Analysis Report RuRxpMUPN7

Overview

General Information

Sample Name: RuRxpMUPN7 (renamed file extension from none to dll)
Analysis ID: 392882
MD5: f6a73ad1c962b6d3d979066d37da71b5
SHA1: c19b72b1b07a8065f2a62be97cb1cccfb1d5b93f
SHA256: 8d357ea7f4cbfcbbd9af86a34c421b7011204c83efa788b2527a79f9c464f287
Tags: 40111Dridex
Infos:

Most interesting Screenshot:

Detection

Dridex Dropper
Score: 80
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Dridex dropper found
Found malware configuration
Yara detected Dridex unpacked file
C2 URLs / IPs found in malware configuration
Machine Learning detection for sample
Tries to delay execution (extensive OutputDebugStringW loop)
Tries to detect sandboxes / dynamic malware analysis system (file name check)
Abnormal high CPU Usage
Antivirus or Machine Learning detection for unpacked file
Contains functionality to call native functions
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to query locales information (e.g. system language)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
One or more processes crash
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

AV Detection:

barindex
Found malware configuration
Source: 3.2.rundll32.exe.72ad0000.3.unpack Malware Configuration Extractor: Dridex {"Version": 40111, "C2 list": ["94.247.168.64:443", "159.203.93.122:8172", "50.116.27.97:2303"], "RC4 keys": ["VOw9c7u110XYjoFF2SzRWNcWNob7Sec1HxEVgBrFF", "5gZeCc8o5cQELWnF44Ik184W6MoZ25O98Rol7kPT2itFWvdxWiT70K4o4YnFUN4mL"]}
Machine Learning detection for sample
Source: RuRxpMUPN7.dll Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 3.2.rundll32.exe.2fa0000.2.unpack Avira: Label: TR/ATRAPS.Gen2
Source: 8.2.rundll32.exe.2b90000.2.unpack Avira: Label: TR/ATRAPS.Gen2
Source: 1.2.loaddll32.exe.640000.1.unpack Avira: Label: TR/ATRAPS.Gen2

Compliance:

barindex
Uses 32bit PE files
Source: RuRxpMUPN7.dll Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
Source: RuRxpMUPN7.dll Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: opengl32.pdb source: WerFault.exe, 0000000B.00000003.350591843.0000000004B08000.00000004.00000040.sdmp
Source: Binary string: wgdi32full.pdb source: WerFault.exe, 0000000B.00000003.350557586.0000000004B02000.00000004.00000040.sdmp
Source: Binary string: wkernel32.pdb source: WerFault.exe, 0000000B.00000003.339834810.00000000008B3000.00000004.00000001.sdmp
Source: Binary string: sechost.pdb source: WerFault.exe, 0000000B.00000003.350557586.0000000004B02000.00000004.00000040.sdmp
Source: Binary string: ucrtbase.pdb source: WerFault.exe, 0000000B.00000003.350553195.0000000004B31000.00000004.00000001.sdmp
Source: Binary string: wgdi32full.pdbk source: WerFault.exe, 0000000B.00000003.350557586.0000000004B02000.00000004.00000040.sdmp
Source: Binary string: msvcrt.pdb source: WerFault.exe, 0000000B.00000003.350591843.0000000004B08000.00000004.00000040.sdmp
Source: Binary string: wntdll.pdbUGP source: rundll32.exe, 00000003.00000003.331405195.000000004B280000.00000004.00000001.sdmp, rundll32.exe, 00000008.00000003.406325341.000000004B280000.00000004.00000001.sdmp
Source: Binary string: glu32.pdb source: WerFault.exe, 0000000B.00000003.350591843.0000000004B08000.00000004.00000040.sdmp
Source: Binary string: wrpcrt4.pdb source: WerFault.exe, 0000000B.00000003.350553195.0000000004B31000.00000004.00000001.sdmp
Source: Binary string: wntdll.pdb source: rundll32.exe, 00000003.00000003.331405195.000000004B280000.00000004.00000001.sdmp, rundll32.exe, 00000008.00000003.406325341.000000004B280000.00000004.00000001.sdmp, WerFault.exe, 0000000B.00000003.339825322.00000000008AD000.00000004.00000001.sdmp
Source: Binary string: opengl32.pdbj source: WerFault.exe, 0000000B.00000003.350591843.0000000004B08000.00000004.00000040.sdmp
Source: Binary string: ole32.pdb source: WerFault.exe, 0000000B.00000003.350553195.0000000004B31000.00000004.00000001.sdmp
Source: Binary string: wgdi32.pdb source: WerFault.exe, 0000000B.00000003.350557586.0000000004B02000.00000004.00000040.sdmp
Source: Binary string: advapi32.pdb source: WerFault.exe, 0000000B.00000003.350591843.0000000004B08000.00000004.00000040.sdmp
Source: Binary string: wsspicli.pdb source: WerFault.exe, 0000000B.00000003.350553195.0000000004B31000.00000004.00000001.sdmp
Source: Binary string: fffp4.pdb source: WerFault.exe, 0000000B.00000003.350553195.0000000004B31000.00000004.00000001.sdmp, RuRxpMUPN7.dll
Source: Binary string: msvcp_win.pdb source: WerFault.exe, 0000000B.00000003.350581972.0000000004B00000.00000004.00000040.sdmp
Source: Binary string: wgdi32.pdbk source: WerFault.exe, 0000000B.00000003.350557586.0000000004B02000.00000004.00000040.sdmp
Source: Binary string: cryptbase.pdb source: WerFault.exe, 0000000B.00000003.350553195.0000000004B31000.00000004.00000001.sdmp
Source: Binary string: sechost.pdbk source: WerFault.exe, 0000000B.00000003.350557586.0000000004B02000.00000004.00000040.sdmp
Source: Binary string: wimm32.pdb source: WerFault.exe, 0000000B.00000003.350591843.0000000004B08000.00000004.00000040.sdmp
Source: Binary string: wkernelbase.pdb source: WerFault.exe, 0000000B.00000003.350553195.0000000004B31000.00000004.00000001.sdmp
Source: Binary string: bcryptprimitives.pdb source: WerFault.exe, 0000000B.00000003.350553195.0000000004B31000.00000004.00000001.sdmp
Source: Binary string: wkernelbase.pdb( source: WerFault.exe, 0000000B.00000003.339850217.00000000008B9000.00000004.00000001.sdmp
Source: Binary string: msvcrt.pdbT source: WerFault.exe, 0000000B.00000003.350591843.0000000004B08000.00000004.00000040.sdmp
Source: Binary string: combase.pdb source: WerFault.exe, 0000000B.00000003.350553195.0000000004B31000.00000004.00000001.sdmp
Source: Binary string: wwin32u.pdb source: WerFault.exe, 0000000B.00000003.350581972.0000000004B00000.00000004.00000040.sdmp
Source: Binary string: azojr}oCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernel32.pdb source: WerFault.exe, 0000000B.00000002.372783936.0000000000332000.00000004.00000010.sdmp
Source: Binary string: wkernel32.pdb( source: WerFault.exe, 0000000B.00000003.339834810.00000000008B3000.00000004.00000001.sdmp
Source: Binary string: apphelp.pdb source: WerFault.exe, 0000000B.00000003.350553195.0000000004B31000.00000004.00000001.sdmp
Source: Binary string: wuser32.pdb source: WerFault.exe, 0000000B.00000003.350581972.0000000004B00000.00000004.00000040.sdmp
Source: Binary string: wntdll.pdb( source: WerFault.exe, 0000000B.00000003.339825322.00000000008AD000.00000004.00000001.sdmp

Networking:

barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor IPs: 94.247.168.64:443
Source: Malware configuration extractor IPs: 159.203.93.122:8172
Source: Malware configuration extractor IPs: 50.116.27.97:2303
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 159.203.93.122 159.203.93.122
Source: Joe Sandbox View IP Address: 50.116.27.97 50.116.27.97
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: DIGITALOCEAN-ASNUS DIGITALOCEAN-ASNUS
Source: Joe Sandbox View ASN Name: LINODE-APLinodeLLCUS LINODE-APLinodeLLCUS
Source: RuRxpMUPN7.dll String found in binary or memory: http://ansicon.adoxa.vze.com/6

E-Banking Fraud:

barindex
Dridex dropper found
Source: Initial file Signature Results: Dridex dropper behavior
Yara detected Dridex unpacked file
Source: Yara match File source: 00000003.00000002.513214824.0000000072AD1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.511726396.0000000072AD1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match File source: 3.2.rundll32.exe.72ad0000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.72ad0000.3.unpack, type: UNPACKEDPE

System Summary:

barindex
Abnormal high CPU Usage
Source: C:\Windows\SysWOW64\rundll32.exe Process Stats: CPU usage > 98%
Contains functionality to call native functions
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_72AE2790 NtAllocateVirtualMemory, 3_2_72AE2790
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_72AE218C NtDelayExecution, 3_2_72AE218C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_72ADBC00 NtClose, 3_2_72ADBC00
Detected potential crypto function
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_72AE07CC 3_2_72AE07CC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_72AD1494 3_2_72AD1494
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_72AE92DC 3_2_72AE92DC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_72AD84E4 3_2_72AD84E4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_72AE14D8 3_2_72AE14D8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_72ADA5A4 3_2_72ADA5A4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_72AD9144 3_2_72AD9144
One or more processes crash
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1416 -s 440
Sample file is different than original file name gathered from version info
Source: RuRxpMUPN7.dll Binary or memory string: OriginalFilenameANSI32.dll0 vs RuRxpMUPN7.dll
Uses 32bit PE files
Source: RuRxpMUPN7.dll Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
Source: RuRxpMUPN7.dll Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: classification engine Classification label: mal80.bank.troj.evad.winDLL@8/4@0/3
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1416
Source: C:\Windows\SysWOW64\WerFault.exe File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WER2B47.tmp Jump to behavior
Source: RuRxpMUPN7.dll Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Windows\System32\loaddll32.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\RuRxpMUPN7.dll',#1
Source: unknown Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\RuRxpMUPN7.dll'
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\RuRxpMUPN7.dll',#1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\RuRxpMUPN7.dll',#1
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\RuRxpMUPN7.dll',ReadLogRecord
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1416 -s 440
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\RuRxpMUPN7.dll',#1 Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\RuRxpMUPN7.dll',ReadLogRecord Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\RuRxpMUPN7.dll',#1 Jump to behavior
Source: RuRxpMUPN7.dll Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: RuRxpMUPN7.dll Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: opengl32.pdb source: WerFault.exe, 0000000B.00000003.350591843.0000000004B08000.00000004.00000040.sdmp
Source: Binary string: wgdi32full.pdb source: WerFault.exe, 0000000B.00000003.350557586.0000000004B02000.00000004.00000040.sdmp
Source: Binary string: wkernel32.pdb source: WerFault.exe, 0000000B.00000003.339834810.00000000008B3000.00000004.00000001.sdmp
Source: Binary string: sechost.pdb source: WerFault.exe, 0000000B.00000003.350557586.0000000004B02000.00000004.00000040.sdmp
Source: Binary string: ucrtbase.pdb source: WerFault.exe, 0000000B.00000003.350553195.0000000004B31000.00000004.00000001.sdmp
Source: Binary string: wgdi32full.pdbk source: WerFault.exe, 0000000B.00000003.350557586.0000000004B02000.00000004.00000040.sdmp
Source: Binary string: msvcrt.pdb source: WerFault.exe, 0000000B.00000003.350591843.0000000004B08000.00000004.00000040.sdmp
Source: Binary string: wntdll.pdbUGP source: rundll32.exe, 00000003.00000003.331405195.000000004B280000.00000004.00000001.sdmp, rundll32.exe, 00000008.00000003.406325341.000000004B280000.00000004.00000001.sdmp
Source: Binary string: glu32.pdb source: WerFault.exe, 0000000B.00000003.350591843.0000000004B08000.00000004.00000040.sdmp
Source: Binary string: wrpcrt4.pdb source: WerFault.exe, 0000000B.00000003.350553195.0000000004B31000.00000004.00000001.sdmp
Source: Binary string: wntdll.pdb source: rundll32.exe, 00000003.00000003.331405195.000000004B280000.00000004.00000001.sdmp, rundll32.exe, 00000008.00000003.406325341.000000004B280000.00000004.00000001.sdmp, WerFault.exe, 0000000B.00000003.339825322.00000000008AD000.00000004.00000001.sdmp
Source: Binary string: opengl32.pdbj source: WerFault.exe, 0000000B.00000003.350591843.0000000004B08000.00000004.00000040.sdmp
Source: Binary string: ole32.pdb source: WerFault.exe, 0000000B.00000003.350553195.0000000004B31000.00000004.00000001.sdmp
Source: Binary string: wgdi32.pdb source: WerFault.exe, 0000000B.00000003.350557586.0000000004B02000.00000004.00000040.sdmp
Source: Binary string: advapi32.pdb source: WerFault.exe, 0000000B.00000003.350591843.0000000004B08000.00000004.00000040.sdmp
Source: Binary string: wsspicli.pdb source: WerFault.exe, 0000000B.00000003.350553195.0000000004B31000.00000004.00000001.sdmp
Source: Binary string: fffp4.pdb source: WerFault.exe, 0000000B.00000003.350553195.0000000004B31000.00000004.00000001.sdmp, RuRxpMUPN7.dll
Source: Binary string: msvcp_win.pdb source: WerFault.exe, 0000000B.00000003.350581972.0000000004B00000.00000004.00000040.sdmp
Source: Binary string: wgdi32.pdbk source: WerFault.exe, 0000000B.00000003.350557586.0000000004B02000.00000004.00000040.sdmp
Source: Binary string: cryptbase.pdb source: WerFault.exe, 0000000B.00000003.350553195.0000000004B31000.00000004.00000001.sdmp
Source: Binary string: sechost.pdbk source: WerFault.exe, 0000000B.00000003.350557586.0000000004B02000.00000004.00000040.sdmp
Source: Binary string: wimm32.pdb source: WerFault.exe, 0000000B.00000003.350591843.0000000004B08000.00000004.00000040.sdmp
Source: Binary string: wkernelbase.pdb source: WerFault.exe, 0000000B.00000003.350553195.0000000004B31000.00000004.00000001.sdmp
Source: Binary string: bcryptprimitives.pdb source: WerFault.exe, 0000000B.00000003.350553195.0000000004B31000.00000004.00000001.sdmp
Source: Binary string: wkernelbase.pdb( source: WerFault.exe, 0000000B.00000003.339850217.00000000008B9000.00000004.00000001.sdmp
Source: Binary string: msvcrt.pdbT source: WerFault.exe, 0000000B.00000003.350591843.0000000004B08000.00000004.00000040.sdmp
Source: Binary string: combase.pdb source: WerFault.exe, 0000000B.00000003.350553195.0000000004B31000.00000004.00000001.sdmp
Source: Binary string: wwin32u.pdb source: WerFault.exe, 0000000B.00000003.350581972.0000000004B00000.00000004.00000040.sdmp
Source: Binary string: azojr}oCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernel32.pdb source: WerFault.exe, 0000000B.00000002.372783936.0000000000332000.00000004.00000010.sdmp
Source: Binary string: wkernel32.pdb( source: WerFault.exe, 0000000B.00000003.339834810.00000000008B3000.00000004.00000001.sdmp
Source: Binary string: apphelp.pdb source: WerFault.exe, 0000000B.00000003.350553195.0000000004B31000.00000004.00000001.sdmp
Source: Binary string: wuser32.pdb source: WerFault.exe, 0000000B.00000003.350581972.0000000004B00000.00000004.00000040.sdmp
Source: Binary string: wntdll.pdb( source: WerFault.exe, 0000000B.00000003.339825322.00000000008AD000.00000004.00000001.sdmp

