Analysis Report CTkT1fRtQv.dll

Overview

General Information

Sample Name:	CTkT1fRtQv.dll
Analysis ID:	392884
MD5:	304c6fb5258a065507a5ea8625fbf120
SHA1:	386f11c61362582fb431758483579cef18094043
SHA256:	ab022d18682f942315316baa838852c3010df92e79f645b37c7afd2b85623b2b
Tags:	40111Dridex
Infos:
Most interesting Screenshot:

Detection

Dridex Dropper

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Dridex dropper found

Found malware configuration

Yara detected Dridex unpacked file

C2 URLs / IPs found in malware configuration

Machine Learning detection for sample

Tries to delay execution (extensive OutputDebugStringW loop)

Tries to detect sandboxes / dynamic malware analysis system (file name check)

Abnormal high CPU Usage

Antivirus or Machine Learning detection for unpacked file

Contains functionality to call native functions

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to query locales information (e.g. system language)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

One or more processes crash

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Signatures

AV Detection:

Found malware configuration

Source: 6.2.rundll32.exe.73310000.3.unpack

Malware Configuration Extractor: Dridex {"Version": 40111, "C2 list": ["94.247.168.64:443", "159.203.93.122:8172", "50.116.27.97:2303"], "RC4 keys": ["VOw9c7u110XYjoFF2SzRWNcWNob7Sec1HxEVgBrFF", "5gZeCc8o5cQELWnF44Ik184W6MoZ25O98Rol7kPT2itFWvdxWiT70K4o4YnFUN4mL"]}

Machine Learning detection for sample

Source: CTkT1fRtQv.dll

Joe Sandbox ML: detected

Antivirus or Machine Learning detection for unpacked file

Source: 0.2.loaddll32.exe.b90000.1.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 6.2.rundll32.exe.6d0000.2.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 2.2.rundll32.exe.2a30000.1.unpack	Avira: Label: TR/ATRAPS.Gen2

Compliance:

Uses 32bit PE files

Source: CTkT1fRtQv.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: CTkT1fRtQv.dll

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: opengl32.pdb source: WerFault.exe, 00000011.00000003.562170398.0000000005537000.00000004.00000040.sdmp
Source:	Binary string: msvcrt.pdb+ source: WerFault.exe, 00000011.00000003.562170398.0000000005537000.00000004.00000040.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000011.00000003.562166429.0000000005534000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000011.00000003.562127824.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 00000011.00000003.562127824.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000011.00000003.562127824.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: wgdi32full.pdbk source: WerFault.exe, 00000011.00000003.562166429.0000000005534000.00000004.00000040.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 00000011.00000003.562170398.0000000005537000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdbUGP source: rundll32.exe, 00000002.00000003.294950857.000000004B280000.00000004.00000001.sdmp, rundll32.exe, 00000006.00000003.356955165.000000004B280000.00000004.00000001.sdmp
Source:	Binary string: glu32.pdb source: WerFault.exe, 00000011.00000003.562170398.0000000005537000.00000004.00000040.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 00000011.00000003.562127824.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: rundll32.exe, 00000002.00000003.294950857.000000004B280000.00000004.00000001.sdmp, rundll32.exe, 00000006.00000003.356955165.000000004B280000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.562127824.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: ole32.pdb source: WerFault.exe, 00000011.00000003.562127824.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000011.00000003.562127824.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 00000011.00000003.562170398.0000000005537000.00000004.00000040.sdmp
Source:	Binary string: oCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernel32.pdb source: WerFault.exe, 00000011.00000002.567915828.0000000001032000.00000004.00000010.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 00000011.00000003.562127824.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: fffp4.pdb source: WerFault.exe, 00000011.00000003.562127824.0000000005561000.00000004.00000001.sdmp, CTkT1fRtQv.dll
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000011.00000003.562162414.0000000005530000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 00000011.00000003.562127824.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000011.00000003.562170398.0000000005537000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000011.00000003.562127824.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000011.00000003.562127824.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 00000011.00000003.562127824.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000011.00000003.562162414.0000000005530000.00000004.00000040.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000011.00000003.562127824.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000011.00000003.562162414.0000000005530000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdbk source: WerFault.exe, 00000011.00000003.562127824.0000000005561000.00000004.00000001.sdmp

