Analysis Report 0WzJdqE4Rw

Overview

General Information

Sample Name: 0WzJdqE4Rw (renamed file extension from none to dll)
Analysis ID: 392876
MD5: d596fd09b8431db69ac77ffdfd138f3f
SHA1: 9e436235e8e0e6f0c0a87ebd4b0d53688a7b994c
SHA256: a6bd76295d3032edba531572417b1349bb4ba8d167fa593d954fd7dcc63cb2ca
Tags: 40112Dridex
Infos:

Most interesting Screenshot:

Detection

Dridex Dropper
Score: 84
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Dridex dropper found
Found malware configuration
Yara detected Dridex unpacked file
C2 URLs / IPs found in malware configuration
Found potential dummy code loops (likely to delay analysis)
Machine Learning detection for sample
Tries to delay execution (extensive OutputDebugStringW loop)
Tries to detect sandboxes / dynamic malware analysis system (file name check)
Abnormal high CPU Usage
Checks if the current process is being debugged
Contains functionality to call native functions
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to query locales information (e.g. system language)
Creates a DirectInput object (often for capturing keystrokes)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
Program does not show much activity (idle)
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

AV Detection:

barindex
Found malware configuration
Source: 3.2.rundll32.exe.6de80000.3.unpack Malware Configuration Extractor: Dridex {"Version": 40112, "C2 list": ["107.172.227.10:443", "172.93.133.123:2303", "108.168.61.147:8172"], "RC4 keys": ["AhGDjKatq8OVBsCNBxsJHbQSf84QZXMd170Lw0kGCrK", "ZZ9zhvNgYZKh5HVVVEDNPVdpdSY2d6pJ4ZBqsvPVEDjyOFNIkXQwmhTyNKiurfq"]}
Machine Learning detection for sample
Source: 0WzJdqE4Rw.dll Joe Sandbox ML: detected

Compliance:

barindex
Uses 32bit PE files
Source: 0WzJdqE4Rw.dll Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
Source: 0WzJdqE4Rw.dll Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: wntdll.pdbUGP source: rundll32.exe, 00000003.00000003.293075202.000000004B280000.00000004.00000001.sdmp
Source: Binary string: wntdll.pdb source: rundll32.exe, 00000003.00000003.293075202.000000004B280000.00000004.00000001.sdmp
Source: Binary string: Gsp.pdb source: loaddll32.exe, 00000001.00000002.234619804.000000006E11A000.00000002.00020000.sdmp, 0WzJdqE4Rw.dll

Networking:

barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor IPs: 107.172.227.10:443
Source: Malware configuration extractor IPs: 172.93.133.123:2303
Source: Malware configuration extractor IPs: 108.168.61.147:8172
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 172.93.133.123 172.93.133.123
Source: Joe Sandbox View IP Address: 107.172.227.10 107.172.227.10
Source: Joe Sandbox View IP Address: 108.168.61.147 108.168.61.147
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: NEXEONUS NEXEONUS
Source: Joe Sandbox View ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS
Source: Joe Sandbox View ASN Name: START-CA START-CA

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Creates a DirectInput object (often for capturing keystrokes)
Source: loaddll32.exe, 00000001.00000002.234590493.0000000000EAB000.00000004.00000020.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

barindex
Dridex dropper found
Source: Initial file Signature Results: Dridex dropper behavior
Yara detected Dridex unpacked file
Source: Yara match File source: 00000003.00000002.503419518.000000006DE81000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match File source: 3.2.rundll32.exe.6de80000.3.unpack, type: UNPACKEDPE

System Summary:

barindex
Abnormal high CPU Usage
Source: C:\Windows\SysWOW64\rundll32.exe Process Stats: CPU usage > 98%
Contains functionality to call native functions
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_6DE9218C NtDelayExecution, 3_2_6DE9218C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_6DE92790 NtAllocateVirtualMemory, 3_2_6DE92790
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_6DE8BC00 NtClose, 3_2_6DE8BC00
Detected potential crypto function
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_6DE907CC 3_2_6DE907CC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_6DE8A5A4 3_2_6DE8A5A4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_6DE89144 3_2_6DE89144
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_6DE884E4 3_2_6DE884E4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_6DE914D8 3_2_6DE914D8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_6DE81494 3_2_6DE81494
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_6DE992DC 3_2_6DE992DC
Sample file is different than original file name gathered from version info
Source: 0WzJdqE4Rw.dll Binary or memory string: OriginalFilenameofl.dllN vs 0WzJdqE4Rw.dll
Uses 32bit PE files
Source: 0WzJdqE4Rw.dll Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
Source: classification engine Classification label: mal84.bank.troj.evad.winDLL@5/0@0/3
Source: 0WzJdqE4Rw.dll Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Windows\System32\loaddll32.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\0WzJdqE4Rw.dll',#1
Source: unknown Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\0WzJdqE4Rw.dll'
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\0WzJdqE4Rw.dll',#1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\0WzJdqE4Rw.dll',#1
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\0WzJdqE4Rw.dll',#1 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\0WzJdqE4Rw.dll',#1 Jump to behavior
Source: 0WzJdqE4Rw.dll Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: 0WzJdqE4Rw.dll Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: wntdll.pdbUGP source: rundll32.exe, 00000003.00000003.293075202.000000004B280000.00000004.00000001.sdmp
Source: Binary string: wntdll.pdb source: rundll32.exe, 00000003.00000003.293075202.000000004B280000.00000004.00000001.sdmp
Source: Binary string: Gsp.pdb source: loaddll32.exe, 00000001.00000002.234619804.000000006E11A000.00000002.00020000.sdmp, 0WzJdqE4Rw.dll

Data Obfuscation:

barindex
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_6E113A27 push ebp; ret 1_2_6E113A28
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_6E112F56 push ebp; retf 1_2_6E112F61
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_6DE8F744 push esi; mov dword ptr [esp], 00000000h 3_2_6DE8F745
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Tries to delay execution (extensive OutputDebugStringW loop)
Source: C:\Windows\SysWOW64\rundll32.exe Section loaded: OutputDebugStringW count: 691
Tries to detect sandboxes / dynamic malware analysis system (file name check)
Source: C:\Windows\SysWOW64\rundll32.exe Section loaded: \KnownDlls32\testapp.exe Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Section loaded: \KnownDlls32\self.exE Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Section loaded: \KnownDlls32\self.exE Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\rundll32.exe Window / User API: threadDelayed 691 Jump to behavior
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\SysWOW64\rundll32.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_6DE907CC GetTokenInformation,GetSystemInfo,GetTokenInformation, 3_2_6DE907CC

Anti Debugging:

barindex
Found potential dummy code loops (likely to delay analysis)
Source: C:\Windows\SysWOW64\rundll32.exe Process Stats: CPU usage > 90% for more than 60s
Checks if the current process is being debugged
Source: C:\Windows\System32\loaddll32.exe Process queried: DebugPort Jump to behavior
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_6DE86DC8 GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA, 3_2_6DE86DC8
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_6DE93060 RtlAddVectoredExceptionHandler, 3_2_6DE93060

HIPS / PFW / Operating System Protection Evasion:

barindex
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\0WzJdqE4Rw.dll',#1 Jump to behavior
Source: rundll32.exe, 00000003.00000002.502741682.00000000031F0000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: rundll32.exe, 00000003.00000002.502741682.00000000031F0000.00000002.00000001.sdmp Binary or memory string: Progman
Source: rundll32.exe, 00000003.00000002.502741682.00000000031F0000.00000002.00000001.sdmp Binary or memory string: SProgram Managerl
Source: rundll32.exe, 00000003.00000002.502741682.00000000031F0000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd,
Source: rundll32.exe, 00000003.00000002.502741682.00000000031F0000.00000002.00000001.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

barindex
Contains functionality to query locales information (e.g. system language)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA, 3_2_6DE86DC8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_6DE86DC8 GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA, 3_2_6DE86DC8
Source: C:\Windows\SysWOW64\rundll32.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 392876 Sample: 0WzJdqE4Rw Startdate: 19/04/2021 Architecture: WINDOWS Score: 84 15 108.168.61.147 START-CA Canada 2->15 17 172.93.133.123 NEXEONUS United States 2->17 19 107.172.227.10 AS-COLOCROSSINGUS United States 2->19 21 Found malware configuration 2->21 23 Dridex dropper found 2->23 25 Yara detected Dridex unpacked file 2->25 27 2 other signatures 2->27 8 loaddll32.exe 1 2->8         started        signatures3 process4 process5 10 cmd.exe 1 8->10         started        process6 12 rundll32.exe 10->12         started        signatures7 29 Tries to detect sandboxes / dynamic malware analysis system (file name check) 12->29 31 Tries to delay execution (extensive OutputDebugStringW loop) 12->31 33 Found potential dummy code loops (likely to delay analysis) 12->33
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
172.93.133.123
 unknown United States
20278 NEXEONUS true
107.172.227.10
 unknown United States
36352 AS-COLOCROSSINGUS true
108.168.61.147
 unknown Canada
40788 START-CA true