detect Ursnif(a.k.a. Dreambot, Gozi, ISFB) in memory

Hunt Hypothesis

This hunt hypothesis posits that adversaries are deploying Ursnif banking trojans to establish persistent memory-based footholds within user endpoints for credential harvesting and man-in-the-browser attacks. Proactively hunting for these specific in-memory artifacts in Azure Sentinel is critical because their low-severity baseline often masks early-stage infections, allowing the SOC team to identify and remediate compromised assets before lateral movement or data exfiltration occurs.

YARA Rule

rule Ursnif {
          meta:
            description = "detect Ursnif(a.k.a. Dreambot, Gozi, ISFB) in memory"
            author = "JPCERT/CC Incident Response Group"
            rule_usage = "memory scan"
            reference = "internal research"
            hash1 = "0207c06879fb4a2ddaffecc3a6713f2605cbdd90fc238da9845e88ff6aef3f85"
            hash2 = "ff2aa9bd3b9b3525bae0832d1e2b7c6dfb988dc7add310088609872ad9a7e714"
            hash3 = "1eca399763808be89d2e58e1b5e242324d60e16c0f3b5012b0070499ab482510"

          strings:
            $a1 = "soft=%u&version=%u&user=%08x%08x%08x%08x&server=%u&id=%u&crc=%x"
            $b1 = "client.dll" fullword
            $c1 = "version=%u"
            $c2 = "user=%08x%08x%08x%08x"
            $c3 = "server=%u"
            $c4 = "id=%u"
            $c5 = "crc=%u"
            $c6 = "guid=%08x%08x%08x%08x"
            $c7 = "name=%s"
            $c8 = "soft=%u"
            $d1 = "%s://%s%s"
            $d2 = "PRI \x2A HTTP/2.0"
            $e1 = { A1 ?? ?? ?? 00 35 E7 F7 8A 40 50 }
            $e2 = { 56 56 56 6A 06 5? FF ?? ?? ?? ?? 00 }
            $f1 = { 56 57 BE ?? ?? ?? ?? 8D ?? ?? A5 A5 A5 }
            $f2 = { 35 8F E3 B7 3F }
            $f3 = { 35 0A 60 2E 51 }

         condition: $a1 or ($b1 and 3 of ($c*)) or (5 of ($c*)) or ($b1 and all of ($d*)) or all of ($e*) or all of ($f*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 17 string patterns in its detection logic.

References

• internal research
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Ursnif (Dreambot/Gozi) detection rule, including suggested filters and exclusions:

• Antivirus Real-Time Scanning of Legacy Applications

  • Scenario: Enterprise Endpoint Detection and Response (EDR) agents like CrowdStrike Falcon or Microsoft Defender for Endpoint frequently scan legacy banking software or older Java-based internal tools. During these scans, the EDR process injects memory modules that mimic Ursnif’s behavior of loading unsigned DLLs into a browser host process (iexplore.exe or chrome.exe) to inspect network traffic, triggering the “in memory” signature.
  • Filter/Exclusion: Exclude processes where the parent process is the known EDR service (e.g., C:\Program Files\CrowdStrike\fsa.exe or MsMpEng.exe) and the loaded module path contains the vendor’s installation directory (e.g., *CrowdStrike*\* or *Microsoft Defender Antivirus*\*).

• Scheduled Group Policy Updates via RSOP

  • Scenario: During scheduled maintenance windows, Group Policy Management Console (GPMC) pushes updates that trigger the gpupdate.exe process. This often results in temporary memory allocations within user sessions where standard Windows system files are re-evaluated. If a specific policy involves browser security configurations, it may load scripts into the browser’s address space that share byte-pattern similarities with Ursnif’s initial infection vector (specifically the creation of C:\Windows\System32\wbem related memory structures).
  • Filter/Exclusion: Create an exclusion for events occurring between 01:00 and 05:00 UTC on weekdays where the initiating process is gpupdate.exe or svchost.exe (specifically the gpsvc group