Joe Sandbox Cloud Basic Analysis Report

Loading ...

Play interactive tourEdit tour

Analysis Report Vjvj9F0fTc

Overview

General Information

Sample Name:Vjvj9F0fTc (renamed file extension from none to dll)
Analysis ID:330003
MD5:b91ce2fa41029f6955bff20079468448
SHA1:76640508b1e7759e548771a5359eaed353bf1eec
SHA256:32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77

Most interesting Screenshot:

Detection

Score:1
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

Program does not show much activity (idle)
Sample file is different than original file name gathered from version info

Classification

Startup

  • System is w10x64
  • loaddll32.exe (PID: 7080 cmdline: loaddll32.exe 'C:\Users\user\Desktop\Vjvj9F0fTc.dll' MD5: 2D39D4DFDE8F7151723794029AB8A034)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: Vjvj9F0fTc.dllString found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: Vjvj9F0fTc.dllString found in binary or memory: http://s.symcd.com06
Source: Vjvj9F0fTc.dllString found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: Vjvj9F0fTc.dllString found in binary or memory: http://s2.symcb.com0
Source: Vjvj9F0fTc.dllString found in binary or memory: http://solarwinds.s3.amazonaws.com/solarwinds/Release/MIB-Database/MIBs.zip
Source: Vjvj9F0fTc.dllString found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: Vjvj9F0fTc.dllString found in binary or memory: http://sv.symcb.com/sv.crt0
Source: Vjvj9F0fTc.dllString found in binary or memory: http://sv.symcd.com0&
Source: Vjvj9F0fTc.dllString found in binary or memory: http://thwackfeeds.solarwinds.com/blogs/orion-product-team-blog/rss.aspxT
Source: Vjvj9F0fTc.dllString found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: Vjvj9F0fTc.dllString found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: Vjvj9F0fTc.dllString found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: Vjvj9F0fTc.dllString found in binary or memory: http://www.solarwinds.com/contracts/IMaintUpdateNotifySvc/2009/09/IMaintUpdateNotifySvc/GetDataRespo
Source: Vjvj9F0fTc.dllString found in binary or memory: http://www.solarwinds.com/contracts/IMaintUpdateNotifySvc/2009/09/IMaintUpdateNotifySvc/GetDataT
Source: Vjvj9F0fTc.dllString found in binary or memory: http://www.solarwinds.com/contracts/IMaintUpdateNotifySvc/2009/09/IMaintUpdateNotifySvc/GetLocalized
Source: Vjvj9F0fTc.dllString found in binary or memory: http://www.solarwinds.com/contracts/IMaintUpdateNotifySvc/2009/09L
Source: Vjvj9F0fTc.dllString found in binary or memory: http://www.solarwinds.com/contracts/IMaintUpdateNotifySvc/2009/09T
Source: Vjvj9F0fTc.dllString found in binary or memory: http://www.solarwinds.com/documentation/kbloader.aspx?lang=
Source: Vjvj9F0fTc.dllString found in binary or memory: http://www.solarwinds.com/embedded_in_products/productLink.aspx?id=online_quote
Source: Vjvj9F0fTc.dllString found in binary or memory: http://www.symauth.com/cps0(
Source: Vjvj9F0fTc.dllString found in binary or memory: http://www.symauth.com/rpa00
Source: Vjvj9F0fTc.dllString found in binary or memory: https://d.symcb.com/cps0%
Source: Vjvj9F0fTc.dllString found in binary or memory: https://d.symcb.com/rpa0
Source: Vjvj9F0fTc.dllString found in binary or memory: https://d.symcb.com/rpa0.
Source: Vjvj9F0fTc.dllBinary or memory string: OriginalFilenameSolarWinds.Orion.Core.BusinessLayer.dllh$ vs Vjvj9F0fTc.dll
Source: classification engineClassification label: clean1.winDLL@1/0@0/0
Source: Vjvj9F0fTc.dllStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Windows\System32\loaddll32.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: Vjvj9F0fTc.dllStatic PE information: certificate valid
Source: Vjvj9F0fTc.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: Vjvj9F0fTc.dllStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
Source: Vjvj9F0fTc.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: C:\buildAgent\temp\buildTmp\Obj\SolarWinds.Orion.Core.BusinessLayer\Release\SolarWinds.Orion.Core.BusinessLayer.pdb source: Vjvj9F0fTc.dll
Source: Binary string: C:\buildAgent\temp\buildTmp\Obj\SolarWinds.Orion.Core.BusinessLayer\Release\SolarWinds.Orion.Core.BusinessLayer.pdb|a source: Vjvj9F0fTc.dll
Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: Vjvj9F0fTc.dllBinary or memory string: SNMPPort#VMwareProductName)VMwareProductVersion
Source: Vjvj9F0fTc.dllBinary or memory string: GetAllVMwareServiceURIs
Source: Vjvj9F0fTc.dllBinary or memory string: for VMWare ESX
Source: Vjvj9F0fTc.dllBinary or memory string: vmwareCredentialsID
Source: Vjvj9F0fTc.dllBinary or memory string: GetVMwareCredential
Source: Vjvj9F0fTc.dllBinary or memory string: ActionTypeIDYSending request for BlogItemDAL.GetBlogById.QError obtaining blog notification item: SSending request for BlogItemDAL.GetItems.]Error when obtaining blog notification items: sSending request for CoreHelper.CheckOrionProductTeamBlog.]Error forcing blog notification items update: eSending request for BlogItemDAL.GetBlogItemForPos.cError obtaining blog notification item for post: /GetAllVMwareServiceURIs'GetVMwareCredential-InsertUpdateVMHostNode
Source: Vjvj9F0fTc.dllBinary or memory string: get_VMwareESXJobTimeout
Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Valid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume AccessOS Credential DumpingSecurity Software Discovery1Remote ServicesData from Local SystemExfiltration Over Other Network MediumData ObfuscationEavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemorySystem Information Discovery1Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothJunk DataExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.