Data Obfuscation:

barindex
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_72ADF744 push esi; mov dword ptr [esp], 00000000h 3_2_72ADF745
Source: initial sample Static PE information: section name: .text entropy: 7.55877156847
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Tries to delay execution (extensive OutputDebugStringW loop)
Source: C:\Windows\SysWOW64\rundll32.exe Section loaded: OutputDebugStringW count: 708
Tries to detect sandboxes / dynamic malware analysis system (file name check)
Source: C:\Windows\System32\loaddll32.exe Section loaded: \KnownDlls32\testapp.exe Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Section loaded: \KnownDlls32\testapp.exe Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Section loaded: \KnownDlls32\testapp.exe Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\rundll32.exe Window / User API: threadDelayed 459 Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\SysWOW64\rundll32.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_72AE07CC GetTokenInformation,GetSystemInfo,GetTokenInformation, 3_2_72AE07CC
Source: C:\Windows\System32\loaddll32.exe Thread delayed: delay time: 120000 Jump to behavior
Source: WerFault.exe, 0000000B.00000002.373860434.00000000047F0000.00000002.00000001.sdmp Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: WerFault.exe, 0000000B.00000002.373860434.00000000047F0000.00000002.00000001.sdmp Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: WerFault.exe, 0000000B.00000002.373860434.00000000047F0000.00000002.00000001.sdmp Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: WerFault.exe, 0000000B.00000002.373860434.00000000047F0000.00000002.00000001.sdmp Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Anti Debugging:

barindex
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_72AD6DC8 GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA, 3_2_72AD6DC8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_72AE3060 RtlAddVectoredExceptionHandler, 3_2_72AE3060

HIPS / PFW / Operating System Protection Evasion:

barindex
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\RuRxpMUPN7.dll',#1 Jump to behavior
Source: rundll32.exe, 00000003.00000002.511797018.0000000003620000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.509492989.0000000003080000.00000002.00000001.sdmp Binary or memory string: uProgram Manager
Source: rundll32.exe, 00000003.00000002.511797018.0000000003620000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.509492989.0000000003080000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: rundll32.exe, 00000003.00000002.511797018.0000000003620000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.509492989.0000000003080000.00000002.00000001.sdmp Binary or memory string: Progman
Source: rundll32.exe, 00000003.00000002.511797018.0000000003620000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.509492989.0000000003080000.00000002.00000001.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

barindex
Contains functionality to query locales information (e.g. system language)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA, 3_2_72AD6DC8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_72AD6DC8 GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA, 3_2_72AD6DC8
Source: C:\Windows\SysWOW64\rundll32.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 392882 Sample: RuRxpMUPN7 Startdate: 19/04/2021 Architecture: WINDOWS Score: 80 21 50.116.27.97 LINODE-APLinodeLLCUS United States 2->21 23 94.247.168.64 GLESYS-ASSE Sweden 2->23 25 159.203.93.122 DIGITALOCEAN-ASNUS United States 2->25 31 Found malware configuration 2->31 33 Dridex dropper found 2->33 35 Yara detected Dridex unpacked file 2->35 37 2 other signatures 2->37 8 loaddll32.exe 1 2->8         started        signatures3 process4 signatures5 39 Tries to detect sandboxes / dynamic malware analysis system (file name check) 8->39 11 cmd.exe 1 8->11         started        13 rundll32.exe 8->13         started        16 WerFault.exe 3 9 8->16         started        process6 signatures7 18 rundll32.exe 11->18         started        41 Tries to detect sandboxes / dynamic malware analysis system (file name check) 13->41 process8 signatures9 27 Tries to detect sandboxes / dynamic malware analysis system (file name check) 18->27 29 Tries to delay execution (extensive OutputDebugStringW loop) 18->29
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
159.203.93.122
 unknown United States
14061 DIGITALOCEAN-ASNUS true
50.116.27.97
 unknown United States
63949 LINODE-APLinodeLLCUS true
94.247.168.64
 unknown Sweden
43948 GLESYS-ASSE true