Analysis Report gsG7jGFk3I.dll

Overview

General Information

Sample Name: gsG7jGFk3I.dll
Analysis ID: 392878
MD5: e8675c9ab1bb95547b902176997e37a1
SHA1: c088263ed0a68c8b9ffb092d41a53603ae25e69b
SHA256: 6934bf4b117408db966b2c8afc1adde7e8bbb2063b7a284727e44a28a6769bea
Tags: 40111Dridex
Infos:

Most interesting Screenshot:

Detection

Dridex Dropper
Score: 80
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Dridex dropper found
Found malware configuration
Yara detected Dridex unpacked file
C2 URLs / IPs found in malware configuration
Machine Learning detection for sample
Tries to delay execution (extensive OutputDebugStringW loop)
Tries to detect sandboxes / dynamic malware analysis system (file name check)
Abnormal high CPU Usage
Antivirus or Machine Learning detection for unpacked file
Contains functionality to call native functions
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to query locales information (e.g. system language)
Creates a DirectInput object (often for capturing keystrokes)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
One or more processes crash
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

AV Detection:

barindex
Found malware configuration
Source: 5.2.rundll32.exe.70990000.3.unpack Malware Configuration Extractor: Dridex {"Version": 40111, "C2 list": ["94.247.168.64:443", "159.203.93.122:8172", "50.116.27.97:2303"], "RC4 keys": ["VOw9c7u110XYjoFF2SzRWNcWNob7Sec1HxEVgBrFF", "5gZeCc8o5cQELWnF44Ik184W6MoZ25O98Rol7kPT2itFWvdxWiT70K4o4YnFUN4mL"]}
Machine Learning detection for sample
Source: gsG7jGFk3I.dll Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 4.2.rundll32.exe.3400000.2.unpack Avira: Label: TR/ATRAPS.Gen2
Source: 1.2.loaddll32.exe.1340000.1.unpack Avira: Label: TR/ATRAPS.Gen2
Source: 5.2.rundll32.exe.2b70000.2.unpack Avira: Label: TR/ATRAPS.Gen2

Compliance:

barindex
Uses 32bit PE files
Source: gsG7jGFk3I.dll Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
Source: gsG7jGFk3I.dll Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: opengl32.pdb source: WerFault.exe, 00000011.00000003.668390475.0000000004C17000.00000004.00000040.sdmp
Source: Binary string: wgdi32full.pdb source: WerFault.exe, 00000011.00000003.668272528.0000000004C14000.00000004.00000040.sdmp
Source: Binary string: wkernel32.pdb source: WerFault.exe, 00000011.00000003.668073327.0000000004A71000.00000004.00000001.sdmp
Source: Binary string: sechost.pdb source: WerFault.exe, 00000011.00000003.668073327.0000000004A71000.00000004.00000001.sdmp
Source: Binary string: ucrtbase.pdb source: WerFault.exe, 00000011.00000003.668073327.0000000004A71000.00000004.00000001.sdmp
Source: Binary string: wgdi32full.pdbk source: WerFault.exe, 00000011.00000003.668272528.0000000004C14000.00000004.00000040.sdmp
Source: Binary string: msvcrt.pdb source: WerFault.exe, 00000011.00000003.668390475.0000000004C17000.00000004.00000040.sdmp
Source: Binary string: wntdll.pdbUGP source: rundll32.exe, 00000004.00000003.399905591.000000004B280000.00000004.00000001.sdmp, rundll32.exe, 00000005.00000003.482441359.000000004B280000.00000004.00000001.sdmp
Source: Binary string: glu32.pdb source: WerFault.exe, 00000011.00000003.668390475.0000000004C17000.00000004.00000040.sdmp
Source: Binary string: wrpcrt4.pdb source: WerFault.exe, 00000011.00000003.668073327.0000000004A71000.00000004.00000001.sdmp
Source: Binary string: wntdll.pdb source: rundll32.exe, 00000004.00000003.399905591.000000004B280000.00000004.00000001.sdmp, rundll32.exe, 00000005.00000003.482441359.000000004B280000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.668073327.0000000004A71000.00000004.00000001.sdmp
Source: Binary string: ole32.pdb source: WerFault.exe, 00000011.00000003.668073327.0000000004A71000.00000004.00000001.sdmp
Source: Binary string: wgdi32.pdb source: WerFault.exe, 00000011.00000003.668073327.0000000004A71000.00000004.00000001.sdmp
Source: Binary string: advapi32.pdb source: WerFault.exe, 00000011.00000003.668390475.0000000004C17000.00000004.00000040.sdmp
Source: Binary string: wsspicli.pdb source: WerFault.exe, 00000011.00000003.668073327.0000000004A71000.00000004.00000001.sdmp
Source: Binary string: pCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernel32.pdb source: WerFault.exe, 00000011.00000002.673373971.0000000000312000.00000004.00000010.sdmp
Source: Binary string: fffp4.pdb source: WerFault.exe, 00000011.00000003.668073327.0000000004A71000.00000004.00000001.sdmp, gsG7jGFk3I.dll
Source: Binary string: msvcp_win.pdb source: WerFault.exe, 00000011.00000003.668262974.0000000004C10000.00000004.00000040.sdmp
Source: Binary string: cryptbase.pdb source: WerFault.exe, 00000011.00000003.668073327.0000000004A71000.00000004.00000001.sdmp
Source: Binary string: wimm32.pdb source: WerFault.exe, 00000011.00000003.668390475.0000000004C17000.00000004.00000040.sdmp
Source: Binary string: wkernelbase.pdb source: WerFault.exe, 00000011.00000003.668073327.0000000004A71000.00000004.00000001.sdmp
Source: Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000011.00000003.668073327.0000000004A71000.00000004.00000001.sdmp
Source: Binary string: wwin32u.pdb source: WerFault.exe, 00000011.00000003.668262974.0000000004C10000.00000004.00000040.sdmp
Source: Binary string: combase.pdb source: WerFault.exe, 00000011.00000003.668073327.0000000004A71000.00000004.00000001.sdmp
Source: Binary string: apphelp.pdb source: WerFault.exe, 00000011.00000003.668073327.0000000004A71000.00000004.00000001.sdmp
Source: Binary string: wuser32.pdb source: WerFault.exe, 00000011.00000003.668262974.0000000004C10000.00000004.00000040.sdmp
Source: Binary string: wntdll.pdbk source: WerFault.exe, 00000011.00000003.668073327.0000000004A71000.00000004.00000001.sdmp

