Edit tour

Windows Analysis Report
SecuriteInfo.com.Application.Generic.3623086.1464.24272.dll

Overview

General Information

Sample name:	SecuriteInfo.com.Application.Generic.3623086.1464.24272.dll (renamed file extension from exe to dll)
Original sample name:	SecuriteInfo.com.Application.Generic.3623086.1464.24272.exe
Analysis ID:	1417538
MD5:	72bca96a3c16575f9c41c971f290ef9d
SHA1:	ec2a063a295a44b559753048b69b13f6f29581be
SHA256:	0ba766c92ee65ba37d996bd0b1aaf5bbf9bdef6efe2473997972642d206c877f
Tags:	exe
Infos:

Detection

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Found direct / indirect Syscall (likely to bypass EDR)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Creates a process in suspended mode (likely to inject code)

Entry point lies outside standard sections

May sleep (evasive loops) to hinder dynamic analysis

PE file contains more sections than normal

PE file contains sections with non-standard names

Program does not show much activity (idle)

Sample execution stops while process was sleeping (likely an evasion)

Tries to load missing DLLs

Classification

Process Tree

System is w10x64

loaddll64.exe (PID: 7452 cmdline: loaddll64.exe "C:\Users\user\Desktop\SecuriteInfo.com.Application.Generic.3623086.1464.24272.dll" MD5: 763455F9DCB24DFEECC2B9D9F8D46D52)

conhost.exe (PID: 7468 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7532 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Application.Generic.3623086.1464.24272.dll",#1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

rundll32.exe (PID: 7548 cmdline: rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Application.Generic.3623086.1464.24272.dll",#1 MD5: EF3179D498793BF4234F708D3BE28633)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Application.Generic.3623086.1464.24272.dll	ReversingLabs: Detection: 44%
Source: SecuriteInfo.com.Application.Generic.3623086.1464.24272.dll	Virustotal: Detection: 47%			Perma Link

Machine Learning detection for sample

Source: SecuriteInfo.com.Application.Generic.3623086.1464.24272.dll

Joe Sandbox ML: detected

Source: loaddll64.exe, 00000000.00000003.1347113703.000001C440D90000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_cbea1377-9

Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb! source: loaddll64.exe, 00000000.00000002.3788577625.00007FFBA9B09000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.3788526443.00007FFBA9B09000.00000040.00000001.01000000.00000003.sdmp
Source:	Binary string: ".pdb*.$ source: SecuriteInfo.com.Application.Generic.3623086.1464.24272.dll
Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb source: loaddll64.exe, 00000000.00000002.3788577625.00007FFBA9B09000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.3788526443.00007FFBA9B09000.00000040.00000001.01000000.00000003.sdmp