Networking:

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	IPs: 94.247.168.64:443
Source: Malware configuration extractor	IPs: 159.203.93.122:8172
Source: Malware configuration extractor	IPs: 50.116.27.97:2303

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 159.203.93.122 159.203.93.122
Source: Joe Sandbox View	IP Address: 50.116.27.97 50.116.27.97
Source: Joe Sandbox View	IP Address: 94.247.168.64 94.247.168.64

Internet Provider seen in connection with other malware

Source: Joe Sandbox View	ASN Name: DIGITALOCEAN-ASNUS DIGITALOCEAN-ASNUS
Source: Joe Sandbox View	ASN Name: LINODE-APLinodeLLCUS LINODE-APLinodeLLCUS
Source: Joe Sandbox View	ASN Name: GLESYS-ASSE GLESYS-ASSE

Source: CTkT1fRtQv.dll

String found in binary or memory: http://ansicon.adoxa.vze.com/6

E-Banking Fraud:

Dridex dropper found

Source: Initial file

Signature Results: Dridex dropper behavior

Yara detected Dridex unpacked file

Source: Yara match	File source: 00000006.00000002.631275717.0000000073311000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.631853045.0000000073311000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 6.2.rundll32.exe.73310000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.73310000.3.unpack, type: UNPACKEDPE

System Summary:

Abnormal high CPU Usage

Source: C:\Windows\SysWOW64\rundll32.exe

Process Stats: CPU usage > 98%

Contains functionality to call native functions

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_73322790 NtAllocateVirtualMemory,	2_2_73322790
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_7332218C NtDelayExecution,	2_2_7332218C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_7331BC00 NtClose,	2_2_7331BC00

Detected potential crypto function

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_733207CC	2_2_733207CC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_73311494	2_2_73311494
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_733292DC	2_2_733292DC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_73319144	2_2_73319144
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_7331A5A4	2_2_7331A5A4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_733184E4	2_2_733184E4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_733214D8	2_2_733214D8

One or more processes crash

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1552 -s 420

Sample file is different than original file name gathered from version info

Source: CTkT1fRtQv.dll

Binary or memory string: OriginalFilenameANSI32.dll0 vs CTkT1fRtQv.dll

Uses 32bit PE files

Source: CTkT1fRtQv.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: CTkT1fRtQv.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal80.bank.troj.evad.winDLL@8/4@0/3

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1552

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WEREE7E.tmp

Jump to behavior

Source: CTkT1fRtQv.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\CTkT1fRtQv.dll',#1

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\CTkT1fRtQv.dll'
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\CTkT1fRtQv.dll',#1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\CTkT1fRtQv.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\CTkT1fRtQv.dll',ReadLogRecord
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1552 -s 420
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\CTkT1fRtQv.dll',#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\CTkT1fRtQv.dll',ReadLogRecord	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\CTkT1fRtQv.dll',#1	Jump to behavior

Source: CTkT1fRtQv.dll

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: CTkT1fRtQv.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: opengl32.pdb source: WerFault.exe, 00000011.00000003.562170398.0000000005537000.00000004.00000040.sdmp
Source:	Binary string: msvcrt.pdb+ source: WerFault.exe, 00000011.00000003.562170398.0000000005537000.00000004.00000040.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000011.00000003.562166429.0000000005534000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000011.00000003.562127824.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 00000011.00000003.562127824.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000011.00000003.562127824.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: wgdi32full.pdbk source: WerFault.exe, 00000011.00000003.562166429.0000000005534000.00000004.00000040.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 00000011.00000003.562170398.0000000005537000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdbUGP source: rundll32.exe, 00000002.00000003.294950857.000000004B280000.00000004.00000001.sdmp, rundll32.exe, 00000006.00000003.356955165.000000004B280000.00000004.00000001.sdmp
Source:	Binary string: glu32.pdb source: WerFault.exe, 00000011.00000003.562170398.0000000005537000.00000004.00000040.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 00000011.00000003.562127824.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: rundll32.exe, 00000002.00000003.294950857.000000004B280000.00000004.00000001.sdmp, rundll32.exe, 00000006.00000003.356955165.000000004B280000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.562127824.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: ole32.pdb source: WerFault.exe, 00000011.00000003.562127824.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000011.00000003.562127824.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 00000011.00000003.562170398.0000000005537000.00000004.00000040.sdmp
Source:	Binary string: oCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernel32.pdb source: WerFault.exe, 00000011.00000002.567915828.0000000001032000.00000004.00000010.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 00000011.00000003.562127824.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: fffp4.pdb source: WerFault.exe, 00000011.00000003.562127824.0000000005561000.00000004.00000001.sdmp, CTkT1fRtQv.dll
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000011.00000003.562162414.0000000005530000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 00000011.00000003.562127824.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000011.00000003.562170398.0000000005537000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000011.00000003.562127824.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000011.00000003.562127824.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 00000011.00000003.562127824.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000011.00000003.562162414.0000000005530000.00000004.00000040.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000011.00000003.562127824.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000011.00000003.562162414.0000000005530000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdbk source: WerFault.exe, 00000011.00000003.562127824.0000000005561000.00000004.00000001.sdmp

Data Obfuscation:

Uses code obfuscation techniques (call, push, ret)

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 2_2_7331F744 push esi; mov dword ptr [esp], 00000000h

2_2_7331F745

Source: initial sample

Static PE information: section name: .text entropy: 7.55877156847

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Tries to delay execution (extensive OutputDebugStringW loop)

Source: C:\Windows\SysWOW64\rundll32.exe

Section loaded: OutputDebugStringW count: 1943

Tries to detect sandboxes / dynamic malware analysis system (file name check)

Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\testapp.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Section loaded: \KnownDlls32\testapp.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Section loaded: \KnownDlls32\testapp.exe	Jump to behavior

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Windows\SysWOW64\rundll32.exe	Window / User API: threadDelayed 1076			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Window / User API: threadDelayed 866			Jump to behavior

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 2_2_733207CC GetTokenInformation,GetSystemInfo,GetTokenInformation,

2_2_733207CC

Source: C:\Windows\System32\loaddll32.exe

Thread delayed: delay time: 120000

Jump to behavior

Source: WerFault.exe, 00000011.00000002.569242042.00000000056C0000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: WerFault.exe, 00000011.00000002.569242042.00000000056C0000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: WerFault.exe, 00000011.00000002.569242042.00000000056C0000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: WerFault.exe, 00000011.00000002.569242042.00000000056C0000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Anti Debugging:

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 2_2_73316DC8 GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA,

2_2_73316DC8

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 2_2_73323060 RtlAddVectoredExceptionHandler,

2_2_73323060

HIPS / PFW / Operating System Protection Evasion:

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\CTkT1fRtQv.dll',#1

Jump to behavior

Source: rundll32.exe, 00000002.00000002.630359279.0000000002F20000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.630929010.0000000002FB0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: rundll32.exe, 00000002.00000002.630359279.0000000002F20000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.630929010.0000000002FB0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: rundll32.exe, 00000002.00000002.630359279.0000000002F20000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.630929010.0000000002FB0000.00000002.00000001.sdmp	Binary or memory string: SProgram Managerl
Source: rundll32.exe, 00000002.00000002.630359279.0000000002F20000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.630929010.0000000002FB0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd,
Source: rundll32.exe, 00000002.00000002.630359279.0000000002F20000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.630929010.0000000002FB0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Contains functionality to query locales information (e.g. system language)

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA,

2_2_73316DC8

Source: C:\Windows\SysWOW64\rundll32.exe

2_2_73316DC8

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
159.203.93.122	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
50.116.27.97	unknown	United States	63949	LINODE-APLinodeLLCUS	true
94.247.168.64	unknown	Sweden	43948	GLESYS-ASSE	true

AV Detection:

Found malware configuration

Source: 6.2.rundll32.exe.73310000.3.unpack

Machine Learning detection for sample

Source: CTkT1fRtQv.dll

Joe Sandbox ML: detected

Antivirus or Machine Learning detection for unpacked file

Source: 0.2.loaddll32.exe.b90000.1.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 6.2.rundll32.exe.6d0000.2.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 2.2.rundll32.exe.2a30000.1.unpack	Avira: Label: TR/ATRAPS.Gen2

Compliance:

Uses 32bit PE files

Source: CTkT1fRtQv.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: CTkT1fRtQv.dll

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: opengl32.pdb source: WerFault.exe, 00000011.00000003.562170398.0000000005537000.00000004.00000040.sdmp
Source:	Binary string: msvcrt.pdb+ source: WerFault.exe, 00000011.00000003.562170398.0000000005537000.00000004.00000040.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000011.00000003.562166429.0000000005534000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000011.00000003.562127824.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 00000011.00000003.562127824.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000011.00000003.562127824.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: wgdi32full.pdbk source: WerFault.exe, 00000011.00000003.562166429.0000000005534000.00000004.00000040.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 00000011.00000003.562170398.0000000005537000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdbUGP source: rundll32.exe, 00000002.00000003.294950857.000000004B280000.00000004.00000001.sdmp, rundll32.exe, 00000006.00000003.356955165.000000004B280000.00000004.00000001.sdmp
Source:	Binary string: glu32.pdb source: WerFault.exe, 00000011.00000003.562170398.0000000005537000.00000004.00000040.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 00000011.00000003.562127824.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: rundll32.exe, 00000002.00000003.294950857.000000004B280000.00000004.00000001.sdmp, rundll32.exe, 00000006.00000003.356955165.000000004B280000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.562127824.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: ole32.pdb source: WerFault.exe, 00000011.00000003.562127824.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000011.00000003.562127824.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 00000011.00000003.562170398.0000000005537000.00000004.00000040.sdmp
Source:	Binary string: oCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernel32.pdb source: WerFault.exe, 00000011.00000002.567915828.0000000001032000.00000004.00000010.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 00000011.00000003.562127824.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: fffp4.pdb source: WerFault.exe, 00000011.00000003.562127824.0000000005561000.00000004.00000001.sdmp, CTkT1fRtQv.dll
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000011.00000003.562162414.0000000005530000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 00000011.00000003.562127824.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000011.00000003.562170398.0000000005537000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000011.00000003.562127824.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000011.00000003.562127824.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 00000011.00000003.562127824.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000011.00000003.562162414.0000000005530000.00000004.00000040.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000011.00000003.562127824.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000011.00000003.562162414.0000000005530000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdbk source: WerFault.exe, 00000011.00000003.562127824.0000000005561000.00000004.00000001.sdmp

Networking:

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	IPs: 94.247.168.64:443
Source: Malware configuration extractor	IPs: 159.203.93.122:8172
Source: Malware configuration extractor	IPs: 50.116.27.97:2303

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 159.203.93.122 159.203.93.122
Source: Joe Sandbox View	IP Address: 50.116.27.97 50.116.27.97
Source: Joe Sandbox View	IP Address: 94.247.168.64 94.247.168.64

Internet Provider seen in connection with other malware

Source: Joe Sandbox View	ASN Name: DIGITALOCEAN-ASNUS DIGITALOCEAN-ASNUS
Source: Joe Sandbox View	ASN Name: LINODE-APLinodeLLCUS LINODE-APLinodeLLCUS
Source: Joe Sandbox View	ASN Name: GLESYS-ASSE GLESYS-ASSE

Source: CTkT1fRtQv.dll

String found in binary or memory: http://ansicon.adoxa.vze.com/6

E-Banking Fraud:

Dridex dropper found

Source: Initial file

Signature Results: Dridex dropper behavior

Yara detected Dridex unpacked file

Source: Yara match	File source: 00000006.00000002.631275717.0000000073311000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.631853045.0000000073311000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 6.2.rundll32.exe.73310000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.73310000.3.unpack, type: UNPACKEDPE

System Summary:

Abnormal high CPU Usage

Source: C:\Windows\SysWOW64\rundll32.exe

Process Stats: CPU usage > 98%

Contains functionality to call native functions

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_73322790 NtAllocateVirtualMemory,	2_2_73322790
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_7332218C NtDelayExecution,	2_2_7332218C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_7331BC00 NtClose,	2_2_7331BC00

