Play interactive tour

Edit tour

Analysis Report utility.dll

Overview

General Information

Sample Name:	utility.dll
Analysis ID:	385485
MD5:	c84fd1069470c4f7cbcd9fa10fc32615
SHA1:	94ca6af9cae336754da47e2b8694a1f33db78e89
SHA256:	59d2ed9608ac543bd671da7b17558ebce275f64dd80fc84abd10fd31dea49c5e
Infos:
Most interesting Screenshot:

Detection

Score:	8
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query network adapater information

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found large amount of non-executed APIs

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Analysis Advice

Sample crashes during execution, try analyze it on another analysis machine

Sample may be VM or Sandbox-aware, try analysis on a native machine

Startup

System is w10x64

loaddll32.exe (PID: 3664 cmdline: loaddll32.exe 'C:\Users\user\Desktop\utility.dll' MD5: 542795ADF7CC08EFCF675D65310596E8)

cmd.exe (PID: 4080 cmdline: cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\utility.dll',#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

rundll32.exe (PID: 908 cmdline: rundll32.exe 'C:\Users\user\Desktop\utility.dll',#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

WerFault.exe (PID: 1956 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 908 -s 696 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

rundll32.exe (PID: 460 cmdline: rundll32.exe C:\Users\user\Desktop\utility.dll,CPUSpeed MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

WerFault.exe (PID: 5360 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 460 -s 688 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

rundll32.exe (PID: 4120 cmdline: rundll32.exe C:\Users\user\Desktop\utility.dll,Decrypt MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

WerFault.exe (PID: 5816 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 4120 -s 688 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

rundll32.exe (PID: 5436 cmdline: rundll32.exe C:\Users\user\Desktop\utility.dll,Decrypt2BinStr MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

WerFault.exe (PID: 5512 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5436 -s 688 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

rundll32.exe (PID: 5988 cmdline: rundll32.exe C:\Users\user\Desktop\utility.dll,DecryptEx MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

WerFault.exe (PID: 5352 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5988 -s 688 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

rundll32.exe (PID: 4928 cmdline: rundll32.exe C:\Users\user\Desktop\utility.dll,Deflate MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

WerFault.exe (PID: 3580 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 688 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

rundll32.exe (PID: 1268 cmdline: rundll32.exe C:\Users\user\Desktop\utility.dll,DeflateToMemory MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

WerFault.exe (PID: 3512 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1268 -s 688 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

rundll32.exe (PID: 3352 cmdline: rundll32.exe C:\Users\user\Desktop\utility.dll,DirectDrawEnumDisplayModes MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 5716 cmdline: rundll32.exe C:\Users\user\Desktop\utility.dll,DirectDrawIsSupported MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 5324 cmdline: rundll32.exe C:\Users\user\Desktop\utility.dll,DirectDrawRestoreDisplayMode MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 3544 cmdline: rundll32.exe C:\Users\user\Desktop\utility.dll,DirectDrawSetDisplayMode MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 6220 cmdline: rundll32.exe C:\Users\user\Desktop\utility.dll,DirectoryAdd MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

WerFault.exe (PID: 6332 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6220 -s 688 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

rundll32.exe (PID: 6356 cmdline: rundll32.exe C:\Users\user\Desktop\utility.dll,DirectoryClear MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 6444 cmdline: rundll32.exe C:\Users\user\Desktop\utility.dll,DirectoryDump MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10002170 FileEncrypt,
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10002290 FileDecrypt,
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10004340 SecuritySave,CompareFileTime,CompareFileTime,CompareFileTime,EncryptEx,
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10001D30 Encrypt,SysAllocStringLen,
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10001E50 EncryptEx,
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10003E90 SecurityLoad,SecurityWipeMemory,GetSystemTime,SystemTimeToFileTime,wsprintfA,lstrcpyA,wsprintfA,wsprintfA,lstrlenA,lstrcpyA,lstrcpynA,DecryptEx,
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10001EB0 DecryptEx,
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10001F10 Decrypt,SysAllocStringLen,
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10001FF0 Decrypt2BinStr,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10002170 FileEncrypt,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10002290 FileDecrypt,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10004340 SecuritySave,CompareFileTime,CompareFileTime,CompareFileTime,EncryptEx,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10001D30 Encrypt,SysAllocStringLen,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10001E50 EncryptEx,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10003E90 SecurityLoad,SecurityWipeMemory,GetSystemTime,SystemTimeToFileTime,wsprintfA,lstrcpyA,wsprintfA,wsprintfA,lstrlenA,lstrcpyA,lstrcpynA,DecryptEx,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10001EB0 DecryptEx,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10001F10 Decrypt,SysAllocStringLen,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10001FF0 Decrypt2BinStr,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 33_2_10002170 FileEncrypt,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 33_2_10002290 FileDecrypt,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 33_2_10004340 SecuritySave,CompareFileTime,CompareFileTime,CompareFileTime,EncryptEx,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 33_2_10001D30 Encrypt,SysAllocStringLen,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 33_2_10001E50 EncryptEx,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 33_2_10003E90 SecurityLoad,SecurityWipeMemory,GetSystemTime,SystemTimeToFileTime,wsprintfA,lstrcpyA,wsprintfA,wsprintfA,lstrlenA,lstrcpyA,lstrcpynA,DecryptEx,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 33_2_10001EB0 DecryptEx,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 33_2_10001F10 Decrypt,SysAllocStringLen,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 33_2_10001FF0 Decrypt2BinStr,

Source: utility.dll

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL, LINE_NUMS_STRIPPED

Source: utility.dll

Static PE information: certificate valid

Source: unknown

DNS traffic detected: queries for: clientconfig.passport.net

Source: utility.dll	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: utility.dll	String found in binary or memory: http://ocsp.thawte.com0
Source: utility.dll	String found in binary or memory: http://t1.symcb.com/ThawtePCA.crl0
Source: utility.dll	String found in binary or memory: http://t2.symcb.com0
Source: utility.dll	String found in binary or memory: http://tl.symcb.com/tl.crl0
Source: utility.dll	String found in binary or memory: http://tl.symcb.com/tl.crt0
Source: utility.dll	String found in binary or memory: http://tl.symcd.com0&
Source: utility.dll	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: utility.dll	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: utility.dll	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: utility.dll	String found in binary or memory: https://www.thawte.com/cps0/
Source: utility.dll	String found in binary or memory: https://www.thawte.com/repository0

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10005830
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_100120C0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10013160
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_1001E96D
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_100019D0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_100151D2
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_1000B9E0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10011A80
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_1000B390
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_100143C1
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10009400
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_1000BC30
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10011470
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10018507
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10014D10
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10015D40
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10015590
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10014610
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_1000BE90
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_1000B6E0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10002F80
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10013790
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10010FC0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_1000AFF0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_100019D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10005830
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_100120C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10013160
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1001E96D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_100151D2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1000B9E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10011A80
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1000B390
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_100143C1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10009400
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1000BC30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10011470
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10018507
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10014D10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10015D40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10015590
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10014610
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1000BE90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1000B6E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10002F80
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10013790
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10010FC0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1000AFF0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 33_2_10005830
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 33_2_100120C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 33_2_10013160
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 33_2_1001E96D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 33_2_100019D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 33_2_100151D2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 33_2_1000B9E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 33_2_10011A80
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 33_2_1000B390
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 33_2_100143C1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 33_2_10009400
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 33_2_1000BC30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 33_2_10011470
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 33_2_10018507
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 33_2_10014D10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 33_2_10015D40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 33_2_10015590
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 33_2_10014610
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 33_2_1000BE90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 33_2_1000B6E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 33_2_10002F80
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 33_2_10013790
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 33_2_10010FC0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 33_2_1000AFF0

Source: C:\Windows\SysWOW64\rundll32.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 460 -s 688

Source: utility.dll

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL, LINE_NUMS_STRIPPED

Source: classification engine

Classification label: clean8.winDLL@51/32@1/0

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4120
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6220
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess460
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4928
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess908
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5436
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5988
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1268

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WERD60F.tmp

Jump to behavior

Source: utility.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\rundll32.exe

File read: C:\Windows\win.ini