Networking:

barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor IPs: 94.247.168.64:443
Source: Malware configuration extractor IPs: 159.203.93.122:8172
Source: Malware configuration extractor IPs: 50.116.27.97:2303
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 159.203.93.122 159.203.93.122
Source: Joe Sandbox View IP Address: 50.116.27.97 50.116.27.97
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: DIGITALOCEAN-ASNUS DIGITALOCEAN-ASNUS
Source: Joe Sandbox View ASN Name: LINODE-APLinodeLLCUS LINODE-APLinodeLLCUS
Source: gsG7jGFk3I.dll String found in binary or memory: http://ansicon.adoxa.vze.com/6

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Creates a DirectInput object (often for capturing keystrokes)
Source: loaddll32.exe, 00000001.00000002.674968916.000000000100B000.00000004.00000020.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

barindex
Dridex dropper found
Source: Initial file Signature Results: Dridex dropper behavior
Yara detected Dridex unpacked file
Source: Yara match File source: 00000004.00000002.727110793.0000000070991000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.731206769.0000000070991000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match File source: 5.2.rundll32.exe.70990000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.rundll32.exe.70990000.3.unpack, type: UNPACKEDPE

System Summary:

barindex
Abnormal high CPU Usage
Source: C:\Windows\SysWOW64\rundll32.exe Process Stats: CPU usage > 98%
Contains functionality to call native functions
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_709A218C NtDelayExecution, 4_2_709A218C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_709A2790 NtAllocateVirtualMemory, 4_2_709A2790
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_7099BC00 NtClose, 4_2_7099BC00
Detected potential crypto function
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_70991494 4_2_70991494
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_709A07CC 4_2_709A07CC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_709A14D8 4_2_709A14D8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_709984E4 4_2_709984E4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_7099A5A4 4_2_7099A5A4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_70999144 4_2_70999144
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_709A92DC 4_2_709A92DC
One or more processes crash
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6856 -s 420
Sample file is different than original file name gathered from version info
Source: gsG7jGFk3I.dll Binary or memory string: OriginalFilenameANSI32.dll0 vs gsG7jGFk3I.dll
Uses 32bit PE files
Source: gsG7jGFk3I.dll Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
Source: gsG7jGFk3I.dll Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: classification engine Classification label: mal80.bank.troj.evad.winDLL@8/4@0/3
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6856
Source: C:\Windows\SysWOW64\WerFault.exe File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WER2679.tmp Jump to behavior
Source: gsG7jGFk3I.dll Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Windows\System32\loaddll32.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\gsG7jGFk3I.dll',#1
Source: unknown Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\gsG7jGFk3I.dll'
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\gsG7jGFk3I.dll',#1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\gsG7jGFk3I.dll',#1
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\gsG7jGFk3I.dll',ReadLogRecord
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6856 -s 420
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\gsG7jGFk3I.dll',#1 Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\gsG7jGFk3I.dll',ReadLogRecord Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\gsG7jGFk3I.dll',#1 Jump to behavior
Source: gsG7jGFk3I.dll Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: gsG7jGFk3I.dll Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: opengl32.pdb source: WerFault.exe, 00000011.00000003.668390475.0000000004C17000.00000004.00000040.sdmp
Source: Binary string: wgdi32full.pdb source: WerFault.exe, 00000011.00000003.668272528.0000000004C14000.00000004.00000040.sdmp
Source: Binary string: wkernel32.pdb source: WerFault.exe, 00000011.00000003.668073327.0000000004A71000.00000004.00000001.sdmp
Source: Binary string: sechost.pdb source: WerFault.exe, 00000011.00000003.668073327.0000000004A71000.00000004.00000001.sdmp
Source: Binary string: ucrtbase.pdb source: WerFault.exe, 00000011.00000003.668073327.0000000004A71000.00000004.00000001.sdmp
Source: Binary string: wgdi32full.pdbk source: WerFault.exe, 00000011.00000003.668272528.0000000004C14000.00000004.00000040.sdmp
Source: Binary string: msvcrt.pdb source: WerFault.exe, 00000011.00000003.668390475.0000000004C17000.00000004.00000040.sdmp
Source: Binary string: wntdll.pdbUGP source: rundll32.exe, 00000004.00000003.399905591.000000004B280000.00000004.00000001.sdmp, rundll32.exe, 00000005.00000003.482441359.000000004B280000.00000004.00000001.sdmp
Source: Binary string: glu32.pdb source: WerFault.exe, 00000011.00000003.668390475.0000000004C17000.00000004.00000040.sdmp
Source: Binary string: wrpcrt4.pdb source: WerFault.exe, 00000011.00000003.668073327.0000000004A71000.00000004.00000001.sdmp
Source: Binary string: wntdll.pdb source: rundll32.exe, 00000004.00000003.399905591.000000004B280000.00000004.00000001.sdmp, rundll32.exe, 00000005.00000003.482441359.000000004B280000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.668073327.0000000004A71000.00000004.00000001.sdmp
Source: Binary string: ole32.pdb source: WerFault.exe, 00000011.00000003.668073327.0000000004A71000.00000004.00000001.sdmp
Source: Binary string: wgdi32.pdb source: WerFault.exe, 00000011.00000003.668073327.0000000004A71000.00000004.00000001.sdmp
Source: Binary string: advapi32.pdb source: WerFault.exe, 00000011.00000003.668390475.0000000004C17000.00000004.00000040.sdmp
Source: Binary string: wsspicli.pdb source: WerFault.exe, 00000011.00000003.668073327.0000000004A71000.00000004.00000001.sdmp
Source: Binary string: pCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernel32.pdb source: WerFault.exe, 00000011.00000002.673373971.0000000000312000.00000004.00000010.sdmp
Source: Binary string: fffp4.pdb source: WerFault.exe, 00000011.00000003.668073327.0000000004A71000.00000004.00000001.sdmp, gsG7jGFk3I.dll
Source: Binary string: msvcp_win.pdb source: WerFault.exe, 00000011.00000003.668262974.0000000004C10000.00000004.00000040.sdmp
Source: Binary string: cryptbase.pdb source: WerFault.exe, 00000011.00000003.668073327.0000000004A71000.00000004.00000001.sdmp
Source: Binary string: wimm32.pdb source: WerFault.exe, 00000011.00000003.668390475.0000000004C17000.00000004.00000040.sdmp
Source: Binary string: wkernelbase.pdb source: WerFault.exe, 00000011.00000003.668073327.0000000004A71000.00000004.00000001.sdmp
Source: Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000011.00000003.668073327.0000000004A71000.00000004.00000001.sdmp
Source: Binary string: wwin32u.pdb source: WerFault.exe, 00000011.00000003.668262974.0000000004C10000.00000004.00000040.sdmp
Source: Binary string: combase.pdb source: WerFault.exe, 00000011.00000003.668073327.0000000004A71000.00000004.00000001.sdmp
Source: Binary string: apphelp.pdb source: WerFault.exe, 00000011.00000003.668073327.0000000004A71000.00000004.00000001.sdmp
Source: Binary string: wuser32.pdb source: WerFault.exe, 00000011.00000003.668262974.0000000004C10000.00000004.00000040.sdmp
Source: Binary string: wntdll.pdbk source: WerFault.exe, 00000011.00000003.668073327.0000000004A71000.00000004.00000001.sdmp