Source: rundll32.exe, 00000004.00000002.3788253297.00007FFBA9464000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://fontello.com
Source: loaddll64.exe, 00000000.00000002.3788294623.00007FFBA9464000.00000004.00000001.01000000.00000003.sdmp, loaddll64.exe, 00000000.00000003.1347874541.000001C442900000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1348219113.000001B6B6570000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.3788253297.00007FFBA9464000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://fontello.comCopyright
Source: loaddll64.exe, 00000000.00000002.3788294623.00007FFBA9464000.00000004.00000001.01000000.00000003.sdmp, loaddll64.exe, 00000000.00000003.1347874541.000001C442900000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1348219113.000001B6B6570000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.3788253297.00007FFBA9464000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://scripts.sil.org/OFLhttp://scripts.sil.org/OFLInterExtraLightOpen
Source: loaddll64.exe, 00000000.00000002.3788294623.00007FFBA9464000.00000004.00000001.01000000.00000003.sdmp, loaddll64.exe, 00000000.00000003.1347874541.000001C442900000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1348219113.000001B6B6570000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.3788253297.00007FFBA9464000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://scripts.sil.org/OFLhttp://scripts.sil.org/OFLInterLightOpen
Source: loaddll64.exe, 00000000.00000002.3788294623.00007FFBA9464000.00000004.00000001.01000000.00000003.sdmp, loaddll64.exe, 00000000.00000003.1347874541.000001C442900000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1348219113.000001B6B6570000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.3788253297.00007FFBA9464000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://scripts.sil.org/OFLhttp://scripts.sil.org/OFLInterMediumOpen
Source: loaddll64.exe, 00000000.00000002.3788294623.00007FFBA9464000.00000004.00000001.01000000.00000003.sdmp, loaddll64.exe, 00000000.00000003.1347874541.000001C442900000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1348219113.000001B6B6570000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.3788253297.00007FFBA9464000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://scripts.sil.org/OFLhttp://scripts.sil.org/OFLInterSemiBoldOpen
Source: loaddll64.exe, 00000000.00000002.3788294623.00007FFBA9464000.00000004.00000001.01000000.00000003.sdmp, loaddll64.exe, 00000000.00000003.1347874541.000001C442900000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1348219113.000001B6B6570000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.3788253297.00007FFBA9464000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://scripts.sil.org/OFLhttp://scripts.sil.org/OFLInterThinOpen
Source: rundll32.exe, 00000004.00000002.3788253297.00007FFBA9464000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://scripts.sil.org/OFLhttp://scripts.sil.org/OFLOpen
Source: loaddll64.exe, 00000000.00000003.1347113703.000001C440D90000.00000004.00001000.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000002.3788249388.00007FFBA93E4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.3788213687.00007FFBA93E4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000003.1347485334.000001B6B6570000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://Mozilla/5.0Failed
Source: rundll32.exe, 00000004.00000003.1347485334.000001B6B6570000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.github.com/repos/Prax-Client/Releases/releases/latest
Source: loaddll64.exe, 00000000.00000003.1347113703.000001C440D90000.00000004.00001000.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000002.3788249388.00007FFBA93E4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.3788213687.00007FFBA93E4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000003.1347485334.000001B6B6570000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.playhive.com/v0/game/all/
Source: loaddll64.exe, 00000000.00000003.1347113703.000001C440D90000.00000004.00001000.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000002.3788249388.00007FFBA93E4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.3788213687.00007FFBA93E4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000003.1347485334.000001B6B6570000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.playhive.com/v0/game/all/GetHiveStats:
Source: rundll32.exe, 00000004.00000003.1347485334.000001B6B6570000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/attachments/1157861980611297410/1163279643168747570/F6_T6MXXoAAH6os.jpg?e
Source: rundll32.exe, 00000004.00000003.1347485334.000001B6B6570000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: loaddll64.exe, 00000000.00000003.1347113703.000001C440D90000.00000004.00001000.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000002.3788249388.00007FFBA93E4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.3788213687.00007FFBA93E4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000003.1347485334.000001B6B6570000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: loaddll64.exe, 00000000.00000003.1347113703.000001C440D90000.00000004.00001000.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000002.3788249388.00007FFBA93E4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.3788213687.00007FFBA93E4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000003.1347485334.000001B6B6570000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: loaddll64.exe, 00000000.00000002.3788294623.00007FFBA9464000.00000004.00000001.01000000.00000003.sdmp, loaddll64.exe, 00000000.00000003.1347874541.000001C442900000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1348219113.000001B6B6570000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.3788253297.00007FFBA9464000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://github.com/JetBrains/JetBrainsMono)JetBrains
Source: loaddll64.exe, 00000000.00000003.1347113703.000001C440D90000.00000004.00001000.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000002.3788249388.00007FFBA93E4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.3788213687.00007FFBA93E4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000003.1347485334.000001B6B6570000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Prax-Client/Releases/raw/main/banner
Source: loaddll64.exe, 00000000.00000003.1347113703.000001C440D90000.00000004.00001000.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000002.3788249388.00007FFBA93E4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.3788213687.00007FFBA93E4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000003.1347485334.000001B6B6570000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Prax-Client/Releases/raw/main/bannerstart_screenhud_screentextures/ui/titletextur
Source: rundll32.exe, 00000004.00000003.1347485334.000001B6B6570000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Prax-Client/Releases/raw/main/fardreverb.wav
Source: loaddll64.exe, 00000000.00000003.1347113703.000001C440D90000.00000004.00001000.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000002.3788249388.00007FFBA93E4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.3788213687.00007FFBA93E4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000003.1347485334.000001B6B6570000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Prax-Client/Releases/raw/main/killsound.wav
Source: loaddll64.exe, 00000000.00000003.1347113703.000001C440D90000.00000004.00001000.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000002.3788249388.00007FFBA93E4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.3788213687.00007FFBA93E4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000003.1347485334.000001B6B6570000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Prax-Client/Releases/raw/main/killsound.wavCreated
Source: rundll32.exe, 00000004.00000002.3788253297.00007FFBA9464000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://github.com/rsms/inter)Inter
Source: loaddll64.exe, 00000000.00000002.3788294623.00007FFBA9464000.00000004.00000001.01000000.00000003.sdmp, loaddll64.exe, 00000000.00000003.1347874541.000001C442900000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1348219113.000001B6B6570000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.3788253297.00007FFBA9464000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://github.com/rsms/inter)InterBold3.019;RSMS;Inter-BoldInter
Source: loaddll64.exe, 00000000.00000002.3788294623.00007FFBA9464000.00000004.00000001.01000000.00000003.sdmp, loaddll64.exe, 00000000.00000003.1347874541.000001C442900000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1348219113.000001B6B6570000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.3788253297.00007FFBA9464000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://github.com/rsms/inter)InterRegular3.019;RSMS;Inter-RegularInter
Source: loaddll64.exe, 00000000.00000003.1347113703.000001C440D90000.00000004.00001000.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000002.3788249388.00007FFBA93E4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.3788213687.00007FFBA93E4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000003.1347485334.000001B6B6570000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://peoplehub-public.xboxlive.com/people/gt(
Source: loaddll64.exe, 00000000.00000003.1347113703.000001C440D90000.00000004.00001000.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000002.3788249388.00007FFBA93E4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.3788213687.00007FFBA93E4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000003.1347485334.000001B6B6570000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://peoplehub-public.xboxlive.com/people/gt(Rtn:
Source: rundll32.exe, 00000004.00000002.3788253297.00007FFBA9464000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://rsms.me/This
Source: loaddll64.exe, 00000000.00000002.3788294623.00007FFBA9464000.00000004.00000001.01000000.00000003.sdmp, loaddll64.exe, 00000000.00000003.1347874541.000001C442900000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1348219113.000001B6B6570000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.3788253297.00007FFBA9464000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://scripts.sil.org/OFLhttps://scripts.sil.org/OFL
Source: loaddll64.exe, 00000000.00000002.3788294623.00007FFBA9464000.00000004.00000001.01000000.00000003.sdmp, loaddll64.exe, 00000000.00000003.1347874541.000001C442900000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1348219113.000001B6B6570000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.3788253297.00007FFBA9464000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.jetbrains.comhttps://www.jetbrains.comThis
Source: loaddll64.exe, 00000000.00000003.1347113703.000001C440D90000.00000004.00001000.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000002.3788249388.00007FFBA93E4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.3788213687.00007FFBA93E4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000003.1347485334.000001B6B6570000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://yiffing.zone/sounds/click.wav
Source: loaddll64.exe, 00000000.00000003.1347113703.000001C440D90000.00000004.00001000.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000002.3788249388.00007FFBA93E4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.3788213687.00007FFBA93E4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000003.1347485334.000001B6B6570000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://yiffing.zone/sounds/click.wavhttps://yiffing.zone/sounds/notify_off.wavhttps://yiffing.zone/
Source: loaddll64.exe, 00000000.00000003.1347113703.000001C440D90000.00000004.00001000.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000002.3788249388.00007FFBA93E4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.3788213687.00007FFBA93E4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000003.1347485334.000001B6B6570000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://yiffing.zone/sounds/notify_off.wav
Source: loaddll64.exe, 00000000.00000003.1347113703.000001C440D90000.00000004.00001000.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000002.3788249388.00007FFBA93E4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.3788213687.00007FFBA93E4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000003.1347485334.000001B6B6570000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://yiffing.zone/sounds/notify_on.wav

System Summary

PE file contains section with special chars

Source: SecuriteInfo.com.Application.Generic.3623086.1464.24272.dll	Static PE information: section name:
Source: SecuriteInfo.com.Application.Generic.3623086.1464.24272.dll	Static PE information: section name:
Source: SecuriteInfo.com.Application.Generic.3623086.1464.24272.dll	Static PE information: section name:
Source: SecuriteInfo.com.Application.Generic.3623086.1464.24272.dll	Static PE information: section name:
Source: SecuriteInfo.com.Application.Generic.3623086.1464.24272.dll	Static PE information: section name:
Source: SecuriteInfo.com.Application.Generic.3623086.1464.24272.dll	Static PE information: section name:
Source: SecuriteInfo.com.Application.Generic.3623086.1464.24272.dll	Static PE information: section name:

Source: SecuriteInfo.com.Application.Generic.3623086.1464.24272.dll

Static PE information: Number of sections : 13 > 10

Source: C:\Windows\System32\loaddll64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: d3dcompiler_47.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: xaudio2_9.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: avrt.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: audioses.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior

Source: SecuriteInfo.com.Application.Generic.3623086.1464.24272.dll	Static PE information: Section: ZLIB complexity 0.9958128511235955
Source: SecuriteInfo.com.Application.Generic.3623086.1464.24272.dll	Static PE information: Section: .reloc ZLIB complexity 1.5625

Source: classification engine

Classification label: mal80.evad.winDLL@6/0@0/0

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7468:120:WilError_03

Source: C:\Windows\System32\loaddll64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Application.Generic.3623086.1464.24272.dll",#1

Source: SecuriteInfo.com.Application.Generic.3623086.1464.24272.dll	ReversingLabs: Detection: 44%
Source: SecuriteInfo.com.Application.Generic.3623086.1464.24272.dll	Virustotal: Detection: 47%

Source: unknown	Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\SecuriteInfo.com.Application.Generic.3623086.1464.24272.dll"
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Application.Generic.3623086.1464.24272.dll",#1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Application.Generic.3623086.1464.24272.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Application.Generic.3623086.1464.24272.dll",#1	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Application.Generic.3623086.1464.24272.dll",#1	Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\InprocServer32

Jump to behavior

Source: SecuriteInfo.com.Application.Generic.3623086.1464.24272.dll

Static PE information: Image base 0x180000000 > 0x60000000

Source: SecuriteInfo.com.Application.Generic.3623086.1464.24272.dll

Static file information: File size 6792208 > 1048576

Source: SecuriteInfo.com.Application.Generic.3623086.1464.24272.dll	Static PE information: Raw size of is bigger than: 0x100000 < 0x12d800
Source: SecuriteInfo.com.Application.Generic.3623086.1464.24272.dll	Static PE information: Raw size of is bigger than: 0x100000 < 0x1a0a00
Source: SecuriteInfo.com.Application.Generic.3623086.1464.24272.dll	Static PE information: Raw size of .boot is bigger than: 0x100000 < 0x362c00

Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb! source: loaddll64.exe, 00000000.00000002.3788577625.00007FFBA9B09000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.3788526443.00007FFBA9B09000.00000040.00000001.01000000.00000003.sdmp
Source:	Binary string: ".pdb*.$ source: SecuriteInfo.com.Application.Generic.3623086.1464.24272.dll
Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb source: loaddll64.exe, 00000000.00000002.3788577625.00007FFBA9B09000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.3788526443.00007FFBA9B09000.00000040.00000001.01000000.00000003.sdmp

Source: initial sample

Static PE information: section where entry point is pointing to: .boot

Source: SecuriteInfo.com.Application.Generic.3623086.1464.24272.dll	Static PE information: section name:
Source: SecuriteInfo.com.Application.Generic.3623086.1464.24272.dll	Static PE information: section name:
Source: SecuriteInfo.com.Application.Generic.3623086.1464.24272.dll	Static PE information: section name:
Source: SecuriteInfo.com.Application.Generic.3623086.1464.24272.dll	Static PE information: section name:
Source: SecuriteInfo.com.Application.Generic.3623086.1464.24272.dll	Static PE information: section name:
Source: SecuriteInfo.com.Application.Generic.3623086.1464.24272.dll	Static PE information: section name:
Source: SecuriteInfo.com.Application.Generic.3623086.1464.24272.dll	Static PE information: section name:
Source: SecuriteInfo.com.Application.Generic.3623086.1464.24272.dll	Static PE information: section name: .themida
Source: SecuriteInfo.com.Application.Generic.3623086.1464.24272.dll	Static PE information: section name: .boot

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Windows\System32\loaddll64.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Windows\System32\loaddll64.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Windows\System32\loaddll64.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Source: C:\Windows\System32\rundll32.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Windows\System32\rundll32.exe TID: 7552

Thread sleep count: 40 > 30

Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: loaddll64.exe, 00000000.00000002.3787758103.000001C440BCD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Your client sucks, just get SigmaT\VBOX__JHh
Source: loaddll64.exe, 00000000.00000002.3787758103.000001C440C00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: rundll32.exe, 00000004.00000002.3787747090.000001B6B4963000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlloo

Source: C:\Windows\System32\loaddll64.exe

System information queried: ModuleInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Windows\System32\loaddll64.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread information set: HideFromDebugger			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Windows\System32\rundll32.exe	Open window title or class name: regmonclass
Source: C:\Windows\System32\rundll32.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Windows\System32\rundll32.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Windows\System32\rundll32.exe	Open window title or class name: procmon_window_class
Source: C:\Windows\System32\rundll32.exe	Open window title or class name: filemonclass
Source: C:\Windows\System32\rundll32.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Windows\System32\loaddll64.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Windows\System32\loaddll64.exe	NtSetInformationThread: Indirect: 0x7FFBA9D73DDD	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtQueryInformationProcess: Indirect: 0x7FFBA9D263AA	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtQueryInformationProcess: Indirect: 0x7FFBA9D13298	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtQuerySystemInformation: Indirect: 0x7FFBA9D0554A	Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Application.Generic.3623086.1464.24272.dll",#1

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	33 Virtualization/Sandbox Evasion	OS Credential Dumping	521 Security Software Discovery	Remote Services	1 Archive Collected Data	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Abuse Elevation Control Mechanism	1 Rundll32	LSASS Memory	33 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Software Packing	Security Account Manager	2 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Abuse Elevation Control Mechanism	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Application.Generic.3623086.1464.24272.dll	45%	ReversingLabs	Win64.Trojan.Acll
SecuriteInfo.com.Application.Generic.3623086.1464.24272.dll	48%	Virustotal		Browse
SecuriteInfo.com.Application.Generic.3623086.1464.24272.dll	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
https://curl.se/docs/http-cookies.html	0%	Avira URL Cloud	safe
https://www.jetbrains.comhttps://www.jetbrains.comThis	0%	Avira URL Cloud	safe
https://api.playhive.com/v0/game/all/GetHiveStats:	0%	Avira URL Cloud	safe
https://curl.se/docs/alt-svc.html	0%	Avira URL Cloud	safe
https://api.playhive.com/v0/game/all/	0%	Avira URL Cloud	safe
https://curl.se/docs/hsts.html	0%	Avira URL Cloud	safe
https://Mozilla/5.0Failed	0%	Avira URL Cloud	safe
https://yiffing.zone/sounds/click.wav	0%	Avira URL Cloud	safe
http://fontello.comCopyright	0%	Avira URL Cloud	safe
https://curl.se/docs/hsts.html	0%	Virustotal		Browse
https://yiffing.zone/sounds/click.wavhttps://yiffing.zone/sounds/notify_off.wavhttps://yiffing.zone/	0%	Avira URL Cloud	safe
https://yiffing.zone/sounds/notify_off.wav	0%	Avira URL Cloud	safe
https://yiffing.zone/sounds/notify_on.wav	0%	Avira URL Cloud	safe
https://curl.se/docs/http-cookies.html	0%	Virustotal		Browse
https://api.playhive.com/v0/game/all/	0%	Virustotal		Browse
https://curl.se/docs/alt-svc.html	0%	Virustotal		Browse
https://yiffing.zone/sounds/click.wavhttps://yiffing.zone/sounds/notify_off.wavhttps://yiffing.zone/	0%	Virustotal		Browse
https://yiffing.zone/sounds/click.wav	0%	Virustotal		Browse
https://yiffing.zone/sounds/notify_off.wav	0%	Virustotal		Browse
https://api.playhive.com/v0/game/all/GetHiveStats:	0%	Virustotal		Browse
https://yiffing.zone/sounds/notify_on.wav	0%	Virustotal		Browse

Name	Source	Malicious	Antivirus Detection	Reputation
http://scripts.sil.org/OFLhttp://scripts.sil.org/OFLInterMediumOpen	loaddll64.exe, 00000000.00000002.3788294623.00007FFBA9464000.00000004.00000001.01000000.00000003.sdmp, loaddll64.exe, 00000000.00000003.1347874541.000001C442900000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1348219113.000001B6B6570000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.3788253297.00007FFBA9464000.00000004.00000001.01000000.00000003.sdmp	false		high
https://curl.se/docs/http-cookies.html	loaddll64.exe, 00000000.00000003.1347113703.000001C440D90000.00000004.00001000.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000002.3788249388.00007FFBA93E4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.3788213687.00007FFBA93E4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000003.1347485334.000001B6B6570000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/Prax-Client/Releases/raw/main/killsound.wavCreated	loaddll64.exe, 00000000.00000003.1347113703.000001C440D90000.00000004.00001000.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000002.3788249388.00007FFBA93E4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.3788213687.00007FFBA93E4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000003.1347485334.000001B6B6570000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.jetbrains.comhttps://www.jetbrains.comThis	loaddll64.exe, 00000000.00000002.3788294623.00007FFBA9464000.00000004.00000001.01000000.00000003.sdmp, loaddll64.exe, 00000000.00000003.1347874541.000001C442900000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1348219113.000001B6B6570000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.3788253297.00007FFBA9464000.00000004.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://api.playhive.com/v0/game/all/GetHiveStats:	loaddll64.exe, 00000000.00000003.1347113703.000001C440D90000.00000004.00001000.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000002.3788249388.00007FFBA93E4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.3788213687.00007FFBA93E4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000003.1347485334.000001B6B6570000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/Prax-Client/Releases/raw/main/banner	loaddll64.exe, 00000000.00000003.1347113703.000001C440D90000.00000004.00001000.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000002.3788249388.00007FFBA93E4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.3788213687.00007FFBA93E4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000003.1347485334.000001B6B6570000.00000004.00001000.00020000.00000000.sdmp	false		high
https://rsms.me/This	rundll32.exe, 00000004.00000002.3788253297.00007FFBA9464000.00000004.00000001.01000000.00000003.sdmp	false		high
http://fontello.com	rundll32.exe, 00000004.00000002.3788253297.00007FFBA9464000.00000004.00000001.01000000.00000003.sdmp	false		high
http://scripts.sil.org/OFLhttp://scripts.sil.org/OFLInterLightOpen	loaddll64.exe, 00000000.00000002.3788294623.00007FFBA9464000.00000004.00000001.01000000.00000003.sdmp, loaddll64.exe, 00000000.00000003.1347874541.000001C442900000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1348219113.000001B6B6570000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.3788253297.00007FFBA9464000.00000004.00000001.01000000.00000003.sdmp	false		high
https://cdn.discordapp.com/attachments/1157861980611297410/1163279643168747570/F6_T6MXXoAAH6os.jpg?e	rundll32.exe, 00000004.00000003.1347485334.000001B6B6570000.00000004.00001000.00020000.00000000.sdmp	false		high
https://curl.se/docs/alt-svc.html	rundll32.exe, 00000004.00000003.1347485334.000001B6B6570000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.github.com/repos/Prax-Client/Releases/releases/latest	rundll32.exe, 00000004.00000003.1347485334.000001B6B6570000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/Prax-Client/Releases/raw/main/killsound.wav	loaddll64.exe, 00000000.00000003.1347113703.000001C440D90000.00000004.00001000.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000002.3788249388.00007FFBA93E4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.3788213687.00007FFBA93E4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000003.1347485334.000001B6B6570000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/rsms/inter)InterBold3.019;RSMS;Inter-BoldInter	loaddll64.exe, 00000000.00000002.3788294623.00007FFBA9464000.00000004.00000001.01000000.00000003.sdmp, loaddll64.exe, 00000000.00000003.1347874541.000001C442900000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1348219113.000001B6B6570000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.3788253297.00007FFBA9464000.00000004.00000001.01000000.00000003.sdmp	false		high
https://api.playhive.com/v0/game/all/	loaddll64.exe, 00000000.00000003.1347113703.000001C440D90000.00000004.00001000.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000002.3788249388.00007FFBA93E4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.3788213687.00007FFBA93E4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000003.1347485334.000001B6B6570000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://scripts.sil.org/OFLhttp://scripts.sil.org/OFLOpen	rundll32.exe, 00000004.00000002.3788253297.00007FFBA9464000.00000004.00000001.01000000.00000003.sdmp	false		high
http://scripts.sil.org/OFLhttp://scripts.sil.org/OFLInterExtraLightOpen	loaddll64.exe, 00000000.00000002.3788294623.00007FFBA9464000.00000004.00000001.01000000.00000003.sdmp, loaddll64.exe, 00000000.00000003.1347874541.000001C442900000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1348219113.000001B6B6570000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.3788253297.00007FFBA9464000.00000004.00000001.01000000.00000003.sdmp	false		high
http://scripts.sil.org/OFLhttp://scripts.sil.org/OFLInterThinOpen	loaddll64.exe, 00000000.00000002.3788294623.00007FFBA9464000.00000004.00000001.01000000.00000003.sdmp, loaddll64.exe, 00000000.00000003.1347874541.000001C442900000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1348219113.000001B6B6570000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.3788253297.00007FFBA9464000.00000004.00000001.01000000.00000003.sdmp	false		high
https://curl.se/docs/hsts.html	loaddll64.exe, 00000000.00000003.1347113703.000001C440D90000.00000004.00001000.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000002.3788249388.00007FFBA93E4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.3788213687.00007FFBA93E4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000003.1347485334.000001B6B6570000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/rsms/inter)InterRegular3.019;RSMS;Inter-RegularInter	loaddll64.exe, 00000000.00000002.3788294623.00007FFBA9464000.00000004.00000001.01000000.00000003.sdmp, loaddll64.exe, 00000000.00000003.1347874541.000001C442900000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1348219113.000001B6B6570000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.3788253297.00007FFBA9464000.00000004.00000001.01000000.00000003.sdmp	false		high
https://Mozilla/5.0Failed	loaddll64.exe, 00000000.00000003.1347113703.000001C440D90000.00000004.00001000.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000002.3788249388.00007FFBA93E4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.3788213687.00007FFBA93E4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000003.1347485334.000001B6B6570000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://yiffing.zone/sounds/click.wav	loaddll64.exe, 00000000.00000003.1347113703.000001C440D90000.00000004.00001000.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000002.3788249388.00007FFBA93E4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.3788213687.00007FFBA93E4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000003.1347485334.000001B6B6570000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/JetBrains/JetBrainsMono)JetBrains	loaddll64.exe, 00000000.00000002.3788294623.00007FFBA9464000.00000004.00000001.01000000.00000003.sdmp, loaddll64.exe, 00000000.00000003.1347874541.000001C442900000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1348219113.000001B6B6570000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.3788253297.00007FFBA9464000.00000004.00000001.01000000.00000003.sdmp	false		high
http://fontello.comCopyright	loaddll64.exe, 00000000.00000002.3788294623.00007FFBA9464000.00000004.00000001.01000000.00000003.sdmp, loaddll64.exe, 00000000.00000003.1347874541.000001C442900000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1348219113.000001B6B6570000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.3788253297.00007FFBA9464000.00000004.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://yiffing.zone/sounds/click.wavhttps://yiffing.zone/sounds/notify_off.wavhttps://yiffing.zone/	loaddll64.exe, 00000000.00000003.1347113703.000001C440D90000.00000004.00001000.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000002.3788249388.00007FFBA93E4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.3788213687.00007FFBA93E4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000003.1347485334.000001B6B6570000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/Prax-Client/Releases/raw/main/fardreverb.wav	rundll32.exe, 00000004.00000003.1347485334.000001B6B6570000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/rsms/inter)Inter	rundll32.exe, 00000004.00000002.3788253297.00007FFBA9464000.00000004.00000001.01000000.00000003.sdmp	false		high
http://scripts.sil.org/OFLhttp://scripts.sil.org/OFLInterSemiBoldOpen	loaddll64.exe, 00000000.00000002.3788294623.00007FFBA9464000.00000004.00000001.01000000.00000003.sdmp, loaddll64.exe, 00000000.00000003.1347874541.000001C442900000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1348219113.000001B6B6570000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.3788253297.00007FFBA9464000.00000004.00000001.01000000.00000003.sdmp	false		high
https://peoplehub-public.xboxlive.com/people/gt(	loaddll64.exe, 00000000.00000003.1347113703.000001C440D90000.00000004.00001000.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000002.3788249388.00007FFBA93E4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.3788213687.00007FFBA93E4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000003.1347485334.000001B6B6570000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/Prax-Client/Releases/raw/main/bannerstart_screenhud_screentextures/ui/titletextur	loaddll64.exe, 00000000.00000003.1347113703.000001C440D90000.00000004.00001000.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000002.3788249388.00007FFBA93E4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.3788213687.00007FFBA93E4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000003.1347485334.000001B6B6570000.00000004.00001000.00020000.00000000.sdmp	false		high
https://peoplehub-public.xboxlive.com/people/gt(Rtn:	loaddll64.exe, 00000000.00000003.1347113703.000001C440D90000.00000004.00001000.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000002.3788249388.00007FFBA93E4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.3788213687.00007FFBA93E4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000003.1347485334.000001B6B6570000.00000004.00001000.00020000.00000000.sdmp	false		high
https://yiffing.zone/sounds/notify_off.wav	loaddll64.exe, 00000000.00000003.1347113703.000001C440D90000.00000004.00001000.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000002.3788249388.00007FFBA93E4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.3788213687.00007FFBA93E4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000003.1347485334.000001B6B6570000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://scripts.sil.org/OFLhttps://scripts.sil.org/OFL	loaddll64.exe, 00000000.00000002.3788294623.00007FFBA9464000.00000004.00000001.01000000.00000003.sdmp, loaddll64.exe, 00000000.00000003.1347874541.000001C442900000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1348219113.000001B6B6570000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.3788253297.00007FFBA9464000.00000004.00000001.01000000.00000003.sdmp	false		high
https://yiffing.zone/sounds/notify_on.wav	loaddll64.exe, 00000000.00000003.1347113703.000001C440D90000.00000004.00001000.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000002.3788249388.00007FFBA93E4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.3788213687.00007FFBA93E4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000003.1347485334.000001B6B6570000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1417538
Start date and time:	2024-03-29 15:25:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Application.Generic.3623086.1464.24272.dll (renamed file extension from exe to dll)
Original Sample Name:	SecuriteInfo.com.Application.Generic.3623086.1464.24272.exe
Detection:	MAL
Classification:	mal80.evad.winDLL@6/0@0/0
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Override analysis time to 240s for rundll32

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information

File type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy (8bit):	7.986250881029374
TrID:	Win64 Dynamic Link Library (generic) (102004/3) 86.43% Win64 Executable (generic) (12005/4) 10.17% Generic Win/DOS Executable (2004/3) 1.70% DOS Executable Generic (2002/1) 1.70% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.01%
File name:	SecuriteInfo.com.Application.Generic.3623086.1464.24272.dll
File size:	6'792'208 bytes
MD5:	72bca96a3c16575f9c41c971f290ef9d
SHA1:	ec2a063a295a44b559753048b69b13f6f29581be
SHA256:	0ba766c92ee65ba37d996bd0b1aaf5bbf9bdef6efe2473997972642d206c877f
SHA512:	0574da8f8b8bab89ff3ad7403deda2a46e8b450d8b837e953cf02e0387998d65d5e6a7916e0af642cad09669fd41e4fcb8221aaf34941908ede8e6eeebc24109
SSDEEP:	98304:9vnGSDRqwFgUXnqWBeLMe7QXtXSXqiYT6fSPA3Jt5w3Va3GmHD60qvlGQP8ERCSi:9vGwxFgTCXl4qmSY3J3AXmj6bGicSxE
TLSH:	B266332F59B66F7BCB9D97B48AE0A06C1D36FF2F185F085E363209161A3C54A2F02D15
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......,...h...h...h...#...r...#...H.....P.o.......x...................#.......#...w...h...3.......i...h...}.............R.i.......i..

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x180d1c0b0
Entrypoint Section:	.boot
Digitally signed:	false
Imagebase:	0x180000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, DLL
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE
Time Stamp:	0x6601F364 [Mon Mar 25 21:57:56 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	4d5e2630f597c581f9c8c6dd71c07b69

Entrypoint Preview

Instruction
call 00007F5A38C2BD17h
inc ecx
push edx
dec ecx
mov edx, esp
inc ecx
push edx
dec ecx
mov esi, dword ptr [edx+10h]
dec ecx
mov edi, dword ptr [edx+20h]
cld
mov dl, 80h
mov al, byte ptr [esi]
dec eax
inc esi
mov byte ptr [edi], al
dec eax
inc edi
mov ebx, 00000002h
add dl, dl
jne 00007F5A38C2BB99h
mov dl, byte ptr [esi]
dec eax
inc esi
adc dl, dl
jnc 00007F5A38C2BB76h
add dl, dl
jne 00007F5A38C2BB99h
mov dl, byte ptr [esi]
dec eax
inc esi
adc dl, dl
jnc 00007F5A38C2BBF0h
xor eax, eax
add dl, dl
jne 00007F5A38C2BB99h
mov dl, byte ptr [esi]
dec eax
inc esi
adc dl, dl
jnc 00007F5A38C2BC98h
add dl, dl
jne 00007F5A38C2BB99h
mov dl, byte ptr [esi]
dec eax
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007F5A38C2BB99h
mov dl, byte ptr [esi]
dec eax
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007F5A38C2BB99h
mov dl, byte ptr [esi]
dec eax
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007F5A38C2BB99h
mov dl, byte ptr [esi]
dec eax
inc esi
adc dl, dl
adc eax, eax
je 00007F5A38C2BB9Bh
push edi
mov eax, eax
dec eax
sub edi, eax
mov al, byte ptr [edi]
pop edi
mov byte ptr [edi], al
dec eax
inc edi
mov ebx, 00000002h
jmp 00007F5A38C2BB1Ah
mov eax, 00000001h
add dl, dl
jne 00007F5A38C2BB99h
mov dl, byte ptr [esi]
dec eax
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007F5A38C2BB99h
mov dl, byte ptr [esi]
dec eax
inc esi
adc dl, dl
jc 00007F5A38C2BB78h
sub eax, ebx
mov ebx, 00000001h
jne 00007F5A38C2BBC0h
mov ecx, 00000001h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x70b169	0x1f0	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x70d000	0x1d8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xcea024	0x1a070	.themida
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x107f000	0x10	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x70c2c0	0x28	.tls
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x2c2738	0x12d800	ca417bccc1d5dd91d3937174cd7ac621	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
	0x2c4000	0x7f7d8	0x37a00	369e192652fe0603688ce100d28a292b	False	0.9958128511235955	data	7.974059154733227	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
	0x344000	0x3a3210	0x1a0a00	b514e5f74447c06613ea1c7685377adb	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x6e8000	0x1a058	0xf000	05318e5f2fbb1e136e721b0592366e5a	False	0.9489420572916667	data	7.677591746789919	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
	0x703000	0x2408	0xe00	a6660cef6d73b063a0ac4c7a62a1b75c	False	0.845703125	data	7.510252954486649	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
	0x706000	0x1e0	0x200	80f858cf3db62e6cb43b45c240fc9f46	False	0.724609375	data	5.568782170470238	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
	0x707000	0x33f4	0xc00	18abc787bf0075d44724b6a95df0840b	False	0.7799479166666666	data	7.460653272571481	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.idata	0x70b000	0x1000	0x400	62cbc799e33125d23dcd548ae7281690	False	0.369140625	data	3.269373167485061	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x70c000	0x1000	0x400	14fc24e5f766d495173fe18d67463c94	False	0.0390625	data	0.20080006224549074	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x70d000	0x1000	0x200	2d3428819562473b96a8482788e7ea79	False	0.52734375	data	4.724728911998389	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.themida	0x70e000	0x60e000	0x0	d41d8cd98f00b204e9800998ecf8427e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.boot	0xd1c000	0x362c00	0x362c00	266436514efba945c5110dd3d78bce54	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.reloc	0x107f000	0x1000	0x10	2f94d631ec0ff5b0ba8396b32a2ef265	False	1.5625	GLS_BINARY_LSB_FIRST	2.6493974703476995	IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x70d058	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	GetModuleHandleA
d3d11.dll	D3D11On12CreateDevice
d2d1.dll
WS2_32.dll	connect
ADVAPI32.dll	CryptReleaseContext
CRYPT32.dll	CryptQueryObject
bcrypt.dll	BCryptOpenAlgorithmProvider
USER32.dll	GetClientRect
ole32.dll	CoCreateFreeThreadedMarshaler
WININET.dll	InternetOpenA
IMM32.dll	ImmGetContext
D3DCOMPILER_47.dll	D3DCompile
OLEAUT32.dll	SetErrorInfo

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	15:26:00
Start date:	29/03/2024
Path:	C:\Windows\System32\loaddll64.exe
Wow64 process (32bit):	false
Commandline:	loaddll64.exe "C:\Users\user\Desktop\SecuriteInfo.com.Application.Generic.3623086.1464.24272.dll"
Imagebase:	0x7ff77d150000
File size:	165'888 bytes
MD5 hash:	763455F9DCB24DFEECC2B9D9F8D46D52
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	15:26:00
Start date:	29/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	15:26:00
Start date:	29/03/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Application.Generic.3623086.1464.24272.dll",#1
Imagebase:	0x7ff60c210000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	15:26:00
Start date:	29/03/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Application.Generic.3623086.1464.24272.dll",#1
Imagebase:	0x7ff675100000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Application.Generic.3623086.1464.24272.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: loaddll64.exePID: 7452, Parent PID: 4084

General

Chronological Activities

Analysis Process: conhost.exePID: 7468, Parent PID: 7452

General

Chronological Activities

Windows Analysis Report
SecuriteInfo.com.Application.Generic.3623086.1464.24272.dll