00000003.395867216.000001716E471000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396822650.000001DFB5E14000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396760863.000001DFB5E11000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: se.pdb( source: WerFault.exe, 0000000B.00000002.404499737.000001716B9D2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: oleaut32.pdb6 source: WerFault.exe, 0000000C.00000003.396853459.000001DFB5E17000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396775988.000001DFB5E17000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 0000000B.00000003.395867216.000001716E471000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396760863.000001DFB5E11000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: UxTheme.pdb" source: WerFault.exe, 0000000C.00000003.396853459.000001DFB5E17000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396775988.000001DFB5E17000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msctf.pdb source: WerFault.exe, 0000000B.00000003.395877568.000001716E477000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000B.00000003.396307800.000001716E477000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396853459.000001DFB5E17000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396775988.000001DFB5E17000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: gdi32full.pdb8 source: WerFault.exe, 0000000B.00000003.396163566.000001716E474000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000B.00000003.395867216.000001716E471000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396822650.000001DFB5E14000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396760863.000001DFB5E11000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: gdi32.pdb8 source: WerFault.exe, 0000000B.00000003.396163566.000001716E474000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000B.00000003.395867216.000001716E471000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396822650.000001DFB5E14000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396760863.000001DFB5E11000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: user32.pdb source: WerFault.exe, 0000000B.00000003.395867216.000001716E471000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396760863.000001DFB5E11000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 0000000B.00000003.396118866.000001716E470000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396815765.000001DFB5E10000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rundll32.pdb8 source: WerFault.exe, 0000000B.00000003.395867216.000001716E471000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396760863.000001DFB5E11000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: .pdbU source: WerFault.exe, 0000000B.00000002.404499737.000001716B9D2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rpcrt4.pdb8 source: WerFault.exe, 0000000B.00000003.395867216.000001716E471000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396760863.000001DFB5E11000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 0000000B.00000003.395867216.000001716E471000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396760863.000001DFB5E11000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: imagehlp.pdb8 source: WerFault.exe, 0000000B.00000003.395867216.000001716E471000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396760863.000001DFB5E11000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: WerFault.exe, 0000000B.00000003.390149544.000001716D88A000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000B.00000003.393542297.000001716D88A000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000B.00000003.395867216.000001716E471000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.390425076.000001DFB52CA000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.393721593.000001DFB52CA000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396760863.000001DFB5E11000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 0000000B.00000003.395867216.000001716E471000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396760863.000001DFB5E11000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: kernel32.pdb source: WerFault.exe, 0000000B.00000003.390201513.000001716D890000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000B.00000003.392963034.000001716D890000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000B.00000003.395867216.000001716E471000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.390462142.000001DFB52D1000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.393053418.000001DFB52D1000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396760863.000001DFB5E11000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rundll32.pdb source: WerFault.exe, 0000000B.00000003.390045053.000001716D884000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000B.00000003.389884691.000001716D918000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000B.00000003.395867216.000001716E471000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.390315024.000001DFB52C4000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396760863.000001DFB5E11000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.390223237.000001DFB5359000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: se.pdb source: WerFault.exe, 0000000B.00000002.404499737.000001716B9D2000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000002.404139284.000001DFB33E2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msvcrt.pdb8 source: WerFault.exe, 0000000B.00000003.395867216.000001716E471000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396760863.000001DFB5E11000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: oleaut32.pdb source: WerFault.exe, 0000000B.00000003.395877568.000001716E477000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000B.00000003.396307800.000001716E477000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396853459.000001DFB5E17000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396775988.000001DFB5E17000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb8 source: WerFault.exe, 0000000B.00000003.395867216.000001716E471000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396760863.000001DFB5E11000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: imagehlp.pdb source: WerFault.exe, 0000000B.00000003.395867216.000001716E471000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396760863.000001DFB5E11000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: win32u.pdb source: WerFault.exe, 0000000B.00000003.396163566.000001716E474000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000B.00000003.395867216.000001716E471000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396822650.000001DFB5E14000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396760863.000001DFB5E11000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: gdi32full.pdb source: WerFault.exe, 0000000B.00000003.396163566.000001716E474000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000B.00000003.395867216.000001716E471000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396822650.000001DFB5E14000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396760863.000001DFB5E11000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: kernel32.pdb8 source: WerFault.exe, 0000000B.00000003.395867216.000001716E471000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396760863.000001DFB5E11000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: user32.pdb8 source: WerFault.exe, 0000000B.00000003.395867216.000001716E471000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396760863.000001DFB5E11000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dwmapi.pdb source: WerFault.exe, 0000000B.00000003.395877568.000001716E477000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000B.00000003.396307800.000001716E477000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396853459.000001DFB5E17000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396775988.000001DFB5E17000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb0 source: WerFault.exe, 0000000B.00000003.390149544.000001716D88A000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000B.00000003.393542297.000001716D88A000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.390425076.000001DFB52CA000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.393721593.000001DFB52CA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: kernelbase.pdb source: WerFault.exe, 0000000B.00000003.392399774.000001716D896000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000B.00000003.395867216.000001716E471000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.390485617.000001DFB52D7000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.392399063.000001DFB52D7000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396760863.000001DFB5E11000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: kernel32.pdb0 source: WerFault.exe, 0000000B.00000003.390201513.000001716D890000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000B.00000003.392963034.000001716D890000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.390462142.000001DFB52D1000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.393053418.000001DFB52D1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: imm32.pdb source: WerFault.exe, 0000000B.00000003.396118866.000001716E470000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396815765.000001DFB5E10000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FF88C07FB70 FindFirstFileExA,
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FF88C07FB70 FindFirstFileExA,
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF88C07FB70 FindFirstFileExA,

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\rundll32.exe	Network Connect: 185.250.148.35 443
Source: C:\Windows\System32\rundll32.exe	Domain query: gigimas.xyz

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2039645 ET TROJAN Observed DNS Query to Ursnif Domain (gigimas .xyz) 192.168.2.4:61007 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2039645 ET TROJAN Observed DNS Query to Ursnif Domain (gigimas .xyz) 192.168.2.4:60686 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2039645 ET TROJAN Observed DNS Query to Ursnif Domain (gigimas .xyz) 192.168.2.4:61124 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2039645 ET TROJAN Observed DNS Query to Ursnif Domain (gigimas .xyz) 192.168.2.4:59444 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2039645 ET TROJAN Observed DNS Query to Ursnif Domain (gigimas .xyz) 192.168.2.4:55570 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2039645 ET TROJAN Observed DNS Query to Ursnif Domain (gigimas .xyz) 192.168.2.4:64906 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2039645 ET TROJAN Observed DNS Query to Ursnif Domain (gigimas .xyz) 192.168.2.4:59446 -> 8.8.8.8:53

Performs DNS queries to domains with low reputation

Source: C:\Windows\System32\rundll32.exe	DNS query: gigimas.xyz
Source: C:\Windows\System32\rundll32.exe	DNS query: gigimas.xyz
Source: C:\Windows\System32\rundll32.exe	DNS query: gigimas.xyz
Source: C:\Windows\System32\rundll32.exe	DNS query: gigimas.xyz
Source: C:\Windows\System32\rundll32.exe	DNS query: gigimas.xyz
Source: C:\Windows\System32\rundll32.exe	DNS query: gigimas.xyz
Source: C:\Windows\System32\rundll32.exe	DNS query: gigimas.xyz

