Windows Analysis Report 6ZV65nCMYQ

Overview

General Information

Sample Name: 6ZV65nCMYQ (renamed file extension from none to exe)
Analysis ID: 448941
MD5: 622f4aa2d5e82438f3a40a35ab4902d5
SHA1: b486db47021575c47e7b130bed1ad70b8bf6a719
SHA256: 277089cb78a9c493cecd8f5fbe70df0577d4f9557fb8b55ff5f7c2505308ca3a
Tags: 32exe
Infos:

Most interesting Screenshot:

Detection

Dridex Dropper
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Dridex dropper found
Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected Dridex unpacked file
C2 URLs / IPs found in malware configuration
Found potential dummy code loops (likely to delay analysis)
Machine Learning detection for sample
Tries to delay execution (extensive OutputDebugStringW loop)
Tries to detect sandboxes / dynamic malware analysis system (file name check)
Tries to detect virtualization through RDTSC time measurements
Abnormal high CPU Usage
Antivirus or Machine Learning detection for unpacked file
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to query locales information (e.g. system language)
Detected potential crypto function
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Program does not show much activity (idle)
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

AV Detection:

barindex
Found malware configuration
Source: 0.2.6ZV65nCMYQ.exe.10000000.0.unpack Malware Configuration Extractor: Dridex {"Version": 22202, "C2 list": ["202.29.60.34:443", "66.175.217.172:13786", "78.46.78.42:9043"], "RC4 keys": ["RQTJGOuDHeSyUCWzdNRZi3fWMitWY9aTc", "2UMW8pusQXiNJDgmuPITkf4TmrOt3Y13lRDWnjBuu16JkzjIG6gNuckQDkiut9pzQHVGfFdlT"]}
Multi AV Scanner detection for submitted file
Source: 6ZV65nCMYQ.exe Virustotal: Detection: 29% Perma Link
Source: 6ZV65nCMYQ.exe ReversingLabs: Detection: 34%
Machine Learning detection for sample
Source: 6ZV65nCMYQ.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 0.2.6ZV65nCMYQ.exe.10000000.0.unpack Avira: Label: TR/Dropper.Gen

Compliance:

barindex
Detected unpacking (overwrites its own PE header)
Source: C:\Users\user\Desktop\6ZV65nCMYQ.exe Unpacked PE file: 0.2.6ZV65nCMYQ.exe.10000000.0.unpack
Uses 32bit PE files
Source: 6ZV65nCMYQ.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: 6ZV65nCMYQ.exe Static PE information: DYNAMIC_BASE, NX_COMPAT
Source: Binary string: wntdll.pdbUGP source: 6ZV65nCMYQ.exe, 00000000.00000003.659201910.000000004B280000.00000004.00000001.sdmp
Source: Binary string: wntdll.pdb source: 6ZV65nCMYQ.exe, 00000000.00000003.659201910.000000004B280000.00000004.00000001.sdmp
Source: Binary string: Gpernfedeefe.pdb source: 6ZV65nCMYQ.exe

Networking:

barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor IPs: 202.29.60.34:443
Source: Malware configuration extractor IPs: 66.175.217.172:13786
Source: Malware configuration extractor IPs: 78.46.78.42:9043
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 78.46.78.42 78.46.78.42
Source: Joe Sandbox View IP Address: 202.29.60.34 202.29.60.34
Source: Joe Sandbox View IP Address: 66.175.217.172 66.175.217.172
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: HETZNER-ASDE HETZNER-ASDE
Source: Joe Sandbox View ASN Name: CMRU-AS-APChiangmaiRajabhatUniversityTH CMRU-AS-APChiangmaiRajabhatUniversityTH
Source: Joe Sandbox View ASN Name: LINODE-APLinodeLLCUS LINODE-APLinodeLLCUS

E-Banking Fraud:

barindex
Dridex dropper found
Source: Initial file Signature Results: Dridex dropper behavior
Yara detected Dridex unpacked file
Source: Yara match File source: 0.2.6ZV65nCMYQ.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.1172561248.0000000010001000.00000020.00020000.sdmp, type: MEMORY

System Summary:

barindex
Abnormal high CPU Usage
Source: C:\Users\user\Desktop\6ZV65nCMYQ.exe Process Stats: CPU usage > 98%
Contains functionality to call native functions
Source: C:\Users\user\Desktop\6ZV65nCMYQ.exe Code function: 0_2_10012840 NtAllocateVirtualMemory, 0_2_10012840
Source: C:\Users\user\Desktop\6ZV65nCMYQ.exe Code function: 0_2_1001223C NtDelayExecution, 0_2_1001223C
Source: C:\Users\user\Desktop\6ZV65nCMYQ.exe Code function: 0_2_1000BB88 NtClose, 0_2_1000BB88
Detected potential crypto function
Source: C:\Users\user\Desktop\6ZV65nCMYQ.exe Code function: 0_2_10010754 0_2_10010754
Source: C:\Users\user\Desktop\6ZV65nCMYQ.exe Code function: 0_2_10011460 0_2_10011460
Source: C:\Users\user\Desktop\6ZV65nCMYQ.exe Code function: 0_2_1000846C 0_2_1000846C
Source: C:\Users\user\Desktop\6ZV65nCMYQ.exe Code function: 0_2_10001494 0_2_10001494
Source: C:\Users\user\Desktop\6ZV65nCMYQ.exe Code function: 0_2_1000A52C 0_2_1000A52C
Source: C:\Users\user\Desktop\6ZV65nCMYQ.exe Code function: 0_2_10011D58 0_2_10011D58
Source: C:\Users\user\Desktop\6ZV65nCMYQ.exe Code function: 0_2_10019348 0_2_10019348
Sample file is different than original file name gathered from version info
Source: 6ZV65nCMYQ.exe, 00000000.00000003.659347284.000000004B39F000.00000004.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs 6ZV65nCMYQ.exe
Source: 6ZV65nCMYQ.exe, 00000000.00000000.648423330.0000000010028000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameDihzehtreof.resources.dll@ vs 6ZV65nCMYQ.exe
Source: 6ZV65nCMYQ.exe, 00000000.00000002.1172580143.000000001001F000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameHexEditor.exe6 vs 6ZV65nCMYQ.exe
Source: 6ZV65nCMYQ.exe Binary or memory string: OriginalFilenameDihzehtreof.resources.dll@ vs 6ZV65nCMYQ.exe
Uses 32bit PE files
Source: 6ZV65nCMYQ.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: 6ZV65nCMYQ.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: classification engine Classification label: mal100.bank.troj.evad.winEXE@1/0@0/3
Source: 6ZV65nCMYQ.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\6ZV65nCMYQ.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: 6ZV65nCMYQ.exe Virustotal: Detection: 29%
Source: 6ZV65nCMYQ.exe ReversingLabs: Detection: 34%
Source: 6ZV65nCMYQ.exe Static PE information: DYNAMIC_BASE, NX_COMPAT
Source: 6ZV65nCMYQ.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: wntdll.pdbUGP source: 6ZV65nCMYQ.exe, 00000000.00000003.659201910.000000004B280000.00000004.00000001.sdmp
Source: Binary string: wntdll.pdb source: 6ZV65nCMYQ.exe, 00000000.00000003.659201910.000000004B280000.00000004.00000001.sdmp
Source: Binary string: Gpernfedeefe.pdb source: 6ZV65nCMYQ.exe

Data Obfuscation:

barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\6ZV65nCMYQ.exe Unpacked PE file: 0.2.6ZV65nCMYQ.exe.10000000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.CRT:R;.rsrc:R;.reloc:R;
Detected unpacking (overwrites its own PE header)
Source: C:\Users\user\Desktop\6ZV65nCMYQ.exe Unpacked PE file: 0.2.6ZV65nCMYQ.exe.10000000.0.unpack
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\6ZV65nCMYQ.exe Code function: 0_2_1000F6CC push esi; mov dword ptr [esp], 00000000h 0_2_1000F6CD
Source: initial sample Static PE information: section name: .text entropy: 7.824574037

Malware Analysis System Evasion:

barindex
Tries to delay execution (extensive OutputDebugStringW loop)
Source: C:\Users\user\Desktop\6ZV65nCMYQ.exe Section loaded: OutputDebugStringW count: 1668
Tries to detect sandboxes / dynamic malware analysis system (file name check)
Source: C:\Users\user\Desktop\6ZV65nCMYQ.exe Section loaded: \KnownDlls32\Self.exE Jump to behavior
Source: C:\Users\user\Desktop\6ZV65nCMYQ.exe Section loaded: \KnownDlls32\testapp.exe Jump to behavior
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\6ZV65nCMYQ.exe RDTSC instruction interceptor: First address: 0000000010001332 second address: 0000000010001336 instructions: 0x00000000 rdtsc 0x00000002 mov esi, eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6ZV65nCMYQ.exe RDTSC instruction interceptor: First address: 0000000010001336 second address: 0000000010001332 instructions: 0x00000000 rdtsc 0x00000002 mov edi, eax 0x00000004 xor eax, eax 0x00000006 xor edx, edx 0x00000008 sub edi, esi 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e cmp eax, edi 0x00000010 cmovb eax, edi 0x00000013 cmp ecx, edi 0x00000015 cmovnbe ecx, edi 0x00000018 mov bl, byte ptr [esp+2Bh] 0x0000001c mov byte ptr [esp+3Bh], bl 0x00000020 mov edx, dword ptr [esp+08h] 0x00000024 add edx, 01h 0x00000027 mov esi, dword ptr [esp+2Ch] 0x0000002b cmp edx, esi 0x0000002d mov edi, ecx 0x0000002f mov esi, eax 0x00000031 mov dword ptr [esp+24h], edi 0x00000035 mov dword ptr [esp+18h], eax 0x00000039 mov dword ptr [esp+1Ch], ecx 0x0000003d mov dword ptr [esp+20h], esi 0x00000041 mov dword ptr [esp+14h], edx 0x00000045 je 00007FCA587815D3h 0x0000004b jmp 00007FCA5878162Dh 0x0000004d mov eax, dword ptr [esp+14h] 0x00000051 mov ecx, dword ptr [esp+1Ch] 0x00000055 mov edx, dword ptr [esp+18h] 0x00000059 mov dword ptr [esp+08h], eax 0x0000005d mov dword ptr [esp+04h], edx 0x00000061 rdtsc
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\6ZV65nCMYQ.exe Window / User API: threadDelayed 1668 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\6ZV65nCMYQ.exe TID: 6636 Thread sleep count: 1668 > 30 Jump to behavior
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Users\user\Desktop\6ZV65nCMYQ.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\6ZV65nCMYQ.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\6ZV65nCMYQ.exe Code function: 0_2_10010754 GetTokenInformation,GetSystemInfo,GetTokenInformation, 0_2_10010754

Anti Debugging:

barindex
Found potential dummy code loops (likely to delay analysis)
Source: C:\Users\user\Desktop\6ZV65nCMYQ.exe Process Stats: CPU usage > 90% for more than 60s
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\6ZV65nCMYQ.exe Code function: 0_2_10019AB4 LdrInitializeThunk, 0_2_10019AB4
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Source: C:\Users\user\Desktop\6ZV65nCMYQ.exe Code function: 0_2_10006D50 GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA, 0_2_10006D50
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Users\user\Desktop\6ZV65nCMYQ.exe Code function: 0_2_10013110 RtlAddVectoredExceptionHandler, 0_2_10013110
Source: 6ZV65nCMYQ.exe, 00000000.00000002.1172446806.0000000000DA0000.00000002.00000001.sdmp Binary or memory string: Program Manager
Source: 6ZV65nCMYQ.exe, 00000000.00000002.1172446806.0000000000DA0000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: 6ZV65nCMYQ.exe, 00000000.00000002.1172446806.0000000000DA0000.00000002.00000001.sdmp Binary or memory string: Progman
Source: 6ZV65nCMYQ.exe, 00000000.00000002.1172446806.0000000000DA0000.00000002.00000001.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

barindex
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\Desktop\6ZV65nCMYQ.exe Code function: GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA, 0_2_10006D50
Source: C:\Users\user\Desktop\6ZV65nCMYQ.exe Code function: 0_2_10006D50 GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA, 0_2_10006D50
Source: C:\Users\user\Desktop\6ZV65nCMYQ.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 448941 Sample: 6ZV65nCMYQ Startdate: 14/07/2021 Architecture: WINDOWS Score: 100 9 66.175.217.172 LINODE-APLinodeLLCUS United States 2->9 11 78.46.78.42 HETZNER-ASDE Germany 2->11 13 202.29.60.34 CMRU-AS-APChiangmaiRajabhatUniversityTH Thailand 2->13 15 Found malware configuration 2->15 17 Multi AV Scanner detection for submitted file 2->17 19 Dridex dropper found 2->19 21 3 other signatures 2->21 6 6ZV65nCMYQ.exe 2->6         started        signatures3 process4 signatures5 23 Detected unpacking (changes PE section rights) 6->23 25 Detected unpacking (overwrites its own PE header) 6->25 27 Tries to detect sandboxes / dynamic malware analysis system (file name check) 6->27 29 3 other signatures 6->29
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
78.46.78.42
 unknown Germany
24940 HETZNER-ASDE true
202.29.60.34
 unknown Thailand
24344 CMRU-AS-APChiangmaiRajabhatUniversityTH true
66.175.217.172
 unknown United States
63949 LINODE-APLinodeLLCUS true