Windows Analysis Report SecuriteInfo.com.Variant.Razy.980776.9478.23455

AV Detection:

Found malware configuration

Source: 7.2.rundll32.exe.6e930000.0.unpack

Malware Configuration Extractor: Dridex {"Version": 10444, "C2 list": ["192.46.210.220:443", "143.244.140.214:808", "45.77.0.96:6891", "185.56.219.47:8116"], "RC4 keys": ["9fRysqcdPgZffBlroqJaZHyCvLvD6BUV", "syF7NqCylLS878kcIy9w5XeI8w6uMrqVwowz4h3uWHHlWsr5ELTiXic3wgqbllkcZyNGwPGihI"]}

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Variant.Razy.980776.9478.dll

ReversingLabs: Detection: 38%

Compliance:

Uses 32bit PE files

Source: SecuriteInfo.com.Variant.Razy.980776.9478.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 192.46.210.220:443 -> 192.168.2.3:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.46.210.220:443 -> 192.168.2.3:49743 version: TLS 1.2

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: SecuriteInfo.com.Variant.Razy.980776.9478.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Source:

Binary string: c:\Gun\208-town\521\exa\botto\party.pdb source: loaddll32.exe, 00000002.00000002.815295434.000000006E9F7000.00000002.00020000.sdmp, rundll32.exe, 00000007.00000002.816408400.000000006E9F7000.00000002.00020000.sdmp, SecuriteInfo.com.Variant.Razy.980776.9478.dll

Spreading:

Contains functionality to enumerate / list files inside a directory

Source: C:\Windows\System32\loaddll32.exe

Code function: 2_2_6E95CEF8 FindFirstFileExW,

2_2_6E95CEF8

Networking:

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 45.77.0.96 235			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 185.56.219.47 180			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 192.46.210.220 187			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 143.244.140.214 40			Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	IPs: 192.46.210.220:443
Source: Malware configuration extractor	IPs: 143.244.140.214:808
Source: Malware configuration extractor	IPs: 45.77.0.96:6891
Source: Malware configuration extractor	IPs: 185.56.219.47:8116

Internet Provider seen in connection with other malware

Source: Joe Sandbox View	ASN Name: AS-CHOOPAUS AS-CHOOPAUS
Source: Joe Sandbox View	ASN Name: KELIWEBIT KELIWEBIT

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 51c64c77e60f3980eea90869b68c58a8

HTTP GET or POST without a user agent

Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 45.77.0.96 45.77.0.96
Source: Joe Sandbox View	IP Address: 185.56.219.47 185.56.219.47

Detected TCP or UDP traffic on non-standard ports

Source: global traffic	TCP traffic: 192.168.2.3:49742 -> 143.244.140.214:808
Source: global traffic	TCP traffic: 192.168.2.3:49746 -> 45.77.0.96:6891
Source: global traffic	TCP traffic: 192.168.2.3:49748 -> 185.56.219.47:8116

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 50134 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 50076 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50133 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 50100 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50142 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 50054 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50150 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50149 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50133
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50134
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50158 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50149
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50142
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50141
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50150
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 50086 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50166 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50157
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50158
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50166
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50165
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 50157 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 50030 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443

Tries to download or post to a non-existing HTTP route (HTTP/1.1 404 Not Found / 503 Service Unavailable / 403 Forbidden)

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:10 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:12 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:18 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:18 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:22 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:22 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:26 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:26 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:30 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:30 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:34 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:34 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:37 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:38 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:41 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:42 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:45 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:46 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:51 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:51 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:54 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:54 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:58 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:58 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:54:02 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:54:02 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:54:06 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:54:06 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:54:10 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:54:10 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:54:14 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:54:14 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:54:18 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:54:18 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:54:22 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:54:22 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:54:25 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:54:26 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:54:29 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:54:29 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:54:33 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:54:33 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:54:37 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:54:37 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:54:41 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:54:41 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:54:45 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:54:45 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:54:49 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:54:49 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:54:53 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:54:53 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:54:57 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:54:57 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:55:00 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:55:00 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:55:04 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:55:04 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:55:09 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:55:10 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:55:13 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:55:14 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:55:17 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:55:18 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:55:21 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:55:22 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:55:25 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:55:25 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:55:29 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:55:29 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:55:33 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:55:33 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:55:36 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:55:37 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:55:42 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:55:43 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:55:46 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:55:46 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:55:50 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:55:50 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:55:54 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:55:54 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:55:58 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:55:58 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:56:02 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:56:02 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:56:06 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:56:06 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:56:10 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:56:10 GMTContent-Type: text/plain; charset=utf-8Connection: close

Connects to IPs without corresponding DNS lookups

Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 185.56.219.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.56.219.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.56.219.47
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 185.56.219.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.56.219.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.56.219.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.56.219.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.56.219.47

URLs found in memory or binary data

Source: loaddll32.exe, 00000002.00000003.457412694.0000000000F57000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000003.487949283.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: rundll32.exe, 00000007.00000003.430153868.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/
Source: rundll32.exe, 00000007.00000003.430153868.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/Gq
Source: rundll32.exe, 00000007.00000002.815150304.00000000032FA000.00000004.00000020.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: loaddll32.exe, 00000002.00000003.457412694.0000000000F57000.00000004.00000001.sdmp, 77EC63BDA74BD0D0E0426DC8F8008506.7.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: rundll32.exe, 00000007.00000003.430285368.000000000541D000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000002.815150304.00000000032FA000.00000004.00000020.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?561c40c84f427
Source: rundll32.exe, 00000007.00000003.487949283.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabv
Source: loaddll32.exe, 00000002.00000003.457412694.0000000000F57000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000003.487949283.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214/
Source: rundll32.exe, 00000007.00000003.421191267.000000000336A000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214/Ev
Source: loaddll32.exe, 00000002.00000003.457412694.0000000000F57000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000003.487949283.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/
Source: rundll32.exe, 00000007.00000003.685102476.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/.140.214:808/la
Source: rundll32.exe, 00000007.00000002.815270694.0000000003361000.00000004.00000020.sdmp	String found in binary or memory: https://143.244.140.214:808/Gq
Source: loaddll32.exe, 00000002.00000003.474152776.0000000000F57000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000003.524322961.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/My
Source: rundll32.exe, 00000007.00000002.815270694.0000000003361000.00000004.00000020.sdmp	String found in binary or memory: https://143.244.140.214:808/P
Source: loaddll32.exe, 00000002.00000003.457412694.0000000000F57000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/W
Source: loaddll32.exe, 00000002.00000003.457412694.0000000000F57000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000003.496322195.0000000003361000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000003.421191267.000000000336A000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/hy
Source: rundll32.exe, 00000007.00000003.590697653.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/hyQq
Source: rundll32.exe, 00000007.00000003.615902947.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/hybq
Source: loaddll32.exe, 00000002.00000003.789280519.0000000000F57000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000003.487949283.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/l
Source: rundll32.exe, 00000007.00000003.487949283.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/lGq
Source: rundll32.exe, 00000007.00000003.624273197.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/la
Source: rundll32.exe, 00000007.00000003.524322961.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/ll
Source: rundll32.exe, 00000007.00000003.565788704.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/llbq
Source: loaddll32.exe, 00000002.00000003.590990072.0000000000F5F000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000003.789346545.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/oft
Source: loaddll32.exe, 00000002.00000003.507704635.0000000000F59000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/z
Source: loaddll32.exe, 00000002.00000002.813943136.0000000000F4C000.00000004.00000020.sdmp	String found in binary or memory: https://182.46.210.220/
Source: rundll32.exe, 00000007.00000002.815270694.0000000003361000.00000004.00000020.sdmp	String found in binary or memory: https://183.244.140.214:808/
Source: rundll32.exe, 00000007.00000003.487949283.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47/
Source: rundll32.exe, 00000007.00000003.487949283.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47/-
Source: loaddll32.exe, 00000002.00000003.438385750.0000000000F5A000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47/T
Source: rundll32.exe, 00000007.00000003.487949283.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47/rm
Source: loaddll32.exe, 00000002.00000003.457412694.0000000000F57000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000003.487949283.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/
Source: loaddll32.exe, 00000002.00000003.780894009.0000000000F4C000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/4802
Source: rundll32.exe, 00000007.00000003.693220636.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/4H
Source: rundll32.exe, 00000007.00000003.565788704.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/814
Source: loaddll32.exe, 00000002.00000003.599359620.0000000000FCA000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/=-
Source: rundll32.exe, 00000007.00000003.487949283.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/D
Source: rundll32.exe, 00000007.00000003.454521385.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/ES
Source: rundll32.exe, 00000007.00000003.734581021.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/F
Source: rundll32.exe, 00000007.00000003.632573369.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/M
Source: loaddll32.exe, 00000002.00000002.814006156.0000000000F58000.00000004.00000020.sdmp	String found in binary or memory: https://185.56.219.47:8116/Ps%
Source: rundll32.exe, 00000007.00000003.590697653.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/fW
Source: rundll32.exe, 00000007.00000003.693220636.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/j
Source: rundll32.exe, 00000007.00000003.487949283.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/l
Source: loaddll32.exe, 00000002.00000003.538347137.0000000000F57000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000003.487949283.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/ll
Source: rundll32.exe, 00000007.00000003.746859571.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/llo
Source: loaddll32.exe, 00000002.00000003.457412694.0000000000F57000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/y$7
Source: rundll32.exe, 00000007.00000003.487949283.0000000003361000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000003.438132004.0000000003361000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000003.734581021.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/
Source: rundll32.exe, 00000007.00000003.734581021.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/(r
Source: rundll32.exe, 00000007.00000003.454521385.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/-
Source: rundll32.exe, 00000007.00000003.496322195.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/.Q
Source: rundll32.exe, 00000007.00000003.734581021.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/0
Source: loaddll32.exe, 00000002.00000003.451141108.0000000000F57000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/3
Source: loaddll32.exe, 00000002.00000003.457412694.0000000000F57000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/5
Source: rundll32.exe, 00000007.00000003.487949283.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/563209-4053062332-1002
Source: rundll32.exe, 00000007.00000003.487949283.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/563209-4053062332-1002L
Source: rundll32.exe, 00000007.00000003.615902947.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/563209-4053062332-1002y
Source: rundll32.exe, 00000007.00000003.479578980.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/6Q
Source: loaddll32.exe, 00000002.00000002.814100062.0000000000F98000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/Aq
Source: loaddll32.exe, 00000002.00000003.451141108.0000000000F57000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/B
Source: rundll32.exe, 00000007.00000003.438132004.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/BQ
Source: loaddll32.exe, 00000002.00000002.814100062.0000000000F98000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000003.487949283.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/Certification
Source: rundll32.exe, 00000007.00000003.624273197.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/FQ
Source: rundll32.exe, 00000007.00000003.615902947.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/GlobalSign
Source: rundll32.exe, 00000007.00000003.487949283.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/Im
Source: rundll32.exe, 00000007.00000003.615902947.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/Is
Source: loaddll32.exe, 00000002.00000003.507704635.0000000000F59000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000002.815150304.00000000032FA000.00000004.00000020.sdmp	String found in binary or memory: https://192.46.210.220/K
Source: loaddll32.exe, 00000002.00000002.814100062.0000000000F98000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/P6
Source: loaddll32.exe, 00000002.00000002.814100062.0000000000F98000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/S
Source: loaddll32.exe, 00000002.00000003.507704635.0000000000F59000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/T
Source: rundll32.exe, 00000007.00000003.487949283.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/Vs
Source: rundll32.exe, 00000007.00000003.438132004.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/_s
Source: loaddll32.exe, 00000002.00000003.640878974.0000000000F55000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/aenh.dll
Source: rundll32.exe, 00000007.00000003.734581021.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/en-US
Source: rundll32.exe, 00000007.00000003.496358216.0000000005416000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000003.565824893.0000000005416000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/graphy
Source: rundll32.exe, 00000007.00000003.565788704.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/jQ
Source: rundll32.exe, 00000007.00000003.693267353.0000000005416000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/liuS
Source: rundll32.exe, 00000007.00000003.487949283.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/nQ
Source: rundll32.exe, 00000007.00000003.516053522.0000000005416000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000003.693267353.0000000005416000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/ography
Source: rundll32.exe, 00000007.00000003.615902947.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/rs
Source: loaddll32.exe, 00000002.00000003.591088945.0000000000F58000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/y
Source: rundll32.exe, 00000007.00000003.487949283.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/zQ
Source: rundll32.exe, 00000007.00000003.430153868.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://19dl.windowsupdate.com/
Source: loaddll32.exe, 00000002.00000003.457412694.0000000000F57000.00000004.00000001.sdmp	String found in binary or memory: https://45.7-
Source: rundll32.exe, 00000007.00000003.471262416.00000000033A1000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96/
Source: rundll32.exe, 00000007.00000003.433791949.000000000339E000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96/-
Source: loaddll32.exe, 00000002.00000003.457412694.0000000000F57000.00000004.00000001.sdmp, loaddll32.exe, 00000002.00000003.615853148.0000000000F58000.00000004.00000001.sdmp, loaddll32.exe, 00000002.00000003.451150859.0000000000F60000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000003.746888787.0000000005416000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/
Source: rundll32.exe, 00000007.00000003.524364338.0000000005416000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/.0.96:6891/
Source: rundll32.exe, 00000007.00000003.565824893.0000000005416000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/.0.96:6891/liuS
Source: loaddll32.exe, 00000002.00000003.434212982.0000000000F5A000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/08/
Source: loaddll32.exe, 00000002.00000003.451150859.0000000000F60000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/08/l
Source: loaddll32.exe, 00000002.00000003.434212982.0000000000F5A000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/14
Source: rundll32.exe, 00000007.00000003.693220636.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/14M
Source: loaddll32.exe, 00000002.00000003.640878974.0000000000F55000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/899f5f57b9a
Source: rundll32.exe, 00000007.00000003.438113449.00000000033D1000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/9
Source: rundll32.exe, 00000007.00000002.815937821.0000000005413000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000003.524364338.0000000005416000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000003.734607197.0000000005416000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000003.590739605.0000000005416000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/Microsoft
Source: loaddll32.exe, 00000002.00000003.451150859.0000000000F60000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/Q%
Source: rundll32.exe, 00000007.00000002.815937821.0000000005413000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/Rf
Source: rundll32.exe, 00000007.00000003.524364338.0000000005416000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/Vi
Source: loaddll32.exe, 00000002.00000003.434212982.0000000000F5A000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/der
Source: rundll32.exe, 00000007.00000003.487977022.0000000005416000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000002.815937821.0000000005413000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000003.516053522.0000000005416000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/graphy
Source: loaddll32.exe, 00000002.00000003.649139573.0000000000F55000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000002.815358842.00000000033D1000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/q
Source: loaddll32.exe, 00000002.00000003.484765322.0000000000F56000.00000004.00000001.sdmp, loaddll32.exe, 00000002.00000003.715289859.0000000000F54000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000003.433750522.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/r
Source: rundll32.exe, 00000007.00000002.815358842.00000000033D1000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/rY
Source: rundll32.exe, 00000007.00000003.565824893.0000000005416000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/ri
Source: loaddll32.exe, 00000002.00000003.591079359.0000000000F4C000.00000004.00000001.sdmp	String found in binary or memory: https://452.46.210.220/

Posts data to webserver

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache

Contains functionality to download additional files from the internet

Source: C:\Windows\System32\loaddll32.exe

Code function: 2_2_6E9639F9 InternetReadFile,

2_2_6E9639F9

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 192.46.210.220:443 -> 192.168.2.3:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.46.210.220:443 -> 192.168.2.3:49743 version: TLS 1.2

E-Banking Fraud:

Yara detected Dridex unpacked file

Source: Yara match	File source: 9.3.rundll32.exe.46edb55.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.3.rundll32.exe.46edb55.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.3.rundll32.exe.8edb55.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.loaddll32.exe.10edb55.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.rundll32.exe.7ddb55.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.rundll32.exe.7ddb55.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.loaddll32.exe.10edb55.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.6e930000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.loaddll32.exe.6e930000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.3.rundll32.exe.31bdb55.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.3.rundll32.exe.31bdb55.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.3.rundll32.exe.8edb55.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000003.411045678.00000000046D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.816097382.000000006E931000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.380770170.00000000007C0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.815049595.000000006E931000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.400629828.00000000008D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.413004072.00000000010D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.381345345.00000000031A0000.00000040.00000001.sdmp, type: MEMORY

Detected Dridex e-Banking trojan

Source: C:\Windows\System32\loaddll32.exe

Code function: 2_2_6E9351A7 OutputDebugStringA,Sleep,OutputDebugStringA,OutputDebugStringA,Sleep,OutputDebugStringA,OutputDebugStringA,Sleep,OutputDebugStringA,OutputDebugStringA,Sleep,OutputDebugStringA,GetAdaptersInfo,

2_2_6E9351A7

System Summary:

Uses 32bit PE files

Source: SecuriteInfo.com.Variant.Razy.980776.9478.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Detected potential crypto function

Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E9467C8		2_2_6E9467C8
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E94AE80		2_2_6E94AE80
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E948AB0		2_2_6E948AB0
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E9526B0		2_2_6E9526B0
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E951EB0		2_2_6E951EB0
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E936AD0		2_2_6E936AD0
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E9496D0		2_2_6E9496D0
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E95FA10		2_2_6E95FA10
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E953EC0		2_2_6E953EC0
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E948EF0		2_2_6E948EF0
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E94B6F0		2_2_6E94B6F0
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E9562F0		2_2_6E9562F0
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E94F6E0		2_2_6E94F6E0
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E93CA10		2_2_6E93CA10
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E95FA10		2_2_6E95FA10
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E950220		2_2_6E950220
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E95D620		2_2_6E95D620
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E951240		2_2_6E951240
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E939E70		2_2_6E939E70
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E949E70		2_2_6E949E70
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E94A660		2_2_6E94A660
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E957660		2_2_6E957660
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E952E60		2_2_6E952E60
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E93B79B		2_2_6E93B79B
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E931784		2_2_6E931784
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E9483C0		2_2_6E9483C0
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E947FC0		2_2_6E947FC0
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E957FC0		2_2_6E957FC0
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E94E3F0		2_2_6E94E3F0
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E959B10		2_2_6E959B10
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E953B00		2_2_6E953B00
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E951730		2_2_6E951730
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E94BF50		2_2_6E94BF50
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E945B60		2_2_6E945B60
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E955CB0		2_2_6E955CB0
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E94E0A0		2_2_6E94E0A0
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E954CA0		2_2_6E954CA0
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E9550A0		2_2_6E9550A0
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E95DCA0		2_2_6E95DCA0
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E94A0D0		2_2_6E94A0D0
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E9498DA		2_2_6E9498DA
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E9488C0		2_2_6E9488C0
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E948CC0		2_2_6E948CC0
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E94D030		2_2_6E94D030
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E951020		2_2_6E951020
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E94C590		2_2_6E94C590
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E94D980		2_2_6E94D980
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E95D180		2_2_6E95D180
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E93F9A0		2_2_6E93F9A0
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E94FDD0		2_2_6E94FDD0
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E9589F0		2_2_6E9589F0
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E9571F0		2_2_6E9571F0
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E947564		2_2_6E947564
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_6E97E210		7_2_6E97E210

Contains functionality to call native functions

Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E9422A0 NtDelayExecution,		2_2_6E9422A0
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E95BE30 NtClose,		2_2_6E95BE30

Sample is known by Antivirus

Source: SecuriteInfo.com.Variant.Razy.980776.9478.dll

ReversingLabs: Detection: 38%

PE file has an executable .text section and no other executable section

Source: SecuriteInfo.com.Variant.Razy.980776.9478.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads software policies

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.9478.dll'
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.9478.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.9478.dll,Bluewing
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.9478.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.9478.dll,Earth
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.9478.dll,Masterjust
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.9478.dll',#1			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.9478.dll,Bluewing			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.9478.dll,Earth			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.9478.dll,Masterjust			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.9478.dll',#1			Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Windows\System32\loaddll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Classification label

Source: classification engine

Classification label: mal84.bank.troj.evad.winDLL@11/1@0/4

Runs a DLL by calling functions

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.9478.dll,Bluewing

Found detection on Joe Sandbox Cloud Basic with higher score

Source: SecuriteInfo.com.Variant.Razy.980776.9478.23455

Joe Sandbox Cloud Basic: Detection: clean Score: 0

Perma Link

Reads the hosts file

Source: C:\Windows\SysWOW64\rundll32.exe

File read: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Found GUI installer (many successful clicks)

Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK

Submission file is bigger than most known malware samples

Source: SecuriteInfo.com.Variant.Razy.980776.9478.dll

Static file information: File size 1375232 > 1048576

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: SecuriteInfo.com.Variant.Razy.980776.9478.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

PE file contains a debug data directory

Source: SecuriteInfo.com.Variant.Razy.980776.9478.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Binary contains paths to debug symbols

Source:

Binary string: c:\Gun\208-town\521\exa\botto\party.pdb source: loaddll32.exe, 00000002.00000002.815295434.000000006E9F7000.00000002.00020000.sdmp, rundll32.exe, 00000007.00000002.816408400.000000006E9F7000.00000002.00020000.sdmp, SecuriteInfo.com.Variant.Razy.980776.9478.dll

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\System32\loaddll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed

Contains functionality to query network adapater information

Source: C:\Windows\System32\loaddll32.exe

Code function: OutputDebugStringA,Sleep,OutputDebugStringA,OutputDebugStringA,Sleep,OutputDebugStringA,OutputDebugStringA,Sleep,OutputDebugStringA,OutputDebugStringA,Sleep,OutputDebugStringA,GetAdaptersInfo,

2_2_6E9351A7

Contains functionality to query system information

Source: C:\Windows\System32\loaddll32.exe

Code function: 2_2_6E943930 GetTokenInformation,GetTokenInformation,GetSystemInfo,GetTokenInformation,

2_2_6E943930

Contains functionality to enumerate / list files inside a directory

Source: C:\Windows\System32\loaddll32.exe

Code function: 2_2_6E95CEF8 FindFirstFileExW,

2_2_6E95CEF8

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: rundll32.exe, 00000007.00000002.815256104.0000000003356000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAWM
Source: loaddll32.exe, 00000002.00000002.813943136.0000000000F4C000.00000004.00000020.sdmp, rundll32.exe, 00000007.00000002.815256104.0000000003356000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW
Source: loaddll32.exe, 00000002.00000002.813943136.0000000000F4C000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAWd

Anti Debugging:

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 7_2_6E9A97B0 IsDebuggerPresent,IsDebuggerPresent,CreateThread,std::_Timevec::_Timevec,WaitForSingleObjectEx,

7_2_6E9A97B0

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 7_2_6E9A8B60 __invoke_watson_if_error,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,__strftime_l,__aligned_msize,__invoke_watson_if_error,__aligned_msize,__invoke_watson_if_error,__aligned_msize,__invoke_watson_if_error,__aligned_msize,__invoke_watson_if_error,__aligned_msize,__invoke_watson_if_error,__aligned_msize,__invoke_watson_if_error,__aligned_msize,__invoke_watson_if_error,__cftoe,__aligned_msize,__invoke_watson_if_error,GetFileType,WriteConsoleW,GetLastError,__cftoe,WriteFile,WriteFile,OutputDebugStringW,__invoke_watson_if_error,__CrtDbgReportWV,

7_2_6E9A8B60

Contains functionality to read the PEB

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_6E9A47C0 mov ecx, dword ptr fs:[00000030h]		7_2_6E9A47C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_6EA7BA72 mov eax, dword ptr fs:[00000030h]		7_2_6EA7BA72
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_6EA7B64D push dword ptr fs:[00000030h]		7_2_6EA7B64D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_6EA7B942 mov eax, dword ptr fs:[00000030h]		7_2_6EA7B942

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Source: C:\Windows\System32\loaddll32.exe

Code function: 2_2_6E946C50 KiUserExceptionDispatcher,LdrLoadDll,

2_2_6E946C50

Contains functionality to register its own exception handler

Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E947A60 RtlAddVectoredExceptionHandler,		2_2_6E947A60
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_6E9763A0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		7_2_6E9763A0

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 45.77.0.96 235			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 185.56.219.47 180			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 192.46.210.220 187			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 143.244.140.214 40			Jump to behavior

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.9478.dll',#1

Jump to behavior

May try to detect the Windows Explorer process (often used for injection)

Source: loaddll32.exe, 00000002.00000002.814515137.0000000001820000.00000002.00020000.sdmp, rundll32.exe, 00000007.00000002.815474501.0000000003780000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: loaddll32.exe, 00000002.00000002.814515137.0000000001820000.00000002.00020000.sdmp, rundll32.exe, 00000007.00000002.815474501.0000000003780000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: loaddll32.exe, 00000002.00000002.814515137.0000000001820000.00000002.00020000.sdmp, rundll32.exe, 00000007.00000002.815474501.0000000003780000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: loaddll32.exe, 00000002.00000002.814515137.0000000001820000.00000002.00020000.sdmp, rundll32.exe, 00000007.00000002.815474501.0000000003780000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Contains functionality to query locales information (e.g. system language)

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,		7_2_6E9C1E60
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,GetACP,GetLocaleInfoW,		7_2_6E9C2750
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,		7_2_6E9C1F40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,		7_2_6E9AB0B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,		7_2_6E9ABC30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,		7_2_6E9C1DB0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,		7_2_6E9C2960

Queries the installation date of Windows

Source: C:\Windows\System32\loaddll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Jump to behavior

Queries the cryptographic machine GUID

Source: C:\Windows\System32\loaddll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Contains functionality to query the account / user name

Source: C:\Windows\System32\loaddll32.exe

Code function: 2_2_6E942980 GetUserNameW,

2_2_6E942980