Data Obfuscation:

barindex
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_7099F744 push esi; mov dword ptr [esp], 00000000h 4_2_7099F745
Source: initial sample Static PE information: section name: .text entropy: 7.55877156847
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Tries to delay execution (extensive OutputDebugStringW loop)
Source: C:\Windows\SysWOW64\rundll32.exe Section loaded: OutputDebugStringW count: 1487
Tries to detect sandboxes / dynamic malware analysis system (file name check)
Source: C:\Windows\System32\loaddll32.exe Section loaded: \KnownDlls32\testapp.exe Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Section loaded: \KnownDlls32\testapp.exe Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Section loaded: \KnownDlls32\testapp.exe Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\rundll32.exe Window / User API: threadDelayed 853 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Window / User API: threadDelayed 632 Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\SysWOW64\rundll32.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_709A07CC GetTokenInformation,GetSystemInfo,GetTokenInformation, 4_2_709A07CC
Source: C:\Windows\System32\loaddll32.exe Thread delayed: delay time: 120000 Jump to behavior
Source: WerFault.exe, 00000011.00000002.674304167.00000000047D0000.00000002.00000001.sdmp Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: WerFault.exe, 00000011.00000002.674304167.00000000047D0000.00000002.00000001.sdmp Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: WerFault.exe, 00000011.00000002.674304167.00000000047D0000.00000002.00000001.sdmp Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: WerFault.exe, 00000011.00000002.674304167.00000000047D0000.00000002.00000001.sdmp Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Anti Debugging:

barindex
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_70996DC8 GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA, 4_2_70996DC8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_709A3060 RtlAddVectoredExceptionHandler, 4_2_709A3060

HIPS / PFW / Operating System Protection Evasion:

barindex
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\gsG7jGFk3I.dll',#1 Jump to behavior
Source: rundll32.exe, 00000004.00000002.726564929.00000000039C0000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.729355579.0000000002FA0000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: rundll32.exe, 00000004.00000002.726564929.00000000039C0000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.729355579.0000000002FA0000.00000002.00000001.sdmp Binary or memory string: Progman
Source: rundll32.exe, 00000004.00000002.726564929.00000000039C0000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.729355579.0000000002FA0000.00000002.00000001.sdmp Binary or memory string: &Program Manager
Source: rundll32.exe, 00000004.00000002.726564929.00000000039C0000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.729355579.0000000002FA0000.00000002.00000001.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

barindex
Contains functionality to query locales information (e.g. system language)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA, 4_2_70996DC8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_70996DC8 GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA, 4_2_70996DC8
Source: C:\Windows\SysWOW64\rundll32.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 392878 Sample: gsG7jGFk3I.dll Startdate: 19/04/2021 Architecture: WINDOWS Score: 80 21 50.116.27.97 LINODE-APLinodeLLCUS United States 2->21 23 94.247.168.64 GLESYS-ASSE Sweden 2->23 25 159.203.93.122 DIGITALOCEAN-ASNUS United States 2->25 31 Found malware configuration 2->31 33 Dridex dropper found 2->33 35 Yara detected Dridex unpacked file 2->35 37 2 other signatures 2->37 8 loaddll32.exe 1 2->8         started        signatures3 process4 signatures5 39 Tries to detect sandboxes / dynamic malware analysis system (file name check) 8->39 11 cmd.exe 1 8->11         started        13 rundll32.exe 8->13         started        16 WerFault.exe 3 9 8->16         started        process6 signatures7 18 rundll32.exe 11->18         started        41 Tries to detect sandboxes / dynamic malware analysis system (file name check) 13->41 process8 signatures9 27 Tries to detect sandboxes / dynamic malware analysis system (file name check) 18->27 29 Tries to delay execution (extensive OutputDebugStringW loop) 18->29
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
159.203.93.122
 unknown United States
14061 DIGITALOCEAN-ASNUS true
50.116.27.97
 unknown United States
63949 LINODE-APLinodeLLCUS true
94.247.168.64
 unknown Sweden
43948 GLESYS-ASSE true