Source: Joe Sandbox View

ASN Name: FIRSTDC-ASRU FIRSTDC-ASRU

Source: Joe Sandbox View

IP Address: 185.250.148.35 185.250.148.35

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443

Source: pzG0rkIchr.dll	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: WerFault.exe, 0000000B.00000002.405055392.000001716D880000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000002.404603896.000001DFB52C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: WerFault.exe, 0000000B.00000002.405055392.000001716D880000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000002.404603896.000001DFB52C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: pzG0rkIchr.dll	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: pzG0rkIchr.dll	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: pzG0rkIchr.dll	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: pzG0rkIchr.dll	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: pzG0rkIchr.dll	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: pzG0rkIchr.dll	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: pzG0rkIchr.dll	String found in binary or memory: http://ocsp.comodoca.com0
Source: pzG0rkIchr.dll	String found in binary or memory: http://ocsp.sectigo.com0
Source: loaddll64.exe, 00000000.00000003.402271914.0000027ED3940000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000003.388635168.0000000002100000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.826743463.0000021DDAD90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.826725063.0000021DDAC4D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.388322445.000001F71CC60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gigimas.xyz
Source: rundll32.exe, 00000004.00000002.825050387.0000021DD91F4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.758857404.0000021DD9255000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.758869560.0000021DD925F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.693664493.0000021DD925F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gigimas.xyz/
Source: rundll32.exe, 00000004.00000003.432267293.0000021DD9200000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gigimas.xyz/92
Source: rundll32.exe, 00000004.00000002.825050387.0000021DD91F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gigimas.xyz/ic
Source: rundll32.exe, 00000004.00000003.563913643.0000021DD9221000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gigimas.xyz/index.html
Source: rundll32.exe, 00000004.00000003.759039619.0000021DD923C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.759733313.0000021DD923C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.694516726.0000021DD923C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.629091178.0000021DD923C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.693778417.0000021DD923C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gigimas.xyz/index.html)I6
Source: rundll32.exe, 00000004.00000003.563913643.0000021DD9221000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gigimas.xyz/index.htmll
Source: rundll32.exe, 00000004.00000003.497300012.0000021DD9221000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.497398978.0000021DD9226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gigimas.xyz/index.htmlr
Source: rundll32.exe, 00000004.00000003.432113341.0000021DD9221000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gigimas.xyz/index.htmluH
Source: rundll32.exe, 00000004.00000002.825032098.0000021DD91ED000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.825050387.0000021DD91F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gigimas.xyz:443/index.html
Source: rundll32.exe, 00000004.00000002.826725063.0000021DDAC4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gigimas.xyzhttps://reaso.xyz
Source: loaddll64.exe, 00000000.00000003.402277727.0000027ED3942000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000003.388644042.0000000002102000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.826756799.0000021DDAD92000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.388329786.000001F71CC62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://http://Mozilla/5.0
Source: rundll32.exe, 00000004.00000002.826725063.0000021DDAC4D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.388322445.000001F71CC60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reaso.xyz
Source: pzG0rkIchr.dll	String found in binary or memory: https://sectigo.com/CPS0

Source: unknown

DNS traffic detected: queries for: gigimas.xyz

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected Ursnif

Source: Yara match	File source: Process Memory Space: loaddll64.exe PID: 492, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: regsvr32.exe PID: 5172, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 1228, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 400, type: MEMORYSTR

E-Banking Fraud

Yara detected Ursnif

Source: Yara match	File source: Process Memory Space: loaddll64.exe PID: 492, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: regsvr32.exe PID: 5172, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 1228, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 400, type: MEMORYSTR

Source: C:\Windows\System32\rundll32.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 2100 -s 304

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000027ED37137E0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000027ED3715638
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000027ED371A918
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000027ED3716DF0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000027ED3717FD4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000027ED3713CD8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000027ED37131C0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000027ED37134A4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000027ED3719D6C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000027ED3714540
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000027ED371204C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FF88C076D50
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FF88C075840
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FF88C071520
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FF88C088D50
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FF88C090D70
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FF88C07F964
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FF88C08B9B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FF88C0875E0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FF88C081E14
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FF88C08F290
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FF88C0742A0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FF88C0776E0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FF88C071B10
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FF88C08B370
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FF88C079BA0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FF88C0783C0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FF88C086808
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FF88C076820
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FF88C074C80
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FF88C07DCAC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FF88C0790B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FF88C075CC0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FF88C08F8F0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FF88C0898F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_003D37E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_003D5638
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_003DA918
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_003D9D6C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_003D204C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_003D4540
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_003D34A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_003D6DF0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_003D3CD8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_003D7FD4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_003D31C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FF88C076D50
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FF88C075840
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FF88C071520
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FF88C088D50
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FF88C090D70
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FF88C07F964
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FF88C08B9B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FF88C0875E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FF88C081E14
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FF88C08F290
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FF88C0742A0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FF88C0776E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FF88C071B10
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FF88C08B370
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FF88C079BA0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FF88C0783C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FF88C086808
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FF88C076820
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FF88C074C80
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FF88C07DCAC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FF88C0790B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FF88C075CC0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FF88C08F8F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FF88C0898F0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000021DD93337E0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000021DD9333CD8
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000021DD93331C0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000021DD9335638
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000021DD9339D6C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000021DD93334A4
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000021DD9336DF0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000021DD9337FD4
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000021DD933A918
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000021DD9334540
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000021DD933204C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001F71CC037E0
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001F71CC03CD8
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001F71CC06DF0
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001F71CC034A4
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001F71CC031C0
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001F71CC07FD4
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001F71CC09D6C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001F71CC0A918
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001F71CC05638
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001F71CC04540
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001F71CC0204C
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF88C071520
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF88C088D50
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF88C076D50
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF88C090D70
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF88C07F964
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF88C08B9B0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF88C0875E0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF88C081E14
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF88C08F290
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF88C0742A0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF88C0776E0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF88C071B10
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF88C08B370
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF88C079BA0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF88C0783C0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF88C086808
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF88C076820
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF88C075840
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF88C074C80
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF88C07DCAC
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF88C0790B0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF88C075CC0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF88C08F8F0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF88C0898F0

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000027ED371A0AC CreateFileW,NtQueryDirectoryFile,
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_003DA0AC CreateFileW,NtQueryDirectoryFile,
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000021DD933A0AC CreateFileW,NtQueryDirectoryFile,
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001F71CC0A0AC CreateFileW,NtQueryDirectoryFile,

Source: C:\Windows\System32\regsvr32.exe

Section loaded: sfc.dll

Source: pzG0rkIchr.dll

ReversingLabs: Detection: 73%

Source: pzG0rkIchr.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\pzG0rkIchr.dll"
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\pzG0rkIchr.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\pzG0rkIchr.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\pzG0rkIchr.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\pzG0rkIchr.dll,DllRegisterServer
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\pzG0rkIchr.dll,ItsnPq5v
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\pzG0rkIchr.dll,QlqYo259k
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 2100 -s 304
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 1308 -s 304
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 2100 -s 304
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 1308 -s 304
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\pzG0rkIchr.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\pzG0rkIchr.dll
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\pzG0rkIchr.dll,DllRegisterServer
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\pzG0rkIchr.dll,ItsnPq5v
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\pzG0rkIchr.dll,QlqYo259k
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\pzG0rkIchr.dll",#1
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 2100 -s 304
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 1308 -s 304

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WER8047.tmp

Jump to behavior

Source: classification engine

Classification label: mal84.troj.evad.winDLL@22/8@7/1

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\pzG0rkIchr.dll",#1

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5284:120:WilError_01
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1308
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2100
Source: C:\Windows\System32\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\ManagerMui

Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: pzG0rkIchr.dll

Static PE information: Image base 0x180000000 > 0x60000000

Source: pzG0rkIchr.dll

Static PE information: certificate valid

Source: pzG0rkIchr.dll

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source: pzG0rkIchr.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: UxTheme.pdb source: WerFault.exe, 0000000B.00000003.395877568.000001716E477000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000B.00000003.396307800.000001716E477000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396853459.000001DFB5E17000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396775988.000001DFB5E17000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: gdi32.pdb source: WerFault.exe, 0000000B.00000003.396163566.000001716E474000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000B.00000003.395867216.000001716E471000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396822650.000001DFB5E14000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396760863.000001DFB5E11000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: kernelbase.pdb0 source: WerFault.exe, 0000000B.00000003.392399774.000001716D896000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.390485617.000001DFB52D7000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.392399063.000001DFB52D7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: bcryptprimitives.pdb8 source: WerFault.exe, 0000000B.00000003.395867216.000001716E471000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396760863.000001DFB5E11000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 0000000B.00000003.395877568.000001716E477000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000B.00000003.396307800.000001716E477000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396853459.000001DFB5E17000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396775988.000001DFB5E17000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rpcrt4.pdb source: WerFault.exe, 0000000B.00000003.395867216.000001716E471000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396760863.000001DFB5E11000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dwmapi.pdb: source: WerFault.exe, 0000000C.00000003.396853459.000001DFB5E17000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396775988.000001DFB5E17000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: se.pdb\ source: WerFault.exe, 0000000C.00000002.404139284.000001DFB33E2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 0000000B.00000003.395867216.000001716E471000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396760863.000001DFB5E11000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: kernelbase.pdb8 source: WerFault.exe, 0000000B.00000003.395867216.000001716E471000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396760863.000001DFB5E11000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ucrtbase.pdb8 source: WerFault.exe, 0000000B.00000003.395867216.000001716E471000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396760863.000001DFB5E11000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: shcore.pdb8 source: WerFault.exe, 0000000B.00000003.395867216.000001716E471000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396760863.000001DFB5E11000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 0000000B.00000003.395867216.000001716E471000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396760863.000001DFB5E11000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: combase.pdb8 source: WerFault.exe, 0000000B.00000003.395867216.000001716E471000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396760863.000001DFB5E11000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: win32u.pdb8 source: WerFault.exe, 0000000B.00000003.396163566.000001716E474000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000B.00000003.395867216.000001716E471000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396822650.000001DFB5E14000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396760863.000001DFB5E11000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: se.pdb( source: WerFault.exe, 0000000B.00000002.404499737.000001716B9D2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: oleaut32.pdb6 source: WerFault.exe, 0000000C.00000003.396853459.000001DFB5E17000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396775988.000001DFB5E17000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 0000000B.00000003.395867216.000001716E471000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396760863.000001DFB5E11000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: UxTheme.pdb" source: WerFault.exe, 0000000C.00000003.396853459.000001DFB5E17000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396775988.000001DFB5E17000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msctf.pdb source: WerFault.exe, 0000000B.00000003.395877568.000001716E477000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000B.00000003.396307800.000001716E477000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396853459.000001DFB5E17000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396775988.000001DFB5E17000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: gdi32full.pdb8 source: WerFault.exe, 0000000B.00000003.396163566.000001716E474000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000B.00000003.395867216.000001716E471000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396822650.000001DFB5E14000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396760863.000001DFB5E11000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: gdi32.pdb8 source: WerFault.exe, 0000000B.00000003.396163566.000001716E474000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000B.00000003.395867216.000001716E471000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396822650.000001DFB5E14000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396760863.000001DFB5E11000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: user32.pdb source: WerFault.exe, 0000000B.00000003.395867216.000001716E471000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396760863.000001DFB5E11000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 0000000B.00000003.396118866.000001716E470000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396815765.000001DFB5E10000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rundll32.pdb8 source: WerFault.exe, 0000000B.00000003.395867216.000001716E471000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396760863.000001DFB5E11000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: .pdbU source: WerFault.exe, 0000000B.00000002.404499737.000001716B9D2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rpcrt4.pdb8 source: WerFault.exe, 0000000B.00000003.395867216.000001716E471000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396760863.000001DFB5E11000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 0000000B.00000003.395867216.000001716E471000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396760863.000001DFB5E11000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: imagehlp.pdb8 source: WerFault.exe, 0000000B.00000003.395867216.000001716E471000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396760863.000001DFB5E11000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: WerFault.exe, 0000000B.00000003.390149544.000001716D88A000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000B.00000003.393542297.000001716D88A000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000B.00000003.395867216.000001716E471000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.390425076.000001DFB52CA000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.393721593.000001DFB52CA000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396760863.000001DFB5E11000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 0000000B.00000003.395867216.000001716E471000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396760863.000001DFB5E11000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: kernel32.pdb source: WerFault.exe, 0000000B.00000003.390201513.000001716D890000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000B.00000003.392963034.000001716D890000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000B.00000003.395867216.000001716E471000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.390462142.000001DFB52D1000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.393053418.000001DFB52D1000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396760863.000001DFB5E11000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rundll32.pdb source: WerFault.exe, 0000000B.00000003.390045053.000001716D884000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000B.00000003.389884691.000001716D918000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000B.00000003.395867216.000001716E471000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.390315024.000001DFB52C4000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396760863.000001DFB5E11000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.390223237.000001DFB5359000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: se.pdb source: WerFault.exe, 0000000B.00000002.404499737.000001716B9D2000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000002.404139284.000001DFB33E2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msvcrt.pdb8 source: WerFault.exe, 0000000B.00000003.395867216.000001716E471000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396760863.000001DFB5E11000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: oleaut32.pdb source: WerFault.exe, 0000000B.00000003.395877568.000001716E477000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000B.00000003.396307800.000001716E477000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396853459.000001DFB5E17000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396775988.000001DFB5E17000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb8 source: WerFault.exe, 0000000B.00000003.395867216.000001716E471000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396760863.000001DFB5E11000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: imagehlp.pdb source: WerFault.exe, 0000000B.00000003.395867216.000001716E471000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396760863.000001DFB5E11000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: win32u.pdb source: WerFault.exe, 0000000B.00000003.396163566.000001716E474000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000B.00000003.395867216.000001716E471000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396822650.000001DFB5E14000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396760863.000001DFB5E11000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: gdi32full.pdb source: WerFault.exe, 0000000B.00000003.396163566.000001716E474000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000B.00000003.395867216.000001716E471000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396822650.000001DFB5E14000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396760863.000001DFB5E11000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: kernel32.pdb8 source: WerFault.exe, 0000000B.00000003.395867216.000001716E471000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396760863.000001DFB5E11000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: user32.pdb8 source: WerFault.exe, 0000000B.00000003.395867216.000001716E471000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396760863.000001DFB5E11000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dwmapi.pdb source: WerFault.exe, 0000000B.00000003.395877568.000001716E477000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000B.00000003.396307800.000001716E477000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396853459.000001DFB5E17000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396775988.000001DFB5E17000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb0 source: WerFault.exe, 0000000B.00000003.390149544.000001716D88A000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000B.00000003.393542297.000001716D88A000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.390425076.000001DFB52CA000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.393721593.000001DFB52CA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: kernelbase.pdb source: WerFault.exe, 0000000B.00000003.392399774.000001716D896000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000B.00000003.395867216.000001716E471000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.390485617.000001DFB52D7000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.392399063.000001DFB52D7000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396760863.000001DFB5E11000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: kernel32.pdb0 source: WerFault.exe, 0000000B.00000003.390201513.000001716D890000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000B.00000003.392963034.000001716D890000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.390462142.000001DFB52D1000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.393053418.000001DFB52D1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: imm32.pdb source: WerFault.exe, 0000000B.00000003.396118866.000001716E470000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000C.00000003.396815765.000001DFB5E10000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FF88C08B9B0 LoadLibraryA,GetProcAddress,

Source: C:\Windows\System32\loaddll64.exe

Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\pzG0rkIchr.dll

Hooking and other Techniques for Hiding and Protection

Yara detected Ursnif

Source: Yara match	File source: Process Memory Space: loaddll64.exe PID: 492, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: regsvr32.exe PID: 5172, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 1228, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 400, type: MEMORYSTR

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX

Source: C:\Windows\System32\loaddll64.exe TID: 5272

Thread sleep time: -120000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\rundll32.exe	Last function: Thread delayed

Source: C:\Windows\System32\rundll32.exe

API coverage: 4.0 %

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FF88C07FB70 FindFirstFileExA,
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FF88C07FB70 FindFirstFileExA,
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF88C07FB70 FindFirstFileExA,

Source: C:\Windows\System32\loaddll64.exe

Thread delayed: delay time: 120000

Source: C:\Windows\System32\loaddll64.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\System32\loaddll64.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\System32\loaddll64.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\System32\regsvr32.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\System32\regsvr32.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\System32\regsvr32.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\System32\rundll32.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\System32\rundll32.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\System32\rundll32.exe	API call chain: ExitProcess graph end node

Source: rundll32.exe, 00000004.00000003.759039619.0000021DD923C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.564079958.0000021DD923C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.759733313.0000021DD923C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.497353450.0000021DD923C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.694516726.0000021DD923C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.629091178.0000021DD923C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.825208523.0000021DD923C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.432152980.0000021DD923C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.497418075.0000021DD923C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.693778417.0000021DD923C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW\
Source: WerFault.exe, 0000000C.00000002.404708361.000001DFB5324000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0*K
Source: WerFault.exe, 0000000B.00000002.405301805.000001716D916000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000B.00000003.403687494.000001716D916000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW</
Source: WerFault.exe, 0000000B.00000003.401733084.000001716D910000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000B.00000003.401808320.000001716D914000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW</%SystemRoot%\system32\mswsock.dll<reqs>
Source: rundll32.exe, 00000004.00000003.759039619.0000021DD923C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.564079958.0000021DD923C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.759733313.0000021DD923C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.497353450.0000021DD923C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.694516726.0000021DD923C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.629091178.0000021DD923C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.825208523.0000021DD923C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.432152980.0000021DD923C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.497418075.0000021DD923C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.693778417.0000021DD923C000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 0000000B.00000002.404822488.000001716BA98000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: rundll32.exe, 00000004.00000002.824960141.0000021DD91C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FF88C07E374 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FF88C08B9B0 LoadLibraryA,GetProcAddress,

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FF88C0711F0 ReadFile,GetProcessHeap,HeapFree,

Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort

Source: C:\Windows\System32\rundll32.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 2100 -s 304

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FF88C086DA4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FF88C07E374 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FF88C07BC0C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FF88C086DA4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FF88C07E374 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FF88C07BC0C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF88C086DA4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF88C07E374 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF88C07BC0C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\rundll32.exe	Network Connect: 185.250.148.35 443
Source: C:\Windows\System32\rundll32.exe	Domain query: gigimas.xyz

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\pzG0rkIchr.dll",#1
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 2100 -s 304
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 1308 -s 304

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FF88C0865F0 cpuid

Source: C:\Windows\System32\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FF88C08ED60 CreateNamedPipeA,

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FF88C07BB08 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

Stealing of Sensitive Information

Yara detected Ursnif

Source: Yara match	File source: Process Memory Space: loaddll64.exe PID: 492, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: regsvr32.exe PID: 5172, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 1228, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 400, type: MEMORYSTR

Remote Access Functionality

Yara detected Ursnif

Source: Yara match	File source: Process Memory Space: loaddll64.exe PID: 492, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: regsvr32.exe PID: 5172, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 1228, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 400, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Native API	1 DLL Side-Loading	112 Process Injection	1 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	12 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	21 Virtualization/Sandbox Evasion	LSASS Memory	31 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	112 Process Injection	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	2 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Regsvr32	NTDS	1 Remote System Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Rundll32	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 DLL Side-Loading	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
pzG0rkIchr.dll	73%	ReversingLabs	Win64.Trojan.Tnega

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
https://gigimas.xyz/index.html)I6	0%	Avira URL Cloud	safe
https://gigimas.xyz	0%	Avira URL Cloud	safe
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	0%	URL Reputation	safe
https://gigimas.xyz/ic	0%	Avira URL Cloud	safe
https://gigimas.xyz/index.htmlr	0%	Avira URL Cloud	safe
https://gigimas.xyz/92	0%	Avira URL Cloud	safe
https://http://Mozilla/5.0	0%	Avira URL Cloud	safe
https://gigimas.xyz/index.htmll	0%	Avira URL Cloud	safe
https://gigimas.xyz/index.htmluH	0%	Avira URL Cloud	safe
https://gigimas.xyzhttps://reaso.xyz	0%	Avira URL Cloud	safe
https://gigimas.xyz:443/index.html	0%	Avira URL Cloud	safe
https://gigimas.xyz/	0%	Avira URL Cloud	safe
https://gigimas.xyz/index.html	0%	Avira URL Cloud	safe
https://reaso.xyz	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
gigimas.xyz	185.250.148.35	true	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://gigimas.xyz	loaddll64.exe, 00000000.00000003.402271914.0000027ED3940000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000003.388635168.0000000002100000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.826743463.0000021DDAD90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.826725063.0000021DDAC4D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.388322445.000001F71CC60000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	pzG0rkIchr.dll	false	URL Reputation: safe	unknown
https://gigimas.xyz/index.html)I6	rundll32.exe, 00000004.00000003.759039619.0000021DD923C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.759733313.0000021DD923C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.694516726.0000021DD923C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.629091178.0000021DD923C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.693778417.0000021DD923C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sectigo.com/CPS0	pzG0rkIchr.dll	false	URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	pzG0rkIchr.dll	false	URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	pzG0rkIchr.dll	false	URL Reputation: safe	unknown
http://ocsp.sectigo.com0	pzG0rkIchr.dll	false	URL Reputation: safe	unknown
https://gigimas.xyz/92	rundll32.exe, 00000004.00000003.432267293.0000021DD9200000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gigimas.xyz/index.htmlr	rundll32.exe, 00000004.00000003.497300012.0000021DD9221000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.497398978.0000021DD9226000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gigimas.xyz/ic	rundll32.exe, 00000004.00000002.825050387.0000021DD91F4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gigimas.xyz/index.htmluH	rundll32.exe, 00000004.00000003.432113341.0000021DD9221000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://http://Mozilla/5.0	loaddll64.exe, 00000000.00000003.402277727.0000027ED3942000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000003.388644042.0000000002102000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.826756799.0000021DDAD92000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.388329786.000001F71CC62000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	pzG0rkIchr.dll	false	URL Reputation: safe	unknown
https://gigimas.xyz/index.html	rundll32.exe, 00000004.00000003.563913643.0000021DD9221000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	pzG0rkIchr.dll	false	URL Reputation: safe	unknown
https://gigimas.xyzhttps://reaso.xyz	rundll32.exe, 00000004.00000002.826725063.0000021DDAC4D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	pzG0rkIchr.dll	false	URL Reputation: safe	unknown
https://gigimas.xyz/index.htmll	rundll32.exe, 00000004.00000003.563913643.0000021DD9221000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gigimas.xyz/	rundll32.exe, 00000004.00000002.825050387.0000021DD91F4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.758857404.0000021DD9255000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.758869560.0000021DD925F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.693664493.0000021DD925F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reaso.xyz	rundll32.exe, 00000004.00000002.826725063.0000021DDAC4D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.388322445.000001F71CC60000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://gigimas.xyz:443/index.html	rundll32.exe, 00000004.00000002.825032098.0000021DD91ED000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.825050387.0000021DD91F4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.250.148.35	gigimas.xyz	Russian Federation		48430	FIRSTDC-ASRU	true

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	752975
Start date and time:	2022-11-24 05:18:08 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 27s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	pzG0rkIchr.exe (renamed file extension from exe to dll)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal84.troj.evad.winDLL@22/8@7/1
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 68.3% (good quality ratio 59.4%) Quality average: 56.9% Quality standard deviation: 33.4%
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Override analysis time to 240s for rundll32

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, WerFault.exe, WMIADAP.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
TCP Packets have been reduced to 100
Excluded IPs from analysis (whitelisted): 52.182.143.212
Excluded domains from analysis (whitelisted): onedsblobprdcus15.centralus.cloudapp.azure.com, login.live.com, blobcollector.events.data.trafficmanager.net, watson.telemetry.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
VT rate limit hit for: pzG0rkIchr.dll

Simulations

Behavior and APIs

Time	Type	Description
05:19:48	API Interceptor	1x Sleep call for process: loaddll64.exe modified
05:19:49	API Interceptor	2x Sleep call for process: WerFault.exe modified
05:20:02	API Interceptor	6x Sleep call for process: rundll32.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_pzG_5df03237c245e7792ae728ba7af47d1bed8c47f7_4f0e5919_16399239\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7600039551007107
Encrypted:	false
SSDEEP:	96:6TFZZFigJPnyqjs55P7HfipXIQcQHc6CcEm6cw3I/XaXz+HbHgSQgJPbpIDV9wO7:snigJKKH5Gs60j0I/u7swS274ltC
MD5:	BD5C8925F7120E1292DBD4961E9F2AB2
SHA1:	997623AC245EEC6535D175E199A180D43E9282FC
SHA-256:	0B242B11BC21F42FD27F1BDD633316DA3694606201E59C3C3CCC3593345C8B7A
SHA-512:	8075C625810E044C3224941D33DD97830E1EC5397E416AFC0DCCCB749580837F7629D7DDDCD531D39423195F82DCF2DF3060474F749789A977EF7DB655E65581
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.1.3.7.3.7.1.8.4.9.4.9.5.4.2.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.1.3.7.3.7.1.8.6.9.4.9.5.2.0.5.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.e.8.6.8.a.2.1.-.d.3.3.a.-.4.6.6.6.-.b.2.e.f.-.6.8.2.8.6.b.5.0.0.f.9.5.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.d.0.2.5.9.3.b.-.0.7.1.f.-.4.6.8.2.-.a.3.3.f.-.9.f.6.a.a.8.a.a.a.e.8.6.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.p.z.G.0.r.k.I.c.h.r...d.l.l.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.8.3.4.-.0.0.0.1.-.0.0.1.f.-.3.5.4.2.-.0.2.e.4.b.b.f.f.d.8.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.2.f.3.4.c.c.f.d.d.8.1.4.1.a.e.e.e.2.e.8.9.f.f.b.0.7.0.c.e.2.3.9.c.7.d.0.0.7.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_pzG_f6b0ff3966a3d6c74191edf638977ebb42334d7_4f0e5919_156d919c\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7599992295897045
Encrypted:	false
SSDEEP:	96:icFXVFiXJPnybjs55P7Hf5pXIQcQdc6/RcEccw3+XaXz+HbHgSQgJPbpIDV9wOyk:71iXJKIHz9mAj0I/u7swS274ltC
MD5:	1E8445DB848C561B6CB8CBEF60359786
SHA1:	00E829DA03ACB0B24004E2C2E45E7D439352BF8D
SHA-256:	8F94F06BC63F693379833D7156EC4C3E65788BD94BC7470C12EF985AED723EBD
SHA-512:	72C3DE3F22801E3947FDC86690B8A63175DC9EFCF7503AF898485A380B6941C42E55F965658B3F799051283C10C4823F5C0C2DE8EFE293C9904D117487FDA1D2
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.1.3.7.3.7.1.8.5.0.8.6.8.0.1.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.1.3.7.3.7.1.8.7.2.8.9.9.3.1.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.b.1.b.0.7.4.e.-.3.1.b.5.-.4.4.2.6.-.9.9.a.5.-.9.9.5.d.d.3.d.8.4.c.8.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.2.5.1.b.f.8.e.-.f.c.a.f.-.4.9.c.0.-.9.1.b.f.-.f.7.b.f.3.9.f.f.a.0.f.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.p.z.G.0.r.k.I.c.h.r...d.l.l.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.5.1.c.-.0.0.0.1.-.0.0.1.f.-.8.9.9.5.-.c.1.e.6.b.b.f.f.d.8.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.2.f.3.4.c.c.f.d.d.8.1.4.1.a.e.e.e.2.e.8.9.f.f.b.0.7.0.c.e.2.3.9.c.7.d.0.0.7.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8047.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Nov 24 04:19:45 2022, 0x1205a4 type
Category:	dropped
Size (bytes):	56070
Entropy (8bit):	1.7075050210528775
Encrypted:	false
SSDEEP:	192:rlRq3OC5I6Pdfek5ka0LGuO3bcmXJBjz2RdYnUQDfERORDNKyB4RSOnR:pCDck5DbRD
MD5:	1A5AA058B4E8ACA002D6B153E7C3B88E
SHA1:	B722FD3B879CCAD5D57716D5D375355C05AC1AA4
SHA-256:	4C914A886A7765E4A814BD13405293A39423A4BB8A6EE712B7D48B0E3086A3F9
SHA-512:	010E25A468C02F293CEBCAF7FA64CF746F6716571837CAD3BC35877EC74F8808B352E2DBC3CE080FF502E1CE8ED8EF02F69F4953C48FFC0537CC6363A68EA782
Malicious:	false
Preview:	MDMP....... .........~c.........................................)..........T.......8...........T...............&...........T...........@....................................................................U...........B..............Lw................,nq...T.......4.....~c.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .D.a.y.l.i.g.h.t. .T.i.m.e.......................................1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER80D3.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Nov 24 04:19:46 2022, 0x1205a4 type
Category:	dropped
Size (bytes):	54966
Entropy (8bit):	1.7301605700636602
Encrypted:	false
SSDEEP:	192:kl9crsOC5We/Q7NLbBjD4z5s0mE6liAU3Oq:amC8e/Q7d1V0m
MD5:	A57C13F28721473003BE444D7239D372
SHA1:	10C6496461E1C6113B6FF62120CA7D83CC17216A
SHA-256:	EBF7FC039C185490580CF4BB3044B63044A13DD5305F7755AC858779DDFCD9FA
SHA-512:	814B8BD3E2333F3084A46553787236EE0C5C0B71EA62B6636836254D80939B593CC3AE58EABC8CD3DDAE9620CAC53AF5550504734A192F8BADBE8BA98EEA582A
Malicious:	false
Preview:	MDMP....... .........~c.........................................)..........T.......8...........T...........................T...........@....................................................................U...........B..............Lw.....................T.............~c.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .D.a.y.l.i.g.h.t. .T.i.m.e.......................................1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER848E.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	3.696693878810589
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNiWpWiN6Y+TagmfQYSl2G+prD89b4oCafaIm:RrlsNiYWiN6YKagmfQYSlR4FafE
MD5:	891C13F961FC9780F58F08B88D03FE00
SHA1:	7AC38531C1F3F85ED591B419A1C0C9D560DE4B1B
SHA-256:	B04D603146FD1D2F17D6588066AA48A86D85B511E7D88380393C69F9BCC4575C
SHA-512:	3D766FCF4F2835FD6750E5BED7331A27EF548BB8C9D729E7B3D3AD8AA09677360AE67F5F2887B1D8057FEBFC622505A4A179A2F07B31E87FBDCEFD4B42C2B477
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.1.0.0.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8588.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8524
Entropy (8bit):	3.6955697518324317
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNivSLis6Y+ZagmfQhSGG+pr889b4IOfxIm:RrlsNiqLis6YgagmfQhSM4Zfr
MD5:	64CB5AA88613858B4078E5BB14479AE6
SHA1:	138C49AF256A227F26D86557778AADF52F016EFB
SHA-256:	1001101306104ACE07059DB78333327804781A7FBC4E59CBC7DEB3AC14A27E8E
SHA-512:	32B368E68F5C667FE75F2B36BECB8680A2D39960E69878D527CAC83B1356126C7BFA04C9645E17A0ACCC7482F244DC7A5571186F0B5F7371D39FF7579A2F5F69
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.3.0.8.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8589.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4733
Entropy (8bit):	4.474599386008591
Encrypted:	false
SSDEEP:	48:cvIwSD8zsA+JgtBI9XlVWgc8sqYjRTq8fm8M4JCXCOFFVyq85m27UZESC5S+d:uITf3NGgrsqYlTfJ8xVv+d
MD5:	CDE8A3EB67D3F603A55F6BCA1C15EA67
SHA1:	9425363A7B60C24BB7466FEAA6C38D60B86C084D
SHA-256:	F2E7CAB0595409E2A61035A46D0DF145C3CCCDC99C2FE8FDB7BBF04B590ED7F9
SHA-512:	BC28D09B0C638843187EDB12E207B49C15A1F99917950FC5E748FEC26F62376E8AFDA47C3BBBEDB80F52FC38BF4C8FE02AA0232816274B4B291A576CD030FACC
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1793610" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8683.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4733
Entropy (8bit):	4.478085829501657
Encrypted:	false
SSDEEP:	48:cvIwSD8zsA+JgtBI9XlVWgc8sqYjF8fm8M4JCXCOCFUyq85m2skUZESC5Sjd:uITf3NGgrsqYeJuzTVvjd
MD5:	0BD2A0E70F01F1D342661314591029DC
SHA1:	CFA327EBD0E02AEAA2F23AB3EA938AA843FB71F5
SHA-256:	A8350E49452A0A6A302EF0A3BA63447E4F1C64FF6C2335E22D1B53DE654A27D5
SHA-512:	6CA8CB1FA55453B637117B22CC0C474110CFE03BCFD602657AEE4F778B4072F8623D5CF32193183DF148F8A5630996B0926C499700F663552898C875774CD12A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1793610" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

Static File Info

General

File type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy (8bit):	6.637392883592079
TrID:	Win64 Dynamic Link Library (generic) (102004/3) 86.43% Win64 Executable (generic) (12005/4) 10.17% Generic Win/DOS Executable (2004/3) 1.70% DOS Executable Generic (2002/1) 1.70% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.01%
File name:	pzG0rkIchr.dll
File size:	290568
MD5:	d6ef4778f7dc9c31a0a2a989ef42d2fd
SHA1:	5dad8394ef37d5a006674589754f7a3187d303b1
SHA256:	54de1f2c26a63a8f6b7f8d5de99f8ebd4093959ab07f027db1985d0652258736
SHA512:	997b57424364ff661d80ca6efc5b7e91f2204d1ed7c4d784ee7d6134bc06952c993de038d6a25c71a7949b08ddd8cc5d167f8c753379f69ee1b6b49342fafa63
SSDEEP:	6144:wHyvumb1p7CC8VoxOJbceNOHI2Tse2RTggR/Znv+yit:Smbrgu2so2TVwcK/ZnG/t
TLSH:	ED54BF41F3D904A6D9138D3D8857562BEBF13C212214DA5F8B50C36A6F37BA1E739B22
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......!5..eT..eT..eT....Z.`T....X..T....Y.hT..^...bT..^...qT..^...uT....`.fT..eT...T......gT......dT......dT..RicheT..........PE..d..

File Icon


Icon Hash:	74f0e4ecccdce0e4

Static PE Info

General

Entrypoint:	0x18000b6ec
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x180000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, DLL
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x62C42DD7 [Tue Jul 5 12:25:59 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	4270d9bbb54b179372d82277269282e6

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=Sectigo Public Code Signing CA R36, O=Sectigo Limited, C=GB
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	7/6/2021 2:00:00 AM 7/7/2022 1:59:59 AM
Subject Chain	CN=NAILS UNLIMITED LIMITED, O=NAILS UNLIMITED LIMITED, L=DORCHESTER, S=Dorset, C=GB
Version:	3
Thumbprint MD5:	71834A68FD130C9D08796B4F19A6FC67
Thumbprint SHA-1:	CA69087AAAA087346202AD16228337130511C4C5
Thumbprint SHA-256:	F13E4801E13898E839183E3305E1DDA7F4C0EBF6EAF7553E18C1DDD4EDC94470
Serial:	2F96A89BFEC6E44DD224E8FD7E72D9BB

Entrypoint Preview

Instruction
dec eax
mov dword ptr [esp+08h], ebx
dec eax
mov dword ptr [esp+10h], esi
push edi
dec eax
sub esp, 20h
dec ecx
mov edi, eax
mov ebx, edx
dec eax
mov esi, ecx
cmp edx, 01h
jne 00007FE818B824F7h
call 00007FE818B828F0h
dec esp
mov eax, edi
mov edx, ebx
dec eax
mov ecx, esi
dec eax
mov ebx, dword ptr [esp+30h]
dec eax
mov esi, dword ptr [esp+38h]
dec eax
add esp, 20h
pop edi
jmp 00007FE818B8236Ch
int3
int3
int3
dec eax
sub esp, 28h
call 00007FE818B82D88h
test eax, eax
je 00007FE818B82513h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007FE818B824F7h
dec eax
cmp ecx, eax
je 00007FE818B82506h
xor eax, eax
dec eax
cmpxchg dword ptr [00038A68h], ecx
jne 00007FE818B824E0h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007FE818B824E9h
int3
int3
int3
dec eax
sub esp, 28h
call 00007FE818B82D4Ch
test eax, eax
je 00007FE818B824F9h
call 00007FE818B82B6Fh
jmp 00007FE818B8250Bh
call 00007FE818B82D34h
mov ecx, eax
call 00007FE818B844A1h
test eax, eax
je 00007FE818B824F6h
xor al, al
jmp 00007FE818B824F9h
call 00007FE818B84828h
mov al, 01h
dec eax
add esp, 28h
ret
dec eax
sub esp, 28h
xor ecx, ecx
call 00007FE818B82636h
test al, al
setne al
dec eax
add esp, 28h
ret
int3
int3

Rich Headers

Programming Language:

[C++] VS2015 UPD3.1 build 24215
[EXP] VS2015 UPD3.1 build 24215
[LNK] VS2015 UPD3.1 build 24215

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x371c0	0x94	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x37254	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x46000	0x15cc	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x44600	0x2908
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x49000	0x618	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x34dd0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x34df0	0x94	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x23000	0x2a8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x21390	0x21400	False	0.6091694078947368	zlib compressed data	6.321988758719223	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x23000	0x14b40	0x14c00	False	0.5551228350903614	data	5.589680054404924	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x38000	0xd378	0xc200	False	0.581286243556701	data	4.475772855701728	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x46000	0x15cc	0x1600	False	0.49556107954545453	data	5.3249872988992655	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.gfids	0x48000	0x94	0x200	False	0.248046875	data	1.4095612964443904	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x49000	0x618	0x800	False	0.54150390625	data	4.760086879502757	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL

Import

KERNEL32.dll

CreateFileA, LockFile, ReadFile, SetEndOfFile, UnlockFile, CloseHandle, PeekNamedPipe, HeapCreate, HeapAlloc, HeapFree, GetProcessHeap, HeapWalk, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, TryEnterCriticalSection, DeleteCriticalSection, WaitForSingleObject, ExitProcess, CreateThread, VirtualAlloc, GetProcAddress, CreateFileMappingA, LoadLibraryA, CreateNamedPipeA, CallNamedPipeA, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, IsProcessorFeaturePresent, GetModuleHandleW, RtlUnwindEx, InterlockedFlushSList, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, GetCurrentProcess, TerminateProcess, GetModuleHandleExW, GetModuleFileNameA, MultiByteToWideChar, WideCharToMultiByte, LCMapStringW, FindClose, FindFirstFileExA, FindNextFileA, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetStdHandle, GetFileType, GetStringTypeW, CreateFileW, HeapSize, HeapReAlloc, SetStdHandle, FlushFileBuffers, WriteFile, GetConsoleCP, GetConsoleMode, ReadConsoleW, SetFilePointerEx, WriteConsoleW, RaiseException

Exports

Name	Ordinal	Address
DllRegisterServer	1	0x180002380
ItsnPq5v	2	0x180002390
QlqYo259k	3	0x180017c20
XeFnYZ409	4	0x1800175e0

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.48.8.8.864906532039645 11/24/22-05:22:35.810533	UDP	2039645	ET TROJAN Observed DNS Query to Ursnif Domain (gigimas .xyz)	64906	53	192.168.2.4	8.8.8.8
192.168.2.48.8.8.861007532039645 11/24/22-05:20:02.978332	UDP	2039645	ET TROJAN Observed DNS Query to Ursnif Domain (gigimas .xyz)	61007	53	192.168.2.4	8.8.8.8
192.168.2.48.8.8.861124532039645 11/24/22-05:21:04.451832	UDP	2039645	ET TROJAN Observed DNS Query to Ursnif Domain (gigimas .xyz)	61124	53	192.168.2.4	8.8.8.8
192.168.2.48.8.8.859444532039645 11/24/22-05:21:34.871041	UDP	2039645	ET TROJAN Observed DNS Query to Ursnif Domain (gigimas .xyz)	59444	53	192.168.2.4	8.8.8.8
192.168.2.48.8.8.855570532039645 11/24/22-05:22:05.359167	UDP	2039645	ET TROJAN Observed DNS Query to Ursnif Domain (gigimas .xyz)	55570	53	192.168.2.4	8.8.8.8
192.168.2.48.8.8.860686532039645 11/24/22-05:20:33.386749	UDP	2039645	ET TROJAN Observed DNS Query to Ursnif Domain (gigimas .xyz)	60686	53	192.168.2.4	8.8.8.8
192.168.2.48.8.8.859446532039645 11/24/22-05:23:06.390786	UDP	2039645	ET TROJAN Observed DNS Query to Ursnif Domain (gigimas .xyz)	59446	53	192.168.2.4	8.8.8.8

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 24, 2022 05:20:03.012599945 CET	49706	443	192.168.2.4	185.250.148.35
Nov 24, 2022 05:20:03.012650967 CET	443	49706	185.250.148.35	192.168.2.4
Nov 24, 2022 05:20:03.012737036 CET	49706	443	192.168.2.4	185.250.148.35
Nov 24, 2022 05:20:03.016460896 CET	49706	443	192.168.2.4	185.250.148.35
Nov 24, 2022 05:20:03.016508102 CET	443	49706	185.250.148.35	192.168.2.4
Nov 24, 2022 05:20:03.072525024 CET	443	49706	185.250.148.35	192.168.2.4
Nov 24, 2022 05:20:03.074080944 CET	49707	443	192.168.2.4	185.250.148.35
Nov 24, 2022 05:20:03.074155092 CET	443	49707	185.250.148.35	192.168.2.4
Nov 24, 2022 05:20:03.074337959 CET	49707	443	192.168.2.4	185.250.148.35
Nov 24, 2022 05:20:03.075628996 CET	49707	443	192.168.2.4	185.250.148.35
Nov 24, 2022 05:20:03.075655937 CET	443	49707	185.250.148.35	192.168.2.4
Nov 24, 2022 05:20:03.131845951 CET	443	49707	185.250.148.35	192.168.2.4
Nov 24, 2022 05:20:03.133225918 CET	49708	443	192.168.2.4	185.250.148.35
Nov 24, 2022 05:20:03.133289099 CET	443	49708	185.250.148.35	192.168.2.4
Nov 24, 2022 05:20:03.133398056 CET	49708	443	192.168.2.4	185.250.148.35
Nov 24, 2022 05:20:03.134278059 CET	49708	443	192.168.2.4	185.250.148.35
Nov 24, 2022 05:20:03.134324074 CET	443	49708	185.250.148.35	192.168.2.4
Nov 24, 2022 05:20:03.191957951 CET	443	49708	185.250.148.35	192.168.2.4
Nov 24, 2022 05:20:03.193757057 CET	49709	443	192.168.2.4	185.250.148.35
Nov 24, 2022 05:20:03.193816900 CET	443	49709	185.250.148.35	192.168.2.4
Nov 24, 2022 05:20:03.193898916 CET	49709	443	192.168.2.4	185.250.148.35
Nov 24, 2022 05:20:03.194484949 CET	49709	443	192.168.2.4	185.250.148.35
Nov 24, 2022 05:20:03.194506884 CET	443	49709	185.250.148.35	192.168.2.4
Nov 24, 2022 05:20:03.250332117 CET	443	49709	185.250.148.35	192.168.2.4
Nov 24, 2022 05:20:33.407180071 CET	49710	443	192.168.2.4	185.250.148.35
Nov 24, 2022 05:20:33.407258034 CET	443	49710	185.250.148.35	192.168.2.4
Nov 24, 2022 05:20:33.407423019 CET	49710	443	192.168.2.4	185.250.148.35
Nov 24, 2022 05:20:33.408660889 CET	49710	443	192.168.2.4	185.250.148.35
Nov 24, 2022 05:20:33.408710957 CET	443	49710	185.250.148.35	192.168.2.4
Nov 24, 2022 05:20:33.463525057 CET	443	49710	185.250.148.35	192.168.2.4
Nov 24, 2022 05:20:33.465197086 CET	49711	443	192.168.2.4	185.250.148.35
Nov 24, 2022 05:20:33.465265036 CET	443	49711	185.250.148.35	192.168.2.4
Nov 24, 2022 05:20:33.465380907 CET	49711	443	192.168.2.4	185.250.148.35
Nov 24, 2022 05:20:33.466645002 CET	49711	443	192.168.2.4	185.250.148.35
Nov 24, 2022 05:20:33.466680050 CET	443	49711	185.250.148.35	192.168.2.4
Nov 24, 2022 05:20:33.522078991 CET	443	49711	185.250.148.35	192.168.2.4
Nov 24, 2022 05:20:33.525345087 CET	49712	443	192.168.2.4	185.250.148.35
Nov 24, 2022 05:20:33.525413036 CET	443	49712	185.250.148.35	192.168.2.4
Nov 24, 2022 05:20:33.525672913 CET	49712	443	192.168.2.4	185.250.148.35
Nov 24, 2022 05:20:33.526755095 CET	49712	443	192.168.2.4	185.250.148.35
Nov 24, 2022 05:20:33.526801109 CET	443	49712	185.250.148.35	192.168.2.4
Nov 24, 2022 05:20:33.582118988 CET	443	49712	185.250.148.35	192.168.2.4
Nov 24, 2022 05:20:33.585807085 CET	49713	443	192.168.2.4	185.250.148.35
Nov 24, 2022 05:20:33.585897923 CET	443	49713	185.250.148.35	192.168.2.4
Nov 24, 2022 05:20:33.586055040 CET	49713	443	192.168.2.4	185.250.148.35
Nov 24, 2022 05:20:33.586787939 CET	49713	443	192.168.2.4	185.250.148.35
Nov 24, 2022 05:20:33.586810112 CET	443	49713	185.250.148.35	192.168.2.4
Nov 24, 2022 05:20:33.641958952 CET	443	49713	185.250.148.35	192.168.2.4
Nov 24, 2022 05:21:04.485233068 CET	49714	443	192.168.2.4	185.250.148.35
Nov 24, 2022 05:21:04.485310078 CET	443	49714	185.250.148.35	192.168.2.4
Nov 24, 2022 05:21:04.485480070 CET	49714	443	192.168.2.4	185.250.148.35
Nov 24, 2022 05:21:04.486561060 CET	49714	443	192.168.2.4	185.250.148.35
Nov 24, 2022 05:21:04.486601114 CET	443	49714	185.250.148.35	192.168.2.4
Nov 24, 2022 05:21:04.541218996 CET	443	49714	185.250.148.35	192.168.2.4
Nov 24, 2022 05:21:04.542530060 CET	49715	443	192.168.2.4	185.250.148.35
Nov 24, 2022 05:21:04.542584896 CET	443	49715	185.250.148.35	192.168.2.4
Nov 24, 2022 05:21:04.542787075 CET	49715	443	192.168.2.4	185.250.148.35
Nov 24, 2022 05:21:04.543291092 CET	49715	443	192.168.2.4	185.250.148.35
Nov 24, 2022 05:21:04.543320894 CET	443	49715	185.250.148.35	192.168.2.4
Nov 24, 2022 05:21:04.598916054 CET	443	49715	185.250.148.35	192.168.2.4
Nov 24, 2022 05:21:04.600245953 CET	49716	443	192.168.2.4	185.250.148.35
Nov 24, 2022 05:21:04.600316048 CET	443	49716	185.250.148.35	192.168.2.4
Nov 24, 2022 05:21:04.600423098 CET	49716	443	192.168.2.4	185.250.148.35
Nov 24, 2022 05:21:04.600950003 CET	49716	443	192.168.2.4	185.250.148.35
Nov 24, 2022 05:21:04.600979090 CET	443	49716	185.250.148.35	192.168.2.4
Nov 24, 2022 05:21:04.668997049 CET	443	49716	185.250.148.35	192.168.2.4
Nov 24, 2022 05:21:04.685195923 CET	49717	443	192.168.2.4	185.250.148.35
Nov 24, 2022 05:21:04.685261965 CET	443	49717	185.250.148.35	192.168.2.4
Nov 24, 2022 05:21:04.685632944 CET	49717	443	192.168.2.4	185.250.148.35
Nov 24, 2022 05:21:04.686243057 CET	49717	443	192.168.2.4	185.250.148.35
Nov 24, 2022 05:21:04.686269045 CET	443	49717	185.250.148.35	192.168.2.4
Nov 24, 2022 05:21:04.742952108 CET	443	49717	185.250.148.35	192.168.2.4
Nov 24, 2022 05:21:34.890145063 CET	49718	443	192.168.2.4	185.250.148.35
Nov 24, 2022 05:21:34.890221119 CET	443	49718	185.250.148.35	192.168.2.4
Nov 24, 2022 05:21:34.890311956 CET	49718	443	192.168.2.4	185.250.148.35
Nov 24, 2022 05:21:34.891124010 CET	49718	443	192.168.2.4	185.250.148.35
Nov 24, 2022 05:21:34.891169071 CET	443	49718	185.250.148.35	192.168.2.4
Nov 24, 2022 05:21:34.949980021 CET	443	49718	185.250.148.35	192.168.2.4
Nov 24, 2022 05:21:34.951565027 CET	49719	443	192.168.2.4	185.250.148.35
Nov 24, 2022 05:21:34.951642990 CET	443	49719	185.250.148.35	192.168.2.4
Nov 24, 2022 05:21:34.951733112 CET	49719	443	192.168.2.4	185.250.148.35
Nov 24, 2022 05:21:34.952301979 CET	49719	443	192.168.2.4	185.250.148.35
Nov 24, 2022 05:21:34.952337027 CET	443	49719	185.250.148.35	192.168.2.4
Nov 24, 2022 05:21:35.007440090 CET	443	49719	185.250.148.35	192.168.2.4
Nov 24, 2022 05:21:35.008912086 CET	49720	443	192.168.2.4	185.250.148.35
Nov 24, 2022 05:21:35.008971930 CET	443	49720	185.250.148.35	192.168.2.4
Nov 24, 2022 05:21:35.009077072 CET	49720	443	192.168.2.4	185.250.148.35
Nov 24, 2022 05:21:35.009592056 CET	49720	443	192.168.2.4	185.250.148.35
Nov 24, 2022 05:21:35.009608984 CET	443	49720	185.250.148.35	192.168.2.4
Nov 24, 2022 05:21:35.066533089 CET	443	49720	185.250.148.35	192.168.2.4
Nov 24, 2022 05:21:35.083612919 CET	49721	443	192.168.2.4	185.250.148.35
Nov 24, 2022 05:21:35.083692074 CET	443	49721	185.250.148.35	192.168.2.4
Nov 24, 2022 05:21:35.083832026 CET	49721	443	192.168.2.4	185.250.148.35
Nov 24, 2022 05:21:35.084454060 CET	49721	443	192.168.2.4	185.250.148.35
Nov 24, 2022 05:21:35.084505081 CET	443	49721	185.250.148.35	192.168.2.4
Nov 24, 2022 05:21:35.141772032 CET	443	49721	185.250.148.35	192.168.2.4
Nov 24, 2022 05:22:05.380898952 CET	49722	443	192.168.2.4	185.250.148.35
Nov 24, 2022 05:22:05.380964041 CET	443	49722	185.250.148.35	192.168.2.4
Nov 24, 2022 05:22:05.381064892 CET	49722	443	192.168.2.4	185.250.148.35
Nov 24, 2022 05:22:05.382277966 CET	49722	443	192.168.2.4	185.250.148.35

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 24, 2022 05:20:02.978332043 CET	61007	53	192.168.2.4	8.8.8.8
Nov 24, 2022 05:20:02.997380018 CET	53	61007	8.8.8.8	192.168.2.4
Nov 24, 2022 05:20:33.386749029 CET	60686	53	192.168.2.4	8.8.8.8
Nov 24, 2022 05:20:33.404028893 CET	53	60686	8.8.8.8	192.168.2.4
Nov 24, 2022 05:21:04.451832056 CET	61124	53	192.168.2.4	8.8.8.8
Nov 24, 2022 05:21:04.469230890 CET	53	61124	8.8.8.8	192.168.2.4
Nov 24, 2022 05:21:34.871041059 CET	59444	53	192.168.2.4	8.8.8.8
Nov 24, 2022 05:21:34.888430119 CET	53	59444	8.8.8.8	192.168.2.4
Nov 24, 2022 05:22:05.359167099 CET	55570	53	192.168.2.4	8.8.8.8
Nov 24, 2022 05:22:05.377713919 CET	53	55570	8.8.8.8	192.168.2.4
Nov 24, 2022 05:22:35.810533047 CET	64906	53	192.168.2.4	8.8.8.8
Nov 24, 2022 05:22:35.829649925 CET	53	64906	8.8.8.8	192.168.2.4
Nov 24, 2022 05:23:06.390785933 CET	59446	53	192.168.2.4	8.8.8.8
Nov 24, 2022 05:23:06.408032894 CET	53	59446	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 24, 2022 05:20:02.978332043 CET	192.168.2.4	8.8.8.8	0x362c	Standard query (0)	gigimas.xyz	A (IP address)	IN (0x0001)	false
Nov 24, 2022 05:20:33.386749029 CET	192.168.2.4	8.8.8.8	0x306e	Standard query (0)	gigimas.xyz	A (IP address)	IN (0x0001)	false
Nov 24, 2022 05:21:04.451832056 CET	192.168.2.4	8.8.8.8	0xfd4e	Standard query (0)	gigimas.xyz	A (IP address)	IN (0x0001)	false
Nov 24, 2022 05:21:34.871041059 CET	192.168.2.4	8.8.8.8	0xbb49	Standard query (0)	gigimas.xyz	A (IP address)	IN (0x0001)	false
Nov 24, 2022 05:22:05.359167099 CET	192.168.2.4	8.8.8.8	0xe9a0	Standard query (0)	gigimas.xyz	A (IP address)	IN (0x0001)	false
Nov 24, 2022 05:22:35.810533047 CET	192.168.2.4	8.8.8.8	0x374b	Standard query (0)	gigimas.xyz	A (IP address)	IN (0x0001)	false
Nov 24, 2022 05:23:06.390785933 CET	192.168.2.4	8.8.8.8	0x8724	Standard query (0)	gigimas.xyz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 24, 2022 05:20:02.997380018 CET	8.8.8.8	192.168.2.4	0x362c	No error (0)	gigimas.xyz	185.250.148.35	A (IP address)	IN (0x0001)	false
Nov 24, 2022 05:20:33.404028893 CET	8.8.8.8	192.168.2.4	0x306e	No error (0)	gigimas.xyz	185.250.148.35	A (IP address)	IN (0x0001)	false
Nov 24, 2022 05:21:04.469230890 CET	8.8.8.8	192.168.2.4	0xfd4e	No error (0)	gigimas.xyz	185.250.148.35	A (IP address)	IN (0x0001)	false
Nov 24, 2022 05:21:34.888430119 CET	8.8.8.8	192.168.2.4	0xbb49	No error (0)	gigimas.xyz	185.250.148.35	A (IP address)	IN (0x0001)	false
Nov 24, 2022 05:22:05.377713919 CET	8.8.8.8	192.168.2.4	0xe9a0	No error (0)	gigimas.xyz	185.250.148.35	A (IP address)	IN (0x0001)	false
Nov 24, 2022 05:22:35.829649925 CET	8.8.8.8	192.168.2.4	0x374b	No error (0)	gigimas.xyz	185.250.148.35	A (IP address)	IN (0x0001)	false
Nov 24, 2022 05:23:06.408032894 CET	8.8.8.8	192.168.2.4	0x8724	No error (0)	gigimas.xyz	185.250.148.35	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	05:19:01
Start date:	24/11/2022
Path:	C:\Windows\System32\loaddll64.exe
Wow64 process (32bit):	false
Commandline:	loaddll64.exe "C:\Users\user\Desktop\pzG0rkIchr.dll"
Imagebase:	0x7ff72b830000
File size:	139776 bytes
MD5 hash:	C676FC0263EDD17D4CE7D644B8F3FCD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: conhost.exePID: 5284, Parent PID: 492

General

Target ID:	1
Start time:	05:19:02
Start date:	24/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: cmd.exePID: 5156, Parent PID: 492

General

Target ID:	2
Start time:	05:19:02
Start date:	24/11/2022
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\pzG0rkIchr.dll",#1
Imagebase:	0x7ff632260000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: regsvr32.exePID: 5172, Parent PID: 492

General

Target ID:	3
Start time:	05:19:02
Start date:	24/11/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	regsvr32.exe /s C:\Users\user\Desktop\pzG0rkIchr.dll
Imagebase:	0x7ff762150000
File size:	24064 bytes
MD5 hash:	D78B75FC68247E8A63ACBA846182740E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: rundll32.exePID: 1228, Parent PID: 5156

General

Target ID:	4
Start time:	05:19:02
Start date:	24/11/2022
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\pzG0rkIchr.dll",#1
Imagebase:	0x7ff736ed0000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: rundll32.exePID: 400, Parent PID: 492

General

Target ID:	5
Start time:	05:19:02
Start date:	24/11/2022
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\pzG0rkIchr.dll,DllRegisterServer
Imagebase:	0x7ff736ed0000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: rundll32.exePID: 2100, Parent PID: 492

General

Target ID:	6
Start time:	05:19:07
Start date:	24/11/2022
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\pzG0rkIchr.dll,ItsnPq5v
Imagebase:	0x7ff736ed0000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: rundll32.exePID: 1308, Parent PID: 492

General

Target ID:	9
Start time:	05:19:12
Start date:	24/11/2022
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\pzG0rkIchr.dll,QlqYo259k
Imagebase:	0x7ff736ed0000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: WerFault.exePID: 5904, Parent PID: 2100

General

Target ID:	11
Start time:	05:19:18
Start date:	24/11/2022
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 2100 -s 304
Imagebase:	0x7ff69db50000
File size:	494488 bytes
MD5 hash:	2AFFE478D86272288BBEF5A00BBEF6A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: WerFault.exePID: 5188, Parent PID: 1308

General

Target ID:	12
Start time:	05:19:23
Start date:	24/11/2022
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 1308 -s 304
Imagebase:	0x7ff69db50000
File size:	494488 bytes
MD5 hash:	2AFFE478D86272288BBEF5A00BBEF6A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: WerFault.exePID: 5968, Parent PID: 2100

General

Target ID:	13
Start time:	05:19:27
Start date:	24/11/2022
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 2100 -s 304
Imagebase:	0x7ff69db50000
File size:	494488 bytes
MD5 hash:	2AFFE478D86272288BBEF5A00BBEF6A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: WerFault.exePID: 3260, Parent PID: 1308

General

Target ID:	14
Start time:	05:19:42
Start date:	24/11/2022
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 1308 -s 304
Imagebase:	0x7ff69db50000
File size:	494488 bytes
MD5 hash:	2AFFE478D86272288BBEF5A00BBEF6A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Disassembly

⊘No disassembly

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. Regsvr32.exe is also a Microsoft signed binary.
Tactics:	Defense Evasion
Data Sources:	Loaded DLLs, Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report pzG0rkIchr.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Ursnif

Yara Signatures

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_pzG_5df03237c245e7792ae728ba7af47d1bed8c47f7_4f0e5919_16399239\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_pzG_f6b0ff3966a3d6c74191edf638977ebb42334d7_4f0e5919_156d919c\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8047.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER80D3.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER848E.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8588.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8589.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8683.tmp.xml

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Rich Headers

Data Directories

Sections

Windows Analysis Report
pzG0rkIchr.exe