Analysis Report 923fc959_by_Libranalysis

ID:	413051
Product:	CloudBasic
Start time:	07:02:24
Start date:	13.05.2021
Sample:	923fc959_by_Libranalysis
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	923fc9595e881586f2a68bd2305531e9
SHA1:	4fd8ea36d18b241e0123f9ba9407d33e22672f2a
SHA256:	be8afda2fa058a3162dd02469646e2276162123313ee2c4adb835e0124c07544
Filetype:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60%

Name	Type	MD5	SHA1	SHA256

AV Detection:

Found malware configuration

Source: 2.2.rundll32.exe.6f3e0000.3.unpack

Malware Configuration Extractor: Dridex {"Version": 40112, "C2 list": ["107.172.227.10:443", "172.93.133.123:2303", "108.168.61.147:8172"], "RC4 keys": ["AhGDjKatq8OVBsCNBxsJHbQSf84QZXMd170Lw0kGCrK", "ZZ9zhvNgYZKh5HVVVEDNPVdpdSY2d6pJ4ZBqsvPVEDjyOFNIkXQwmhTyNKiurfq"]}

Multi AV Scanner detection for submitted file

Source: 923fc959_by_Libranalysis.dll	Virustotal: Detection: 67%			Perma Link
Source: 923fc959_by_Libranalysis.dll	ReversingLabs: Detection: 89%

Machine Learning detection for sample

Source: 923fc959_by_Libranalysis.dll

Joe Sandbox ML: detected

Compliance:

Uses 32bit PE files

Source: 923fc959_by_Libranalysis.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: 923fc959_by_Libranalysis.dll

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Source:	Binary string: wntdll.pdbUGP source: rundll32.exe, 00000002.00000003.271179778.000000004B280000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: rundll32.exe, 00000002.00000003.271179778.000000004B280000.00000004.00000001.sdmp
Source:	Binary string: Gsp.pdb source: loaddll32.exe, 00000000.00000002.199846409.000000006F3EA000.00000002.00020000.sdmp, 923fc959_by_Libranalysis.dll

Networking:

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	IPs: 107.172.227.10:443
Source: Malware configuration extractor	IPs: 172.93.133.123:2303
Source: Malware configuration extractor	IPs: 108.168.61.147:8172

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 172.93.133.123 172.93.133.123
Source: Joe Sandbox View	IP Address: 107.172.227.10 107.172.227.10
Source: Joe Sandbox View	IP Address: 108.168.61.147 108.168.61.147

Internet Provider seen in connection with other malware

Source: Joe Sandbox View	ASN Name: NEXEONUS NEXEONUS
Source: Joe Sandbox View	ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS
Source: Joe Sandbox View	ASN Name: START-CA START-CA

E-Banking Fraud:

Dridex dropper found

Source: Initial file

Signature Results: Dridex dropper behavior

Yara detected Dridex unpacked file

Source: Yara match	File source: 00000002.00000002.470542364.000000006F3E1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 2.2.rundll32.exe.6f3e0000.3.unpack, type: UNPACKEDPE

System Summary:

Abnormal high CPU Usage

Source: C:\Windows\SysWOW64\rundll32.exe

Process Stats: CPU usage > 98%

Contains functionality to call native functions

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6F3F2790 NtAllocateVirtualMemory,		2_2_6F3F2790
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6F3F218C NtDelayExecution,		2_2_6F3F218C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6F3EBC00 NtClose,		2_2_6F3EBC00

Detected potential crypto function

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6F3F07CC		2_2_6F3F07CC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6F3F92DC		2_2_6F3F92DC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6F3E9144		2_2_6F3E9144
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6F3EA5A4		2_2_6F3EA5A4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6F3E1494		2_2_6F3E1494
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6F3E84E4		2_2_6F3E84E4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6F3F14D8		2_2_6F3F14D8

Sample file is different than original file name gathered from version info

Source: 923fc959_by_Libranalysis.dll

Binary or memory string: OriginalFilenameofl.dllN vs 923fc959_by_Libranalysis.dll

Uses 32bit PE files

Source: 923fc959_by_Libranalysis.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Classification label

Source: classification engine

Classification label: mal92.bank.troj.evad.winDLL@5/0@0/3

PE file has an executable .text section and no other executable section

Source: 923fc959_by_Libranalysis.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads software policies

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Runs a DLL by calling functions

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\923fc959_by_Libranalysis.dll',#1

Sample is known by Antivirus

Source: 923fc959_by_Libranalysis.dll	Virustotal: Detection: 67%
Source: 923fc959_by_Libranalysis.dll	ReversingLabs: Detection: 89%

Spawns processes

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\923fc959_by_Libranalysis.dll'
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\923fc959_by_Libranalysis.dll',#1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\923fc959_by_Libranalysis.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\923fc959_by_Libranalysis.dll',#1			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\923fc959_by_Libranalysis.dll',#1			Jump to behavior

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: 923fc959_by_Libranalysis.dll

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

PE file contains a debug data directory

Source: 923fc959_by_Libranalysis.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Binary contains paths to debug symbols

Source:	Binary string: wntdll.pdbUGP source: rundll32.exe, 00000002.00000003.271179778.000000004B280000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: rundll32.exe, 00000002.00000003.271179778.000000004B280000.00000004.00000001.sdmp
Source:	Binary string: Gsp.pdb source: loaddll32.exe, 00000000.00000002.199846409.000000006F3EA000.00000002.00020000.sdmp, 923fc959_by_Libranalysis.dll

Data Obfuscation:

Uses code obfuscation techniques (call, push, ret)

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6F3E3A27 push ebp; ret		0_2_6F3E3A28
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6F3E2F56 push ebp; retf		0_2_6F3E2F61
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6F3EF744 push esi; mov dword ptr [esp], 00000000h		2_2_6F3EF745

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Source: C:\Windows\SysWOW64\rundll32.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion:

Tries to delay execution (extensive OutputDebugStringW loop)

Source: C:\Windows\SysWOW64\rundll32.exe

Section loaded: OutputDebugStringW count: 610

Tries to detect sandboxes / dynamic malware analysis system (file name check)

Source: C:\Windows\SysWOW64\rundll32.exe	Section loaded: \KnownDlls32\testapp.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Section loaded: \KnownDlls32\self.exE			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Section loaded: \KnownDlls32\self.exE			Jump to behavior

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Windows\SysWOW64\rundll32.exe

Window / User API: threadDelayed 610

Jump to behavior

Program does not show much activity (idle)

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed

Contains functionality to query system information

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 2_2_6F3F07CC GetTokenInformation,GetSystemInfo,GetTokenInformation,

2_2_6F3F07CC

Anti Debugging:

Found potential dummy code loops (likely to delay analysis)

Source: C:\Windows\SysWOW64\rundll32.exe

Process Stats: CPU usage > 90% for more than 60s

Checks if the current process is being debugged

Source: C:\Windows\System32\loaddll32.exe

Process queried: DebugPort

Jump to behavior

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 2_2_6F3E6DC8 GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA,

2_2_6F3E6DC8

Program does not show much activity (idle)

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Contains functionality to register its own exception handler

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 2_2_6F3F3060 RtlAddVectoredExceptionHandler,

2_2_6F3F3060

HIPS / PFW / Operating System Protection Evasion:

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\923fc959_by_Libranalysis.dll',#1

Jump to behavior

May try to detect the Windows Explorer process (often used for injection)

Source: rundll32.exe, 00000002.00000002.469250303.0000000003250000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: rundll32.exe, 00000002.00000002.469250303.0000000003250000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: rundll32.exe, 00000002.00000002.469250303.0000000003250000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: rundll32.exe, 00000002.00000002.469250303.0000000003250000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Contains functionality to query locales information (e.g. system language)

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA,

2_2_6F3E6DC8

Contains functionality to query the account / user name

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 2_2_6F3E6DC8 GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA,

2_2_6F3E6DC8

Queries the cryptographic machine GUID

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior