Analysis Report 5a866993_by_Libranalysis

Overview

General Information

Sample Name: 5a866993_by_Libranalysis (renamed file extension from none to dll)
Analysis ID: 413058
MD5: 5a8669939cc5c7dc13f95d308fb509a9
SHA1: 4c3c6bbbcc0ce1e5a04a7fb65db30f255f2a9bf5
SHA256: 439d76a549397ad0e6814cec88e82fb5275ade77fd4e4001834411138f0e3006
Infos:

Most interesting Screenshot:

Detection

Dridex Dropper
Score: 84
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Dridex dropper found
Found malware configuration
Yara detected Dridex unpacked file
C2 URLs / IPs found in malware configuration
Found potential dummy code loops (likely to delay analysis)
Machine Learning detection for sample
Tries to delay execution (extensive OutputDebugStringW loop)
Tries to detect sandboxes / dynamic malware analysis system (file name check)
Abnormal high CPU Usage
Checks if the current process is being debugged
Contains functionality to call native functions
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to query locales information (e.g. system language)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
Program does not show much activity (idle)
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

AV Detection:

barindex
Found malware configuration
Source: 2.2.rundll32.exe.73620000.3.unpack Malware Configuration Extractor: Dridex {"Version": 40112, "C2 list": ["107.172.227.10:443", "172.93.133.123:2303", "108.168.61.147:8172"], "RC4 keys": ["AhGDjKatq8OVBsCNBxsJHbQSf84QZXMd170Lw0kGCrK", "ZZ9zhvNgYZKh5HVVVEDNPVdpdSY2d6pJ4ZBqsvPVEDjyOFNIkXQwmhTyNKiurfq"]}
Machine Learning detection for sample
Source: 5a866993_by_Libranalysis.dll Joe Sandbox ML: detected

Compliance:

barindex
Uses 32bit PE files
Source: 5a866993_by_Libranalysis.dll Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
Source: 5a866993_by_Libranalysis.dll Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: wntdll.pdbUGP source: rundll32.exe, 00000002.00000003.395444465.000000004B280000.00000004.00000001.sdmp
Source: Binary string: wntdll.pdb source: rundll32.exe, 00000002.00000003.395444465.000000004B280000.00000004.00000001.sdmp
Source: Binary string: Gsp.pdb source: loaddll32.exe, 00000000.00000002.325552898.000000007362A000.00000002.00020000.sdmp, 5a866993_by_Libranalysis.dll

Networking:

barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor IPs: 107.172.227.10:443
Source: Malware configuration extractor IPs: 172.93.133.123:2303
Source: Malware configuration extractor IPs: 108.168.61.147:8172
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 172.93.133.123 172.93.133.123
Source: Joe Sandbox View IP Address: 107.172.227.10 107.172.227.10
Source: Joe Sandbox View IP Address: 108.168.61.147 108.168.61.147
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: NEXEONUS NEXEONUS
Source: Joe Sandbox View ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS
Source: Joe Sandbox View ASN Name: START-CA START-CA

E-Banking Fraud:

barindex
Dridex dropper found
Source: Initial file Signature Results: Dridex dropper behavior
Yara detected Dridex unpacked file
Source: Yara match File source: 00000002.00000002.593188580.0000000073621000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match File source: 2.2.rundll32.exe.73620000.3.unpack, type: UNPACKEDPE

System Summary:

barindex
Abnormal high CPU Usage
Source: C:\Windows\SysWOW64\rundll32.exe Process Stats: CPU usage > 98%
Contains functionality to call native functions
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_73632790 NtAllocateVirtualMemory, 2_2_73632790
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_7363218C NtDelayExecution, 2_2_7363218C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_7362BC00 NtClose, 2_2_7362BC00
Detected potential crypto function
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_736307CC 2_2_736307CC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_736392DC 2_2_736392DC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_73629144 2_2_73629144
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_7362A5A4 2_2_7362A5A4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_736284E4 2_2_736284E4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_736314D8 2_2_736314D8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_73621494 2_2_73621494
Sample file is different than original file name gathered from version info
Source: 5a866993_by_Libranalysis.dll Binary or memory string: OriginalFilenameofl.dllN vs 5a866993_by_Libranalysis.dll
Uses 32bit PE files
Source: 5a866993_by_Libranalysis.dll Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
Source: classification engine Classification label: mal84.bank.troj.evad.winDLL@5/0@0/3
Source: 5a866993_by_Libranalysis.dll Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Windows\System32\loaddll32.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\5a866993_by_Libranalysis.dll',#1
Source: unknown Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\5a866993_by_Libranalysis.dll'
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\5a866993_by_Libranalysis.dll',#1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\5a866993_by_Libranalysis.dll',#1
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\5a866993_by_Libranalysis.dll',#1 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\5a866993_by_Libranalysis.dll',#1 Jump to behavior
Source: 5a866993_by_Libranalysis.dll Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: 5a866993_by_Libranalysis.dll Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: wntdll.pdbUGP source: rundll32.exe, 00000002.00000003.395444465.000000004B280000.00000004.00000001.sdmp
Source: Binary string: wntdll.pdb source: rundll32.exe, 00000002.00000003.395444465.000000004B280000.00000004.00000001.sdmp
Source: Binary string: Gsp.pdb source: loaddll32.exe, 00000000.00000002.325552898.000000007362A000.00000002.00020000.sdmp, 5a866993_by_Libranalysis.dll

Data Obfuscation:

barindex
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_73622F56 push ebp; retf 0_2_73622F61
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_73623A27 push ebp; ret 0_2_73623A28
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_7362F744 push esi; mov dword ptr [esp], 00000000h 2_2_7362F745
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Tries to delay execution (extensive OutputDebugStringW loop)
Source: C:\Windows\SysWOW64\rundll32.exe Section loaded: OutputDebugStringW count: 611
Tries to detect sandboxes / dynamic malware analysis system (file name check)
Source: C:\Windows\SysWOW64\rundll32.exe Section loaded: \KnownDlls32\testapp.exe Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Section loaded: \KnownDlls32\self.exE Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Section loaded: \KnownDlls32\self.exE Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\rundll32.exe Window / User API: threadDelayed 611 Jump to behavior
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\SysWOW64\rundll32.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_736307CC GetTokenInformation,GetSystemInfo,GetTokenInformation, 2_2_736307CC

Anti Debugging:

barindex
Found potential dummy code loops (likely to delay analysis)
Source: C:\Windows\SysWOW64\rundll32.exe Process Stats: CPU usage > 90% for more than 60s
Checks if the current process is being debugged
Source: C:\Windows\System32\loaddll32.exe Process queried: DebugPort Jump to behavior
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_73626DC8 GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA, 2_2_73626DC8
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_73633060 RtlAddVectoredExceptionHandler, 2_2_73633060

HIPS / PFW / Operating System Protection Evasion:

barindex
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\5a866993_by_Libranalysis.dll',#1 Jump to behavior
Source: rundll32.exe, 00000002.00000002.592285676.00000000038F0000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: rundll32.exe, 00000002.00000002.592285676.00000000038F0000.00000002.00000001.sdmp Binary or memory string: Progman
Source: rundll32.exe, 00000002.00000002.592285676.00000000038F0000.00000002.00000001.sdmp Binary or memory string: &Program Manager
Source: rundll32.exe, 00000002.00000002.592285676.00000000038F0000.00000002.00000001.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

barindex
Contains functionality to query locales information (e.g. system language)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA, 2_2_73626DC8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 2_2_73626DC8 GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA, 2_2_73626DC8
Source: C:\Windows\SysWOW64\rundll32.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 413058 Sample: 5a866993_by_Libranalysis Startdate: 13/05/2021 Architecture: WINDOWS Score: 84 15 108.168.61.147 START-CA Canada 2->15 17 172.93.133.123 NEXEONUS United States 2->17 19 107.172.227.10 AS-COLOCROSSINGUS United States 2->19 21 Found malware configuration 2->21 23 Dridex dropper found 2->23 25 Yara detected Dridex unpacked file 2->25 27 2 other signatures 2->27 8 loaddll32.exe 1 2->8         started        signatures3 process4 process5 10 cmd.exe 1 8->10         started        process6 12 rundll32.exe 10->12         started        signatures7 29 Tries to detect sandboxes / dynamic malware analysis system (file name check) 12->29 31 Tries to delay execution (extensive OutputDebugStringW loop) 12->31 33 Found potential dummy code loops (likely to delay analysis) 12->33
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
172.93.133.123
 unknown United States
20278 NEXEONUS true
107.172.227.10
 unknown United States
36352 AS-COLOCROSSINGUS true
108.168.61.147
 unknown Canada
40788 START-CA true