Detected potential crypto function

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_733207CC	2_2_733207CC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_73311494	2_2_73311494
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_733292DC	2_2_733292DC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_73319144	2_2_73319144
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_7331A5A4	2_2_7331A5A4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_733184E4	2_2_733184E4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_733214D8	2_2_733214D8

One or more processes crash

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1552 -s 420

Sample file is different than original file name gathered from version info

Source: CTkT1fRtQv.dll

Binary or memory string: OriginalFilenameANSI32.dll0 vs CTkT1fRtQv.dll

Uses 32bit PE files

Source: CTkT1fRtQv.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: CTkT1fRtQv.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal80.bank.troj.evad.winDLL@8/4@0/3

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1552

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WEREE7E.tmp

Jump to behavior

Source: CTkT1fRtQv.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\CTkT1fRtQv.dll',#1

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\CTkT1fRtQv.dll'
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\CTkT1fRtQv.dll',#1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\CTkT1fRtQv.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\CTkT1fRtQv.dll',ReadLogRecord
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1552 -s 420
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\CTkT1fRtQv.dll',#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\CTkT1fRtQv.dll',ReadLogRecord	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\CTkT1fRtQv.dll',#1	Jump to behavior

Source: CTkT1fRtQv.dll

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: CTkT1fRtQv.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: opengl32.pdb source: WerFault.exe, 00000011.00000003.562170398.0000000005537000.00000004.00000040.sdmp
Source:	Binary string: msvcrt.pdb+ source: WerFault.exe, 00000011.00000003.562170398.0000000005537000.00000004.00000040.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000011.00000003.562166429.0000000005534000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000011.00000003.562127824.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 00000011.00000003.562127824.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000011.00000003.562127824.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: wgdi32full.pdbk source: WerFault.exe, 00000011.00000003.562166429.0000000005534000.00000004.00000040.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 00000011.00000003.562170398.0000000005537000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdbUGP source: rundll32.exe, 00000002.00000003.294950857.000000004B280000.00000004.00000001.sdmp, rundll32.exe, 00000006.00000003.356955165.000000004B280000.00000004.00000001.sdmp
Source:	Binary string: glu32.pdb source: WerFault.exe, 00000011.00000003.562170398.0000000005537000.00000004.00000040.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 00000011.00000003.562127824.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: rundll32.exe, 00000002.00000003.294950857.000000004B280000.00000004.00000001.sdmp, rundll32.exe, 00000006.00000003.356955165.000000004B280000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.562127824.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: ole32.pdb source: WerFault.exe, 00000011.00000003.562127824.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000011.00000003.562127824.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 00000011.00000003.562170398.0000000005537000.00000004.00000040.sdmp
Source:	Binary string: oCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernel32.pdb source: WerFault.exe, 00000011.00000002.567915828.0000000001032000.00000004.00000010.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 00000011.00000003.562127824.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: fffp4.pdb source: WerFault.exe, 00000011.00000003.562127824.0000000005561000.00000004.00000001.sdmp, CTkT1fRtQv.dll
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000011.00000003.562162414.0000000005530000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 00000011.00000003.562127824.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000011.00000003.562170398.0000000005537000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000011.00000003.562127824.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000011.00000003.562127824.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 00000011.00000003.562127824.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000011.00000003.562162414.0000000005530000.00000004.00000040.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000011.00000003.562127824.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000011.00000003.562162414.0000000005530000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdbk source: WerFault.exe, 00000011.00000003.562127824.0000000005561000.00000004.00000001.sdmp

Data Obfuscation:

Uses code obfuscation techniques (call, push, ret)

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 2_2_7331F744 push esi; mov dword ptr [esp], 00000000h

2_2_7331F745

Source: initial sample

Static PE information: section name: .text entropy: 7.55877156847

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Tries to delay execution (extensive OutputDebugStringW loop)

Source: C:\Windows\SysWOW64\rundll32.exe

Section loaded: OutputDebugStringW count: 1943

Tries to detect sandboxes / dynamic malware analysis system (file name check)

Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\testapp.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Section loaded: \KnownDlls32\testapp.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Section loaded: \KnownDlls32\testapp.exe	Jump to behavior

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Windows\SysWOW64\rundll32.exe	Window / User API: threadDelayed 1076			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Window / User API: threadDelayed 866			Jump to behavior

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 2_2_733207CC GetTokenInformation,GetSystemInfo,GetTokenInformation,

2_2_733207CC

Source: C:\Windows\System32\loaddll32.exe

Thread delayed: delay time: 120000

Jump to behavior

Source: WerFault.exe, 00000011.00000002.569242042.00000000056C0000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: WerFault.exe, 00000011.00000002.569242042.00000000056C0000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: WerFault.exe, 00000011.00000002.569242042.00000000056C0000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: WerFault.exe, 00000011.00000002.569242042.00000000056C0000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Anti Debugging:

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Source: C:\Windows\SysWOW64\rundll32.exe

2_2_73316DC8

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 2_2_73323060 RtlAddVectoredExceptionHandler,

2_2_73323060

HIPS / PFW / Operating System Protection Evasion:

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\CTkT1fRtQv.dll',#1

Jump to behavior

Source: rundll32.exe, 00000002.00000002.630359279.0000000002F20000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.630929010.0000000002FB0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: rundll32.exe, 00000002.00000002.630359279.0000000002F20000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.630929010.0000000002FB0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: rundll32.exe, 00000002.00000002.630359279.0000000002F20000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.630929010.0000000002FB0000.00000002.00000001.sdmp	Binary or memory string: SProgram Managerl
Source: rundll32.exe, 00000002.00000002.630359279.0000000002F20000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.630929010.0000000002FB0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd,
Source: rundll32.exe, 00000002.00000002.630359279.0000000002F20000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.630929010.0000000002FB0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Contains functionality to query locales information (e.g. system language)

Source: C:\Windows\SysWOW64\rundll32.exe

2_2_73316DC8

Source: C:\Windows\SysWOW64\rundll32.exe

2_2_73316DC8

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

ID:	392884
Product:	CloudBasic
Start time:	23:47:13
Start date:	19.04.2021
Sample:	CTkT1fRtQv.dll
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	304c6fb5258a065507a5ea8625fbf120
SHA1:	386f11c61362582fb431758483579cef18094043
SHA256:	ab022d18682f942315316baa838852c3010df92e79f645b37c7afd2b85623b2b
Filetype:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60%

Name	Type	MD5	SHA1	SHA256
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_loaddll32.exe_8697bb53893bff1d8dd8d2263efc904abedc64_160cf2be_11f3fcc6\Report.wer	Little-endian UTF-16 Unicode text, with CRLF line terminators	CAA15A6509BB763AB3F43B1FB1772B9C	9A83B6B5ED21315D93E1E31383A1008B54740CD5	DFBBCD118C9889F2DBE89554DDC5C39E10D1F3B170D54002E811F74F4EF7C6F5
C:\ProgramData\Microsoft\Windows\WER\Temp\WEREE7E.tmp.dmp	Mini DuMP crash report, 15 streams, Tue Apr 20 06:50:40 2021, 0x1205a4 type	F815BAB06A0E4DD912BF08A5CD0320E4	99583C293A06FA023D0F11AC5CC4B08AA937DB19	36356B6E55E6BB78BF40A2F58C48E28E1502D9CEEA329677BE37A1E3F5B63A18
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF3BF.tmp.WERInternalMetadata.xml	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators	8EDB93A71AD0C73146E0921F9F342E41	5EB6FACDD8B7047C3ECE3C2F51A46C51AAFEE439	79D136AE0744F98416AAADC2613878BBA64FDB1F3226002665F3176785444962
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF6AE.tmp.xml	XML 1.0 document, ASCII text, with CRLF line terminators	84525A785735DB6B4E3B65E0B6D622B1	0492EC5FEB6A78A2A443D3A9A2D72071CC8A9534	37AA0F6505690A5A5A48983BA78A9AA6DFE521A4655341E3AC9740C95BAEA821

Analysis Report CTkT1fRtQv.dll

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection:

Compliance:

Networking:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs