Edit tour

Windows Analysis Report
SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll

Overview

General Information

Sample name:	SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll
Analysis ID:	1431438
MD5:	db4b8570e24a6820f9fc30bc34b75de4
SHA1:	8eec515e7c75b3879ada16cd5f397e7c588dc193
SHA256:	652e2c35d36d4b96fdda843b6339c185eab3263b0b8acdb6349df240d1b9f8e4
Tags:	dll
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected VMProtect packer

Machine Learning detection for sample

Checks if the current process is being debugged

Creates a process in suspended mode (likely to inject code)

Entry point lies outside standard sections

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Registers a DLL

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 3732 cmdline: loaddll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll" MD5: 51E6071F9CBA48E79F10C84515AAE618)

conhost.exe (PID: 4176 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 2668 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll",#1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

rundll32.exe (PID: 7100 cmdline: rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll",#1 MD5: 889B99C52A60DD49227C5E485A016679)

regsvr32.exe (PID: 7060 cmdline: regsvr32.exe /s C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll MD5: 878E47C8656E53AE8A8A21E927C6F7E0)

rundll32.exe (PID: 4772 cmdline: rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll,DllCanUnloadNow MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 4144 cmdline: rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll,DllGetClassObject MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 5316 cmdline: rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll,DllRegisterServer MD5: 889B99C52A60DD49227C5E485A016679)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll

Avira: detected

Machine Learning detection for sample

Source: SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll

Joe Sandbox ML: detected

Source: SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL

Source: SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll	String found in binary or memory: http://www.2345.com/?15493
Source: SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll	String found in binary or memory: http://www.2345.com/?15493Software
Source: SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll	String found in binary or memory: http://www.hao123.com/?tn=50097079_1_hao_pg
Source: SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll	String found in binary or memory: http://www.hao123.com/?tn=50097079_1_hao_pgaHR0cDovL3d3dy5oYW8xMjMuY29tLz90bj01MDA5NzA3OV8xX2hhb19wZ
Source: SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll	String found in binary or memory: http://www.itmxc.com
Source: SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll	String found in binary or memory: http://www.itmxc.com/member.php?mod=register

System Summary

Detected VMProtect packer

Source: SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll

Static PE information: .vmp0 and .vmp1 section names

Source: SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll

Binary or memory string: OriginalFilenameNCList.DLL< vs SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll

Source: SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL

Source: SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll

Static PE information: Section: .vmp2 ZLIB complexity 0.9891912286931818

Source: classification engine

Classification label: mal56.winDLL@14/0@0/0

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4176:120:WilError_03

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll",#1

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll,DllCanUnloadNow
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll,DllGetClassObject
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll,DllRegisterServer
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll,DllCanUnloadNow	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll,DllGetClassObject	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll,DllRegisterServer	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll",#1	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: atl100.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: msvcp100.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: omng.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: uilib.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: atl100.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: msvcp100.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: omng.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: uilib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: msvcr100.dll	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll

Static file information: File size 2216547 > 1048576

Source: SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll

Static PE information: Raw size of .vmp2 is bigger than: 0x100000 < 0x113000

Source: initial sample

Static PE information: section where entry point is pointing to: .vmp2

Source: SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll

Static PE information: real checksum: 0x12bb1c should be: 0x2286d4

Source: SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll	Static PE information: section name: .vmp0
Source: SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll	Static PE information: section name: .vmp1
Source: SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll	Static PE information: section name: .vmp2

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll

Source: SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll

Static PE information: section name: .vmp2 entropy: 7.954667501881547

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\loaddll32.exe

Process queried: DebugPort

Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll",#1

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	1 Regsvr32	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Rundll32	Security Account Manager	1 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Software Packing	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Process Injection	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll	100%	Avira	TR/Black.Gen2
SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll	100%	Joe Sandbox ML

Name	Source	Malicious	Reputation
http://www.hao123.com/?tn=50097079_1_hao_pg	SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll	false	high
http://www.2345.com/?15493Software	SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll	false	high
http://www.itmxc.com/member.php?mod=register	SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll	false	high
http://www.2345.com/?15493	SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll	false	high
http://www.hao123.com/?tn=50097079_1_hao_pgaHR0cDovL3d3dy5oYW8xMjMuY29tLz90bj01MDA5NzA3OV8xX2hhb19wZ	SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll	false	high
http://www.itmxc.com	SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll	false	high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1431438
Start date and time:	2024-04-25 05:24:28 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll
Detection:	MAL
Classification:	mal56.winDLL@14/0@0/0
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .dll Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Not all processes where analyzed, report is missing behavior information

File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.28865805527719
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 89.26% Windows ActiveX control (116523/4) 10.38% Generic Win/DOS Executable (2004/3) 0.18% DOS Executable Generic (2002/1) 0.18% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll
File size:	2'216'547 bytes
MD5:	db4b8570e24a6820f9fc30bc34b75de4
SHA1:	8eec515e7c75b3879ada16cd5f397e7c588dc193
SHA256:	652e2c35d36d4b96fdda843b6339c185eab3263b0b8acdb6349df240d1b9f8e4
SHA512:	0c24ee51414acc43a801263162077b18ba2bb14b579e8cf07d74521f53721f1dcafe0c51783ea5872d441cbd1f9996efc8c9ea1e06bcf811e8dce40538e93a34
SSDEEP:	24576:hZKLBBcfI5epEbN1uSqwyMvSosVEcF2G6cTFOp/rzYIBCDT1Lvna:hZKLBBaI5eu1uStyUSosVtUFAoC
TLSH:	8EA5CFC577C8D852C2F9223019862EE25E6E9D64BD9B52263F0D721F9F739D01B32E60
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........q..J...J...J...%fs.O....^@.O...Q.F.@...Q.r.G....0..H...Q.D.B...Ch\.K...Ch[.O...ChK.]...J.......Q.s.t...Q.C.K...Q.B.K...Q.E.K..

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x5fc6dea2
Entrypoint Section:	.vmp2
Digitally signed:	false
Imagebase:	0x5f9c0000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL
DLL Characteristics:	NX_COMPAT
Time Stamp:	0x51DCC8F3 [Wed Jul 10 02:37:39 2013 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	faa66df48a491ed57103190e1f0392c6

Entrypoint Preview

Instruction
call 00007F677C6C20DDh
push DBE5E3BEh
lea esp, dword ptr [esp+28h]
je 00007F677C719099h
jmp 00007F677C71A02Ah
or byte ptr [D85A817Dh], bh
outsd
sub edi, edx
test byte ptr [3F00C99Ah+esi*2], al
movsd
pop esp
jo 00007F677C7B341Ch
push ebx
push eax
pop ds
cld
test eax, 8DEFC965h
and edx, dword ptr [edi+ebp*8-0Eh]
or eax, DA560312h

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 SP1 build 40219
[ C ] VS2010 SP1 build 40219
[LNK] VC++ 6.0 SP5 build 8804
[IMP] VS2010 SP1 build 40219
[C++] VS2008 SP1 build 30729
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[C++] VS2010 SP1 build 40219
[EXP] VS2010 SP1 build 40219
[RES] VS2010 SP1 build 40219
[LNK] VS2010 SP1 build 40219

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x1bd8c4	0xcb	.vmp2
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1bce30	0x17c	.vmp2
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xe9000	0x14ba0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2c7000	0x94	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2c6484	0x40	.vmp2
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2ad744	0xa4	.vmp2
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xa1a8c	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xa3000	0x3390b	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xd7000	0x11c1c	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xe9000	0x14ba0	0x14c00	be89738940fa6416643f16b1ff094acc	False	0.3430675828313253	data	5.086973990628991	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.vmp0	0xfe000	0xe616	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.vmp1	0x10d000	0xa6830	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE
.vmp2	0x1b4000	0x112ec0	0x113000	7b7b1d761729b00daeb35c475bce946d	False	0.9891912286931818	data	7.954667501881547	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x2c7000	0x94	0x200	e540ab6d74a46225da8338e952e2eb37	False	0.25390625	GLS_BINARY_LSB_FIRST	1.5835659840242964	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
REGISTRY	0xe93dc	0x24e	ASCII text, with CRLF line terminators	Chinese	China	0.4915254237288136
REGISTRY	0xe962c	0x286	ASCII text, with CRLF line terminators	Chinese	China	0.4551083591331269
REGISTRY	0xe98b4	0x29e	ASCII text, with CRLF line terminators	Chinese	China	0.44328358208955226
REGISTRY	0xe9b54	0x256	ASCII text, with CRLF line terminators	Chinese	China	0.48494983277591974
REGISTRY	0xe9dac	0x266	ASCII text, with CRLF line terminators	Chinese	China	0.4755700325732899
REGISTRY	0xea014	0x2d6	ASCII text, with CRLF line terminators	Chinese	China	0.4132231404958678
REGISTRY	0xea2ec	0x266	ASCII text, with CRLF line terminators	Chinese	China	0.4723127035830619
REGISTRY	0xea554	0x291	ASCII text, with CRLF line terminators	Chinese	China	0.4459665144596651
REGISTRY	0xea7e8	0x29e	ASCII text, with CRLF line terminators	Chinese	China	0.44029850746268656
REGISTRY	0xeaa88	0x27e	ASCII text, with CRLF line terminators	Chinese	China	0.46394984326018807
REGISTRY	0xead08	0x286	ASCII text, with CRLF line terminators	Chinese	China	0.456656346749226
REGISTRY	0xeaf90	0x2c8	ASCII text, with CRLF line terminators	Chinese	China	0.4353932584269663
REGISTRY	0xeb258	0x29d	ASCII text, with CRLF line terminators	Chinese	China	0.4439461883408072
TYPELIB	0xeb4f8	0x1229c	data	Chinese	China	0.36317812785633635
RT_STRING	0xfdb74	0x2c	data	Chinese	China	0.2727272727272727
RT_VERSION	0xfd794	0x284	data	Chinese	China	0.4767080745341615
RT_MANIFEST	0xfda18	0x15a	ASCII text, with CRLF line terminators	English	United States	0.5491329479768786

Imports

DLL	Import
KERNEL32.dll	GetProcessHeap
USER32.dll	PostQuitMessage
GDI32.dll	SetDIBits
ADVAPI32.dll	CryptExportKey
SHELL32.dll
ole32.dll	CoInitialize
OLEAUT32.dll	RegisterTypeLib
ATL100.DLL
SHLWAPI.dll	PathFindFileNameW
MSVCP100.dll	?width@ios_base@std@@QBE_JXZ
omng.DLL
MSVCR100.dll	_mkgmtime64
uilib.dll	sqlite3_next_stmt
RPCRT4.dll	UuidFromStringA
VERSION.dll	GetFileVersionInfoSizeW
WININET.dll	InternetTimeToSystemTimeW
USER32.dll	MessageBoxA
KERNEL32.dll	GetModuleHandleA, LoadLibraryA, LocalAlloc, LocalFree, GetModuleFileNameA, ExitProcess

Exports

Name	Ordinal	Address
DllCanUnloadNow	1	0x5fa08c85
DllGetClassObject	2	0x5fa09e8e
DllRegisterServer	3	0x5fa0acb6
DllUnregisterServer	4	0x5fa0acc5
NSGetModule	6	0x5fa08c91
RD_XXXX	5	0x5fa313f8

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	China
English	United States

Target ID:	0
Start time:	05:25:44
Start date:	25/04/2024
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll"
Imagebase:	0x270000
File size:	126'464 bytes
MD5 hash:	51E6071F9CBA48E79F10C84515AAE618
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	05:25:44
Start date:	25/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff68cce0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	05:25:44
Start date:	25/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll",#1
Imagebase:	0xc30000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	05:25:44
Start date:	25/04/2024
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	regsvr32.exe /s C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll
Imagebase:	0x890000
File size:	20'992 bytes
MD5 hash:	878E47C8656E53AE8A8A21E927C6F7E0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	05:25:44
Start date:	25/04/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll",#1
Imagebase:	0xbc0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	05:25:44
Start date:	25/04/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll,DllCanUnloadNow
Imagebase:	0xbc0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	05:25:47
Start date:	25/04/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll,DllGetClassObject
Imagebase:	0xbc0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	05:25:50
Start date:	25/04/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll,DllRegisterServer
Imagebase:	0xbc0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. The Regsvr32.exe binary may also be signed by Microsoft.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Module: Module Load, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: loaddll32.exePID: 3732, Parent PID: 2592

General

Chronological Activities

Analysis Process: conhost.exePID: 4176, Parent PID: 3732

General

Chronological Activities

Windows Analysis Report
SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll