Windows Analysis Report SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll

Overview

General Information

Sample Name:	SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll
Analysis ID:	510686
MD5:	e53a16bea7918b1f7d4c0e659febc766
SHA1:	10d4d3d7fac35f6492cda2fb04aebf46903481f0
SHA256:	212cae7b05ecbc938b3a1fda4753d119f69360165955937b836fdbc7a6d514eb
Tags:	dll
Infos:
Most interesting Screenshot:

Detection

Dridex

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Found detection on Joe Sandbox Cloud Basic with higher score

Yara detected Dridex unpacked file

Multi AV Scanner detection for submitted file

Tries to delay execution (extensive OutputDebugStringW loop)

C2 URLs / IPs found in malware configuration

Machine Learning detection for sample

Uses 32bit PE files

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Antivirus or Machine Learning detection for unpacked file

Sample file is different than original file name gathered from version info

One or more processes crash

Contains functionality to query locales information (e.g. system language)

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Launches processes in debugging mode, may be used to hinder debugging

Creates a process in suspended mode (likely to inject code)

IP address seen in connection with other malware

Classification

Signatures

AV Detection:

Found malware configuration

Source: 4.2.rundll32.exe.6ecf0000.2.unpack

Malware Configuration Extractor: Dridex {"Version": 22201, "C2 list": ["149.202.179.100:443", "66.147.235.11:6891", "81.0.236.89:13786"], "RC4 keys": ["9fRysqcdPgZffBlroqJaZHyCvLvD6BUV", "ranVAwtYINZG8jFJSjh5rR8jx3HIZIvSCern79nVFUhfeb2NvJlOKPsGO1osGE0VchV9bFDjym"]}

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll	Virustotal: Detection: 21%			Perma Link
Source: SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll	ReversingLabs: Detection: 31%

Machine Learning detection for sample

Source: SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll

Joe Sandbox ML: detected

Antivirus or Machine Learning detection for unpacked file

Source: 19.0.rundll32.exe.754756.4.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 18.0.rundll32.exe.4764756.4.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 19.2.rundll32.exe.5b0000.0.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 19.0.rundll32.exe.5b0000.0.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 17.0.rundll32.exe.4af4756.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 17.2.rundll32.exe.f70000.0.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 3.0.rundll32.exe.4df4756.4.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.2.loaddll32.exe.1250000.0.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 3.0.rundll32.exe.3300000.0.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 14.2.rundll32.exe.3464756.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 19.0.rundll32.exe.754756.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 19.0.rundll32.exe.5b0000.3.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 18.0.rundll32.exe.4764756.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 18.2.rundll32.exe.c00000.0.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 17.0.rundll32.exe.f70000.3.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 3.0.rundll32.exe.3300000.3.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 19.2.rundll32.exe.754756.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 4.2.rundll32.exe.e94756.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 18.2.rundll32.exe.4764756.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 16.0.rundll32.exe.b20000.3.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 17.0.rundll32.exe.f70000.0.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 16.0.rundll32.exe.b20000.0.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 4.2.rundll32.exe.bd0000.0.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 0.2.loaddll32.exe.15e4756.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 16.0.rundll32.exe.1144756.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 17.2.rundll32.exe.4af4756.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 3.0.rundll32.exe.4df4756.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 18.0.rundll32.exe.c00000.3.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 17.0.rundll32.exe.4af4756.4.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 18.0.rundll32.exe.c00000.0.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 14.2.rundll32.exe.fc0000.0.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 16.0.rundll32.exe.1144756.4.unpack	Avira: Label: TR/Patched.Ren.Gen

Compliance:

Uses 32bit PE files

Source: SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: rpidebbfll.pdb source: SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll
Source:	Binary string: wntdll.pdbUGP source: rundll32.exe, 00000004.00000003.352818755.000000004B280000.00000004.00000001.sdmp, rundll32.exe, 0000000E.00000003.595500849.000000004B280000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: rundll32.exe, 00000004.00000003.352818755.000000004B280000.00000004.00000001.sdmp, rundll32.exe, 0000000E.00000003.595500849.000000004B280000.00000004.00000001.sdmp

Networking:

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	IPs: 149.202.179.100:443
Source: Malware configuration extractor	IPs: 66.147.235.11:6891
Source: Malware configuration extractor	IPs: 81.0.236.89:13786

Internet Provider seen in connection with other malware

Source: Joe Sandbox View	ASN Name: HOSTROCKETUS HOSTROCKETUS
Source: Joe Sandbox View	ASN Name: OVHFR OVHFR

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 66.147.235.11 66.147.235.11
Source: Joe Sandbox View	IP Address: 149.202.179.100 149.202.179.100
Source: Joe Sandbox View	IP Address: 81.0.236.89 81.0.236.89

Source: loaddll32.exe, 00000000.00000002.648422509.000000006ED0F000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000000.372865791.000000006ED0F000.00000002.00020000.sdmp, rundll32.exe, 00000004.00000002.649740233.000000006ED0F000.00000002.00020000.sdmp, rundll32.exe, 0000000E.00000002.650585460.000000006ED0F000.00000002.00020000.sdmp, rundll32.exe, 00000010.00000000.600585830.000000006ED0F000.00000002.00020000.sdmp, rundll32.exe, 00000011.00000000.614963241.000000006ED0F000.00000002.00020000.sdmp, rundll32.exe, 00000012.00000000.640010436.000000006ED0F000.00000002.00020000.sdmp, rundll32.exe, 00000013.00000000.640637691.000000006ED0F000.00000002.00020000.sdmp

String found in binary or memory: http://www.vomfass.deDVarFileInfo$

E-Banking Fraud:

Yara detected Dridex unpacked file

Source: Yara match	File source: 17.0.rundll32.exe.6ecf0000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.0.rundll32.exe.6ecf0000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.6ecf0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.rundll32.exe.6ecf0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.rundll32.exe.6ecf0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.6ecf0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.0.rundll32.exe.6ecf0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.6ecf0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.rundll32.exe.6ecf0000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.0.rundll32.exe.6ecf0000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.rundll32.exe.6ecf0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.rundll32.exe.6ecf0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.rundll32.exe.6ecf0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.0.rundll32.exe.6ecf0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.0.rundll32.exe.6ecf0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.650424736.000000006ECF1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000000.633029380.000000006ECF1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.647984137.000000006ECF1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000000.639692678.000000006ECF1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.372154068.000000006ECF1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000000.609752932.000000006ECF1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.647602284.000000006ECF1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000000.640582271.000000006ECF1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.648668483.000000006ECF1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.649606375.000000006ECF1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.646115407.000000006ECF1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000000.614518127.000000006ECF1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000000.600008382.000000006ECF1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000000.631903118.000000006ECF1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000000.600571038.000000006ECF1000.00000020.00020000.sdmp, type: MEMORY

System Summary:

Found detection on Joe Sandbox Cloud Basic with higher score

Source: SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll

Joe Sandbox Cloud Basic: Detection: malicious Score: 76 Threat Name: Dridex

Perma Link

Uses 32bit PE files

Source: SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Sample file is different than original file name gathered from version info

Source: SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll

Binary or memory string: OriginalFilenameddlb.dll vs SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll

One or more processes crash

Source: C:\Windows\SysWOW64\rundll32.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5964 -s 664

Detected potential crypto function

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED00754	0_2_6ED00754
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED09348	0_2_6ED09348
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ECF1494	0_2_6ECF1494
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ECF846C	0_2_6ECF846C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED01460	0_2_6ED01460
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED01D58	0_2_6ED01D58
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ECFA52C	0_2_6ECFA52C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ECF90CC	0_2_6ECF90CC

Source: SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll	Virustotal: Detection: 21%
Source: SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll	ReversingLabs: Detection: 31%

Source: SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll,FFRgpmdlwwWde

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll'
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll,FFRgpmdlwwWde
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll',CheckTrust
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll',DllCanUnloadNow
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll',DllGetClassObject
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll',DownloadFile
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll',GetICifFileFromFile
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5964 -s 664
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 664
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5964 -s 664
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6120 -s 664
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 664
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll',#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll,FFRgpmdlwwWde	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll',CheckTrust	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll',DllCanUnloadNow	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll',DllGetClassObject	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll',DownloadFile	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll',GetICifFileFromFile	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll',#1	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5964 -s 664	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 664	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6120 -s 664	Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6120
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5964
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2212

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WERA390.tmp

Jump to behavior

Source: classification engine

Classification label: mal84.troj.evad.winDLL@28/11@0/3

Source: SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll

Static file information: File size 1093632 > 1048576

Source: SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: rpidebbfll.pdb source: SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll
Source:	Binary string: wntdll.pdbUGP source: rundll32.exe, 00000004.00000003.352818755.000000004B280000.00000004.00000001.sdmp, rundll32.exe, 0000000E.00000003.595500849.000000004B280000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: rundll32.exe, 00000004.00000003.352818755.000000004B280000.00000004.00000001.sdmp, rundll32.exe, 0000000E.00000003.595500849.000000004B280000.00000004.00000001.sdmp

Data Obfuscation:

Uses code obfuscation techniques (call, push, ret)

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6ECFF6CC push esi; mov dword ptr [esp], 00000000h

0_2_6ECFF6CD

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Tries to delay execution (extensive OutputDebugStringW loop)

Source: C:\Windows\SysWOW64\rundll32.exe

Section loaded: OutputDebugStringW count: 448

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Windows\SysWOW64\rundll32.exe

Window / User API: threadDelayed 426

Jump to behavior

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\System32\loaddll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed

Source: C:\Windows\System32\loaddll32.exe

Thread delayed: delay time: 120000

Jump to behavior

Source: WERD744.tmp.WERInternalMetadata.xml.29.dr	Binary or memory string: <SystemManufacturer>VMware, Inc.</SystemManufacturer>
Source: WERDCC3.tmp.xml.29.dr	Binary or memory string: <arg nm="syspro" val="VMware7,1" />
Source: WERD744.tmp.WERInternalMetadata.xml.29.dr	Binary or memory string: <SystemProductName>VMware7,1</SystemProductName>
Source: WERDCC3.tmp.xml.29.dr	Binary or memory string: <arg nm="sysmfg" val="VMware, Inc." />

Anti Debugging:

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6ECF6D50 GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA,

0_2_6ECF6D50

Launches processes in debugging mode, may be used to hinder debugging

Source: C:\Windows\SysWOW64\rundll32.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5964 -s 664

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll',#1	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5964 -s 664	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 664	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6120 -s 664	Jump to behavior

Source: loaddll32.exe, 00000000.00000002.646808145.00000000019A0000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000000.362283972.0000000003910000.00000002.00020000.sdmp, rundll32.exe, 00000004.00000002.648957709.0000000003410000.00000002.00020000.sdmp, rundll32.exe, 0000000E.00000002.649564710.00000000039E0000.00000002.00020000.sdmp, rundll32.exe, 00000010.00000000.596800440.0000000003280000.00000002.00020000.sdmp, rundll32.exe, 00000011.00000000.590761143.0000000003610000.00000002.00020000.sdmp, rundll32.exe, 00000012.00000000.637219700.0000000003280000.00000002.00020000.sdmp, rundll32.exe, 00000013.00000000.632972734.0000000003280000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: loaddll32.exe, 00000000.00000002.646808145.00000000019A0000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000000.362283972.0000000003910000.00000002.00020000.sdmp, rundll32.exe, 00000004.00000002.648957709.0000000003410000.00000002.00020000.sdmp, rundll32.exe, 0000000E.00000002.649564710.00000000039E0000.00000002.00020000.sdmp, rundll32.exe, 00000010.00000000.596800440.0000000003280000.00000002.00020000.sdmp, rundll32.exe, 00000011.00000000.590761143.0000000003610000.00000002.00020000.sdmp, rundll32.exe, 00000012.00000000.637219700.0000000003280000.00000002.00020000.sdmp, rundll32.exe, 00000013.00000000.632972734.0000000003280000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: loaddll32.exe, 00000000.00000002.646808145.00000000019A0000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000000.362283972.0000000003910000.00000002.00020000.sdmp, rundll32.exe, 00000004.00000002.648957709.0000000003410000.00000002.00020000.sdmp, rundll32.exe, 0000000E.00000002.649564710.00000000039E0000.00000002.00020000.sdmp, rundll32.exe, 00000010.00000000.596800440.0000000003280000.00000002.00020000.sdmp, rundll32.exe, 00000011.00000000.590761143.0000000003610000.00000002.00020000.sdmp, rundll32.exe, 00000012.00000000.637219700.0000000003280000.00000002.00020000.sdmp, rundll32.exe, 00000013.00000000.632972734.0000000003280000.00000002.00020000.sdmp	Binary or memory string: SProgram Managerl
Source: loaddll32.exe, 00000000.00000002.646808145.00000000019A0000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000000.362283972.0000000003910000.00000002.00020000.sdmp, rundll32.exe, 00000004.00000002.648957709.0000000003410000.00000002.00020000.sdmp, rundll32.exe, 0000000E.00000002.649564710.00000000039E0000.00000002.00020000.sdmp, rundll32.exe, 00000010.00000000.596800440.0000000003280000.00000002.00020000.sdmp, rundll32.exe, 00000011.00000000.590761143.0000000003610000.00000002.00020000.sdmp, rundll32.exe, 00000012.00000000.637219700.0000000003280000.00000002.00020000.sdmp, rundll32.exe, 00000013.00000000.632972734.0000000003280000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd,
Source: loaddll32.exe, 00000000.00000002.646808145.00000000019A0000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000000.362283972.0000000003910000.00000002.00020000.sdmp, rundll32.exe, 00000004.00000002.648957709.0000000003410000.00000002.00020000.sdmp, rundll32.exe, 0000000E.00000002.649564710.00000000039E0000.00000002.00020000.sdmp, rundll32.exe, 00000010.00000000.596800440.0000000003280000.00000002.00020000.sdmp, rundll32.exe, 00000011.00000000.590761143.0000000003610000.00000002.00020000.sdmp, rundll32.exe, 00000012.00000000.637219700.0000000003280000.00000002.00020000.sdmp, rundll32.exe, 00000013.00000000.632972734.0000000003280000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Contains functionality to query locales information (e.g. system language)

Source: C:\Windows\System32\loaddll32.exe

Code function: GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA,

0_2_6ECF6D50

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

0_2_6ECF6D50

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
66.147.235.11	unknown	United States	23535	HOSTROCKETUS	true
149.202.179.100	unknown	France	16276	OVHFR	true
81.0.236.89	unknown	Czech Republic	15685	CASABLANCA-ASInternetCollocationProviderCZ	true

AV Detection:

Found malware configuration

Source: 4.2.rundll32.exe.6ecf0000.2.unpack

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll	Virustotal: Detection: 21%			Perma Link
Source: SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll	ReversingLabs: Detection: 31%

Machine Learning detection for sample

Source: SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll

Joe Sandbox ML: detected

Antivirus or Machine Learning detection for unpacked file

Source: 19.0.rundll32.exe.754756.4.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 18.0.rundll32.exe.4764756.4.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 19.2.rundll32.exe.5b0000.0.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 19.0.rundll32.exe.5b0000.0.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 17.0.rundll32.exe.4af4756.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 17.2.rundll32.exe.f70000.0.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 3.0.rundll32.exe.4df4756.4.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.2.loaddll32.exe.1250000.0.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 3.0.rundll32.exe.3300000.0.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 14.2.rundll32.exe.3464756.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 19.0.rundll32.exe.754756.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 19.0.rundll32.exe.5b0000.3.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 18.0.rundll32.exe.4764756.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 18.2.rundll32.exe.c00000.0.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 17.0.rundll32.exe.f70000.3.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 3.0.rundll32.exe.3300000.3.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 19.2.rundll32.exe.754756.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 4.2.rundll32.exe.e94756.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 18.2.rundll32.exe.4764756.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 16.0.rundll32.exe.b20000.3.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 17.0.rundll32.exe.f70000.0.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 16.0.rundll32.exe.b20000.0.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 4.2.rundll32.exe.bd0000.0.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 0.2.loaddll32.exe.15e4756.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 16.0.rundll32.exe.1144756.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 17.2.rundll32.exe.4af4756.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 3.0.rundll32.exe.4df4756.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 18.0.rundll32.exe.c00000.3.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 17.0.rundll32.exe.4af4756.4.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 18.0.rundll32.exe.c00000.0.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 14.2.rundll32.exe.fc0000.0.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 16.0.rundll32.exe.1144756.4.unpack	Avira: Label: TR/Patched.Ren.Gen

Compliance:

Uses 32bit PE files

Source: SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: rpidebbfll.pdb source: SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll
Source:	Binary string: wntdll.pdbUGP source: rundll32.exe, 00000004.00000003.352818755.000000004B280000.00000004.00000001.sdmp, rundll32.exe, 0000000E.00000003.595500849.000000004B280000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: rundll32.exe, 00000004.00000003.352818755.000000004B280000.00000004.00000001.sdmp, rundll32.exe, 0000000E.00000003.595500849.000000004B280000.00000004.00000001.sdmp

Networking:

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	IPs: 149.202.179.100:443
Source: Malware configuration extractor	IPs: 66.147.235.11:6891
Source: Malware configuration extractor	IPs: 81.0.236.89:13786

Internet Provider seen in connection with other malware

Source: Joe Sandbox View	ASN Name: HOSTROCKETUS HOSTROCKETUS
Source: Joe Sandbox View	ASN Name: OVHFR OVHFR

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 66.147.235.11 66.147.235.11
Source: Joe Sandbox View	IP Address: 149.202.179.100 149.202.179.100
Source: Joe Sandbox View	IP Address: 81.0.236.89 81.0.236.89

String found in binary or memory: http://www.vomfass.deDVarFileInfo$

E-Banking Fraud:

Yara detected Dridex unpacked file

Source: Yara match	File source: 17.0.rundll32.exe.6ecf0000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.0.rundll32.exe.6ecf0000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.6ecf0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.rundll32.exe.6ecf0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.rundll32.exe.6ecf0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.6ecf0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.0.rundll32.exe.6ecf0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.6ecf0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.rundll32.exe.6ecf0000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.0.rundll32.exe.6ecf0000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.rundll32.exe.6ecf0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.rundll32.exe.6ecf0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.rundll32.exe.6ecf0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.0.rundll32.exe.6ecf0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.0.rundll32.exe.6ecf0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.650424736.000000006ECF1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000000.633029380.000000006ECF1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.647984137.000000006ECF1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000000.639692678.000000006ECF1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.372154068.000000006ECF1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000000.609752932.000000006ECF1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.647602284.000000006ECF1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000000.640582271.000000006ECF1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.648668483.000000006ECF1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.649606375.000000006ECF1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.646115407.000000006ECF1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000000.614518127.000000006ECF1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000000.600008382.000000006ECF1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000000.631903118.000000006ECF1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000000.600571038.000000006ECF1000.00000020.00020000.sdmp, type: MEMORY

System Summary:

Found detection on Joe Sandbox Cloud Basic with higher score

Source: SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll

Joe Sandbox Cloud Basic: Detection: malicious Score: 76 Threat Name: Dridex

Perma Link

Uses 32bit PE files

Source: SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Sample file is different than original file name gathered from version info

Source: SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll

Binary or memory string: OriginalFilenameddlb.dll vs SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll

One or more processes crash

Source: C:\Windows\SysWOW64\rundll32.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5964 -s 664

Detected potential crypto function

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED00754	0_2_6ED00754
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED09348	0_2_6ED09348
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ECF1494	0_2_6ECF1494
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ECF846C	0_2_6ECF846C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED01460	0_2_6ED01460
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED01D58	0_2_6ED01D58
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ECFA52C	0_2_6ECFA52C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ECF90CC	0_2_6ECF90CC

Source: SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll	Virustotal: Detection: 21%
Source: SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll	ReversingLabs: Detection: 31%

Source: SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll,FFRgpmdlwwWde

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll'
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll,FFRgpmdlwwWde
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll',CheckTrust
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll',DllCanUnloadNow
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll',DllGetClassObject
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll',DownloadFile
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll',GetICifFileFromFile
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5964 -s 664
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 664
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5964 -s 664
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6120 -s 664
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 664
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll',#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll,FFRgpmdlwwWde	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll',CheckTrust	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll',DllCanUnloadNow	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll',DllGetClassObject	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll',DownloadFile	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll',GetICifFileFromFile	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll',#1	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5964 -s 664	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 664	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6120 -s 664	Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6120
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5964
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2212

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WERA390.tmp

Jump to behavior

Source: classification engine

Classification label: mal84.troj.evad.winDLL@28/11@0/3

Source: SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll

Static file information: File size 1093632 > 1048576

Source: SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: rpidebbfll.pdb source: SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll
Source:	Binary string: wntdll.pdbUGP source: rundll32.exe, 00000004.00000003.352818755.000000004B280000.00000004.00000001.sdmp, rundll32.exe, 0000000E.00000003.595500849.000000004B280000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: rundll32.exe, 00000004.00000003.352818755.000000004B280000.00000004.00000001.sdmp, rundll32.exe, 0000000E.00000003.595500849.000000004B280000.00000004.00000001.sdmp

Data Obfuscation:

Uses code obfuscation techniques (call, push, ret)

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6ECFF6CC push esi; mov dword ptr [esp], 00000000h

0_2_6ECFF6CD

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Tries to delay execution (extensive OutputDebugStringW loop)

Source: C:\Windows\SysWOW64\rundll32.exe

Section loaded: OutputDebugStringW count: 448

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Windows\SysWOW64\rundll32.exe

Window / User API: threadDelayed 426

Jump to behavior

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\System32\loaddll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed

Source: C:\Windows\System32\loaddll32.exe

Thread delayed: delay time: 120000

Jump to behavior

Source: WERD744.tmp.WERInternalMetadata.xml.29.dr	Binary or memory string: <SystemManufacturer>VMware, Inc.</SystemManufacturer>
Source: WERDCC3.tmp.xml.29.dr	Binary or memory string: <arg nm="syspro" val="VMware7,1" />
Source: WERD744.tmp.WERInternalMetadata.xml.29.dr	Binary or memory string: <SystemProductName>VMware7,1</SystemProductName>
Source: WERDCC3.tmp.xml.29.dr	Binary or memory string: <arg nm="sysmfg" val="VMware, Inc." />

Anti Debugging:

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Source: C:\Windows\System32\loaddll32.exe

0_2_6ECF6D50

Launches processes in debugging mode, may be used to hinder debugging

Source: C:\Windows\SysWOW64\rundll32.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5964 -s 664

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll',#1	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5964 -s 664	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 664	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6120 -s 664	Jump to behavior

Source: loaddll32.exe, 00000000.00000002.646808145.00000000019A0000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000000.362283972.0000000003910000.00000002.00020000.sdmp, rundll32.exe, 00000004.00000002.648957709.0000000003410000.00000002.00020000.sdmp, rundll32.exe, 0000000E.00000002.649564710.00000000039E0000.00000002.00020000.sdmp, rundll32.exe, 00000010.00000000.596800440.0000000003280000.00000002.00020000.sdmp, rundll32.exe, 00000011.00000000.590761143.0000000003610000.00000002.00020000.sdmp, rundll32.exe, 00000012.00000000.637219700.0000000003280000.00000002.00020000.sdmp, rundll32.exe, 00000013.00000000.632972734.0000000003280000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: loaddll32.exe, 00000000.00000002.646808145.00000000019A0000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000000.362283972.0000000003910000.00000002.00020000.sdmp, rundll32.exe, 00000004.00000002.648957709.0000000003410000.00000002.00020000.sdmp, rundll32.exe, 0000000E.00000002.649564710.00000000039E0000.00000002.00020000.sdmp, rundll32.exe, 00000010.00000000.596800440.0000000003280000.00000002.00020000.sdmp, rundll32.exe, 00000011.00000000.590761143.0000000003610000.00000002.00020000.sdmp, rundll32.exe, 00000012.00000000.637219700.0000000003280000.00000002.00020000.sdmp, rundll32.exe, 00000013.00000000.632972734.0000000003280000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: loaddll32.exe, 00000000.00000002.646808145.00000000019A0000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000000.362283972.0000000003910000.00000002.00020000.sdmp, rundll32.exe, 00000004.00000002.648957709.0000000003410000.00000002.00020000.sdmp, rundll32.exe, 0000000E.00000002.649564710.00000000039E0000.00000002.00020000.sdmp, rundll32.exe, 00000010.00000000.596800440.0000000003280000.00000002.00020000.sdmp, rundll32.exe, 00000011.00000000.590761143.0000000003610000.00000002.00020000.sdmp, rundll32.exe, 00000012.00000000.637219700.0000000003280000.00000002.00020000.sdmp, rundll32.exe, 00000013.00000000.632972734.0000000003280000.00000002.00020000.sdmp	Binary or memory string: SProgram Managerl
Source: loaddll32.exe, 00000000.00000002.646808145.00000000019A0000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000000.362283972.0000000003910000.00000002.00020000.sdmp, rundll32.exe, 00000004.00000002.648957709.0000000003410000.00000002.00020000.sdmp, rundll32.exe, 0000000E.00000002.649564710.00000000039E0000.00000002.00020000.sdmp, rundll32.exe, 00000010.00000000.596800440.0000000003280000.00000002.00020000.sdmp, rundll32.exe, 00000011.00000000.590761143.0000000003610000.00000002.00020000.sdmp, rundll32.exe, 00000012.00000000.637219700.0000000003280000.00000002.00020000.sdmp, rundll32.exe, 00000013.00000000.632972734.0000000003280000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd,
Source: loaddll32.exe, 00000000.00000002.646808145.00000000019A0000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000000.362283972.0000000003910000.00000002.00020000.sdmp, rundll32.exe, 00000004.00000002.648957709.0000000003410000.00000002.00020000.sdmp, rundll32.exe, 0000000E.00000002.649564710.00000000039E0000.00000002.00020000.sdmp, rundll32.exe, 00000010.00000000.596800440.0000000003280000.00000002.00020000.sdmp, rundll32.exe, 00000011.00000000.590761143.0000000003610000.00000002.00020000.sdmp, rundll32.exe, 00000012.00000000.637219700.0000000003280000.00000002.00020000.sdmp, rundll32.exe, 00000013.00000000.632972734.0000000003280000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Contains functionality to query locales information (e.g. system language)

Source: C:\Windows\System32\loaddll32.exe

0_2_6ECF6D50

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

0_2_6ECF6D50

ID:	510686
Product:	CloudBasic
Start time:	05:00:21
Start date:	28.10.2021
Sample:	SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	e53a16bea7918b1f7d4c0e659febc766
SHA1:	10d4d3d7fac35f6492cda2fb04aebf46903481f0
SHA256:	212cae7b05ecbc938b3a1fda4753d119f69360165955937b836fdbc7a6d514eb
Filetype:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60%

Name	Type	MD5	SHA1	SHA256
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_5f8c232292098bd3183b3bd76fd57ba47bd4c4b_82810a17_06dfdcd0\Report.wer	Little-endian UTF-16 Unicode text, with CRLF line terminators	CCEA7058269A40866547402C32B0E12A	638C28D714E87A2B1FB9CB76E65AD4D2B4590188	F6F42848EC901990E01446A63B6D3C218D982C9EDE770F8F2EF969F89DFA9784
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_c316961cf9547f4477c913cd7ccdecd11bd19_82810a17_09efd927\Report.wer	Little-endian UTF-16 Unicode text, with CRLF line terminators	F9E87888FA317EC87A8C755DABBD2C66	2585D9C93809CA4DCAAC39D1043DDC702B304E7B	4E8B0739F101D95B13071B6D33751157C8C63543C2DB4E3284FEEFBFADC7FC76
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA390.tmp.dmp	Mini DuMP crash report, 14 streams, Thu Oct 28 12:04:12 2021, 0x1205a4 type	8CF91AF0FC9D82647FF152F00E0ABB6D	103DBA4D056EFF05F8345517C2BA7AC414F26D9E	29ECC9C3001CD194DCF145DFFB73DBCA4B837C4B2149C17D71D53116565AA066
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA620.tmp.dmp	Mini DuMP crash report, 14 streams, Thu Oct 28 12:04:16 2021, 0x1205a4 type	468455B7C32BF823B1C70B241AE47E54	223BDB9E503CFD93134F2C6E483E2C4DF8988DF1	34F7C9D2E1A24E6AAB9B70238812FF524DDFEBF19831518AC382D043E8840695
C:\ProgramData\Microsoft\Windows\WER\Temp\WERB2D3.tmp.WERInternalMetadata.xml	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators	4151D17A289312C107FEF6FE5FA3E5FF	2B297AAFA3784FC32650B8CFE6DF8BD196458B99	71ADDB34D643ADE60DDD00AC3AC9E33196DD3B07BDA0F076A9ED80DE939E5735
C:\ProgramData\Microsoft\Windows\WER\Temp\WERB72A.tmp.xml	XML 1.0 document, ASCII text, with CRLF line terminators	06579D1301DAEF503B82F588180B029A	C263EDC496EF1D914E283FBDFC88A5B65F0922E3	35DDB8B7C1A4B7876F5A16764FCAF68C294059CCEC731170EAC34F83CD188FD3
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC169.tmp.dmp	Mini DuMP crash report, 14 streams, Thu Oct 28 12:04:22 2021, 0x1205a4 type	BB604FE41CE924CB88F14A53F73D55EB	8C9E0289CF2584A1CF5AB36BB03075A58F241973	A6CC4560B4BA9D45267FD3DF8F74416B64E369987F5A2714692B993350E5A305
C:\ProgramData\Microsoft\Windows\WER\Temp\WERCB3D.tmp.WERInternalMetadata.xml	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators	24BAA055B5D6B7C373D05EC5658733A3	548FA50C505A0568902159D4532345A14DD29058	703245EC3E5129BACCE3A5A8344AC60EFF8A9C6CBB8F1578523A447EA77D4317
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD020.tmp.xml	XML 1.0 document, ASCII text, with CRLF line terminators	B54095CE6F524F7234526A5F8CC44462	649092155215605C275D23D39E1749BA88889D22	B7BFD695CB733D64A69960D5193D097DBEC835C9E65B0BA53CB35050F2259A1B
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD744.tmp.WERInternalMetadata.xml	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators	645AA25DE0930D788B806E66F3BD8FDC	49906A9C0683FD3C7112C33BB658CF67496BAC68	1B8281F03FDEAEB82D724B9838916FA84F40878B832A7348C4863CBCBF2D5EC4
C:\ProgramData\Microsoft\Windows\WER\Temp\WERDCC3.tmp.xml	XML 1.0 document, ASCII text, with CRLF line terminators	8985C591066C23F260D51139922D93A9	3BD08EC8716978765CA63D79685DF0EBD3FA1C35	26DBEF706EF369902902A44D2E952AB5484953AE03146F4735DBF84793E16EF7

Windows Analysis Report SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection:

Compliance:

Networking:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs