Windows Analysis Report mal2.dll

AV Detection:

Found malware configuration

Source: 0.0.loaddll32.exe.d33b80.10.raw.unpack

Malware Configuration Extractor: Emotet {"C2 list": ["46.55.222.11:443", "104.245.52.73:8080", "41.76.108.46:8080", "103.8.26.103:8080", "185.184.25.237:8080", "103.8.26.102:8080", "203.114.109.124:443", "45.118.115.99:8080", "178.79.147.66:8080", "58.227.42.236:80", "45.118.135.203:7080", "103.75.201.2:443", "195.154.133.20:443", "45.142.114.231:8080", "212.237.5.209:443", "207.38.84.195:8080", "104.251.214.46:8080", "212.237.17.99:8080", "212.237.56.116:7080", "216.158.226.206:443", "110.232.117.186:8080", "158.69.222.101:443", "107.182.225.142:8080", "176.104.106.96:8080", "81.0.236.90:443", "50.116.54.215:443", "138.185.72.26:8080", "51.68.175.8:8080", "210.57.217.132:8080"], "Public Key": ["RUNTMSAAAABAX3S2xNjcDD0fBno33Ln5t71eii+mofIPoXkNFOX1MeiwCh48iz97kB0mJjGGZXwardnDXKxI8GCHGNl0PFj5", "RUNLMSAAAADzozW1Di4r9DVWzQpMKT588RDdy7BPILP6AiDOTLYMHkSWvrQO5slbmr1OvZ2Pz+AQWzRMggQmAtO6rPH7nyx2"]}

Multi AV Scanner detection for submitted file

Source: mal2.dll

ReversingLabs: Detection: 24%

Compliance:

Uses 32bit PE files

Source: mal2.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL, LARGE_ADDRESS_AWARE

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: mal2.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000016.00000003.584277033.00000000047F1000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.609321694.0000000004C21000.00000004.00000001.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000016.00000003.584277033.00000000047F1000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.609321694.0000000004C21000.00000004.00000001.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000016.00000003.573738619.0000000000F47000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.584277033.00000000047F1000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.609321694.0000000004C21000.00000004.00000001.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000016.00000003.584277033.00000000047F1000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.609321694.0000000004C21000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000016.00000003.584277033.00000000047F1000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.581262316.0000000000917000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.609321694.0000000004C21000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000016.00000003.584277033.00000000047F1000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.609321694.0000000004C21000.00000004.00000001.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000016.00000003.584277033.00000000047F1000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.609321694.0000000004C21000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000016.00000003.584277033.00000000047F1000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.603106130.0000000000B7D000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.609321694.0000000004C21000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.602476954.0000000000B7D000.00000004.00000001.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000016.00000003.584277033.00000000047F1000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.609321694.0000000004C21000.00000004.00000001.sdmp
Source:	Binary string: upwntdll.pdb source: WerFault.exe, 00000019.00000003.602237788.0000000000BBB000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000016.00000003.584277033.00000000047F1000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.609321694.0000000004C21000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdbk source: WerFault.exe, 00000016.00000003.584277033.00000000047F1000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.609321694.0000000004C21000.00000004.00000001.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000016.00000003.584277033.00000000047F1000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.609321694.0000000004C21000.00000004.00000001.sdmp
Source:	Binary string: oCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernel32.pdb source: WerFault.exe, 00000016.00000002.593818088.00000000003D2000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb( source: WerFault.exe, 00000019.00000003.603106130.0000000000B7D000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.602476954.0000000000B7D000.00000004.00000001.sdmp

Spreading:

Contains functionality to enumerate / list files inside a directory

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDC2FE7 FindFirstFileExW,		0_2_6EDC2FE7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDC2FE7 FindFirstFileExW,		2_2_6EDC2FE7

Networking:

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	IPs: 46.55.222.11:443
Source: Malware configuration extractor	IPs: 104.245.52.73:8080
Source: Malware configuration extractor	IPs: 41.76.108.46:8080
Source: Malware configuration extractor	IPs: 103.8.26.103:8080
Source: Malware configuration extractor	IPs: 185.184.25.237:8080
Source: Malware configuration extractor	IPs: 103.8.26.102:8080
Source: Malware configuration extractor	IPs: 203.114.109.124:443
Source: Malware configuration extractor	IPs: 45.118.115.99:8080
Source: Malware configuration extractor	IPs: 178.79.147.66:8080
Source: Malware configuration extractor	IPs: 58.227.42.236:80
Source: Malware configuration extractor	IPs: 45.118.135.203:7080
Source: Malware configuration extractor	IPs: 103.75.201.2:443
Source: Malware configuration extractor	IPs: 195.154.133.20:443
Source: Malware configuration extractor	IPs: 45.142.114.231:8080
Source: Malware configuration extractor	IPs: 212.237.5.209:443
Source: Malware configuration extractor	IPs: 207.38.84.195:8080
Source: Malware configuration extractor	IPs: 104.251.214.46:8080
Source: Malware configuration extractor	IPs: 212.237.17.99:8080
Source: Malware configuration extractor	IPs: 212.237.56.116:7080
Source: Malware configuration extractor	IPs: 216.158.226.206:443
Source: Malware configuration extractor	IPs: 110.232.117.186:8080
Source: Malware configuration extractor	IPs: 158.69.222.101:443
Source: Malware configuration extractor	IPs: 107.182.225.142:8080
Source: Malware configuration extractor	IPs: 176.104.106.96:8080
Source: Malware configuration extractor	IPs: 81.0.236.90:443
Source: Malware configuration extractor	IPs: 50.116.54.215:443
Source: Malware configuration extractor	IPs: 138.185.72.26:8080
Source: Malware configuration extractor	IPs: 51.68.175.8:8080
Source: Malware configuration extractor	IPs: 210.57.217.132:8080

Internet Provider seen in connection with other malware

Source: Joe Sandbox View	ASN Name: OnlineSASFR OnlineSASFR
Source: Joe Sandbox View	ASN Name: ARUBA-ASNIT ARUBA-ASNIT

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 195.154.133.20 195.154.133.20
Source: Joe Sandbox View	IP Address: 212.237.17.99 212.237.17.99

Connects to several IPs in different countries

Source: unknown

Network traffic detected: IP country count 19

URLs found in memory or binary data

Source: svchost.exe, 00000004.00000002.567333158.0000028217E61000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000002.640708267.0000000001128000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.639198752.0000000001128000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: svchost.exe, 00000004.00000002.567003860.0000028217E12000.00000004.00000001.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000004.00000002.566413205.00000282128AF000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/enumeration/Enumerate
Source: Amcache.hve.22.dr	String found in binary or memory: http://upx.sf.net
Source: svchost.exe, 0000000A.00000002.388912529.0000020B26E13000.00000004.00000001.sdmp	String found in binary or memory: http://www.bingmapsportal.com
Source: svchost.exe, 00000007.00000002.661162395.00000227EB441000.00000004.00000001.sdmp	String found in binary or memory: https://%s.dnet.xboxlive.com
Source: svchost.exe, 00000007.00000002.661162395.00000227EB441000.00000004.00000001.sdmp	String found in binary or memory: https://%s.xboxlive.com
Source: svchost.exe, 00000007.00000002.661162395.00000227EB441000.00000004.00000001.sdmp	String found in binary or memory: https://%s.xboxlive.com/
Source: svchost.exe, 00000007.00000002.661162395.00000227EB441000.00000004.00000001.sdmp	String found in binary or memory: https://activity.windows.com
Source: svchost.exe, 0000000A.00000003.387932456.0000020B26E63000.00000004.00000001.sdmp	String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: svchost.exe, 00000007.00000002.661162395.00000227EB441000.00000004.00000001.sdmp	String found in binary or memory: https://bn2.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 00000007.00000002.661162395.00000227EB441000.00000004.00000001.sdmp	String found in binary or memory: https://co4-df.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 0000000A.00000002.388924782.0000020B26E29000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.387943285.0000020B26E4D000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 0000000A.00000002.388951772.0000020B26E44000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.387983858.0000020B26E42000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.388012695.0000020B26E43000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 0000000A.00000003.387932456.0000020B26E63000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 0000000A.00000002.388924782.0000020B26E29000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 0000000A.00000002.388951772.0000020B26E44000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.387983858.0000020B26E42000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.388012695.0000020B26E43000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Traffic/Incidents/
Source: svchost.exe, 0000000A.00000003.387900433.0000020B26E69000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.388989382.0000020B26E6B000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Transit/Stops/
Source: svchost.exe, 0000000A.00000003.387932456.0000020B26E63000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 0000000A.00000002.388924782.0000020B26E29000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 0000000A.00000002.388951772.0000020B26E44000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.387983858.0000020B26E42000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.388012695.0000020B26E43000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 0000000A.00000002.388924782.0000020B26E29000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 0000000A.00000003.387932456.0000020B26E63000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 0000000A.00000003.387932456.0000020B26E63000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 0000000A.00000003.387932456.0000020B26E63000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 0000000A.00000002.388924782.0000020B26E29000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Traffic/Incidents/
Source: svchost.exe, 0000000A.00000003.387936814.0000020B26E60000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 0000000A.00000002.388924782.0000020B26E29000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=
Source: svchost.exe, 0000000A.00000003.387932456.0000020B26E63000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 0000000A.00000002.388958286.0000020B26E4A000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.387957781.0000020B26E49000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.387983858.0000020B26E42000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 0000000A.00000003.387943285.0000020B26E4D000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 0000000A.00000002.388958286.0000020B26E4A000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.387957781.0000020B26E49000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 0000000A.00000002.388958286.0000020B26E4A000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.387957781.0000020B26E49000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 0000000A.00000002.388983797.0000020B26E66000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.t
Source: svchost.exe, 0000000A.00000003.387932456.0000020B26E63000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 0000000A.00000002.388924782.0000020B26E29000.00000004.00000001.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 0000000A.00000002.388951772.0000020B26E44000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.387983858.0000020B26E42000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.388012695.0000020B26E43000.00000004.00000001.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: svchost.exe, 0000000A.00000002.388943903.0000020B26E41000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 0000000A.00000002.388924782.0000020B26E29000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 0000000A.00000003.338514593.0000020B26E35000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 0000000A.00000003.338514593.0000020B26E35000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
Source: svchost.exe, 0000000A.00000003.338514593.0000020B26E35000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 0000000A.00000003.338514593.0000020B26E35000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.388024416.0000020B26E3E000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 0000000A.00000003.387943285.0000020B26E4D000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.388970566.0000020B26E56000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.388048361.0000020B26E50000.00000004.00000001.sdmp	String found in binary or memory: https://t0.tiles.ditu.live.com/tiles/gen

E-Banking Fraud:

Yara detected Emotet

Source: Yara match	File source: 0.0.loaddll32.exe.d33b80.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.ba0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.7a0000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.7a0000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.d33b80.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.1060000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.7a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.d33b80.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.7a0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.d33b80.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.7a0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.da0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.1060000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.650000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.782138.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.650000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.7a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.d33b80.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.782138.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.da0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.7a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.d33b80.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.d33b80.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.7a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.32a2138.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.7a0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.d33b80.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.7a0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.32a2138.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.d13d58.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.ba0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.d33b80.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.d33b80.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.d13d58.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.566657802.00000000007A0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.567231949.0000000000D2C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.597839039.00000000007A0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.596491370.00000000007A0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.564537877.000000000076A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.564875818.000000000328A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.568652514.00000000007A0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.643009162.0000000000D2C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.545043648.0000000001060000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.596841009.0000000000D2C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.526115475.0000000003368000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.564451857.0000000000650000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.598456484.0000000000D2C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.543502348.0000000000BA0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.568840979.0000000000D2C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.564446850.0000000000DA0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.543542843.0000000000CFA000.00000004.00000020.sdmp, type: MEMORY

System Summary:

Uses 32bit PE files

Source: mal2.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL, LARGE_ADDRESS_AWARE

One or more processes crash

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1456 -ip 1456

Deletes files inside the Windows folder

Source: C:\Windows\SysWOW64\rundll32.exe

File deleted: C:\Windows\SysWOW64\Xjvbeeymcqp\hqokwlnubzbb.uql:Zone.Identifier

Jump to behavior

Creates files inside the system directory

Source: C:\Windows\SysWOW64\rundll32.exe

File created: C:\Windows\SysWOW64\Xjvbeeymcqp\

Jump to behavior

Detected potential crypto function

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007BED95		0_2_007BED95
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007BE478		0_2_007BE478
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007C1C71		0_2_007C1C71
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007C0C66		0_2_007C0C66
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007B645F		0_2_007B645F
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007B604E		0_2_007B604E
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007A3E3B		0_2_007A3E3B
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007BCC3F		0_2_007BCC3F
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007B0A37		0_2_007B0A37
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007B0824		0_2_007B0824
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007BBA18		0_2_007BBA18
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007B1C12		0_2_007B1C12
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007C2C16		0_2_007C2C16
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007AF20D		0_2_007AF20D
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007C20F8		0_2_007C20F8
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007AE6FD		0_2_007AE6FD
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007ABEF5		0_2_007ABEF5
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007AA8E8		0_2_007AA8E8
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007C06EF		0_2_007C06EF
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007B7EDD		0_2_007B7EDD
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007C0AD3		0_2_007C0AD3
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007A54C0		0_2_007A54C0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007BB0BA		0_2_007BB0BA
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007AAEB9		0_2_007AAEB9
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007B3ABE		0_2_007B3ABE
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007B56A9		0_2_007B56A9
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007A68AD		0_2_007A68AD
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007B04A4		0_2_007B04A4
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007AF4A5		0_2_007AF4A5
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007AC69B		0_2_007AC69B
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007AF699		0_2_007AF699
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007AD899		0_2_007AD899
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007A3085		0_2_007A3085
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007A2B7C		0_2_007A2B7C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007B5B7C		0_2_007B5B7C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007A597D		0_2_007A597D
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007BC772		0_2_007BC772
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007A2176		0_2_007A2176
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007A2575		0_2_007A2575
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007A996C		0_2_007A996C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007A196D		0_2_007A196D
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007BF561		0_2_007BF561
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007A5166		0_2_007A5166
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007ADD66		0_2_007ADD66
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007C2560		0_2_007C2560
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007A9565		0_2_007A9565
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007A8D59		0_2_007A8D59
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007A635F		0_2_007A635F
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007C2D4F		0_2_007C2D4F
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007C314A		0_2_007C314A
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007A4F42		0_2_007A4F42
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007BC145		0_2_007BC145
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007B473A		0_2_007B473A
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007A7739		0_2_007A7739
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007B3130		0_2_007B3130
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007AE336		0_2_007AE336
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007AB12E		0_2_007AB12E
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007BCF2C		0_2_007BCF2C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007A6125		0_2_007A6125
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007B8518		0_2_007B8518
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007A8112		0_2_007A8112
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007A4716		0_2_007A4716
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007A5314		0_2_007A5314
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007BD10B		0_2_007BD10B
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007B710D		0_2_007B710D
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007C3306		0_2_007C3306
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007A1DF9		0_2_007A1DF9
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007A6BFE		0_2_007A6BFE
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007BD5FE		0_2_007BD5FE
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007B91F7		0_2_007B91F7
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007AFBEF		0_2_007AFBEF
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007AB7EC		0_2_007AB7EC
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007C35E3		0_2_007C35E3
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007B13DB		0_2_007B13DB
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007BE7DA		0_2_007BE7DA
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007B89DA		0_2_007B89DA
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007A5DC3		0_2_007A5DC3
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007A39C3		0_2_007A39C3
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007B4DC5		0_2_007B4DC5
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007B0FC5		0_2_007B0FC5
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007A2DC5		0_2_007A2DC5
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007A33A9		0_2_007A33A9
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007BBFA1		0_2_007BBFA1
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007B77A7		0_2_007B77A7
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007B6B91		0_2_007B6B91
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007A938F		0_2_007A938F
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007C1987		0_2_007C1987
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007A7D87		0_2_007A7D87
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007AF984		0_2_007AF984
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDAA6D0		0_2_6EDAA6D0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDAE6E0		0_2_6EDAE6E0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDA66E0		0_2_6EDA66E0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDA5EA0		0_2_6EDA5EA0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDB0F10		0_2_6EDB0F10
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDA1C10		0_2_6EDA1C10
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDA75F4		0_2_6EDA75F4
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDA9D50		0_2_6EDA9D50
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDC0A61		0_2_6EDC0A61
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDAD380		0_2_6EDAD380
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDA38C0		0_2_6EDA38C0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDB01D0		0_2_6EDB01D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01065314		2_2_01065314
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01068112		2_2_01068112
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01073130		2_2_01073130
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01068D59		2_2_01068D59
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0106196D		2_2_0106196D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01062B7C		2_2_01062B7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0107ED95		2_2_0107ED95
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0107E7DA		2_2_0107E7DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_010789DA		2_2_010789DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_010791F7		2_2_010791F7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0107BA18		2_2_0107BA18
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0107604E		2_2_0107604E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_010756A9		2_2_010756A9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0106AEB9		2_2_0106AEB9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_010806EF		2_2_010806EF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0107710D		2_2_0107710D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0107D10B		2_2_0107D10B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01083306		2_2_01083306
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01064716		2_2_01064716
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01078518		2_2_01078518
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01066125		2_2_01066125
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0106B12E		2_2_0106B12E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0107CF2C		2_2_0107CF2C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0106E336		2_2_0106E336
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0107473A		2_2_0107473A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01067739		2_2_01067739
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0108314A		2_2_0108314A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0107C145		2_2_0107C145
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01064F42		2_2_01064F42
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01082D4F		2_2_01082D4F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0106635F		2_2_0106635F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01065166		2_2_01065166
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0106DD66		2_2_0106DD66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01069565		2_2_01069565
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0107F561		2_2_0107F561
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01082560		2_2_01082560
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0106996C		2_2_0106996C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01062176		2_2_01062176
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01062575		2_2_01062575
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0107C772		2_2_0107C772
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01075B7C		2_2_01075B7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0106597D		2_2_0106597D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01067D87		2_2_01067D87
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0106F984		2_2_0106F984
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0106938F		2_2_0106938F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01081987		2_2_01081987
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01076B91		2_2_01076B91
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_010777A7		2_2_010777A7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0107BFA1		2_2_0107BFA1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_010633A9		2_2_010633A9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01074DC5		2_2_01074DC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01070FC5		2_2_01070FC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01062DC5		2_2_01062DC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01065DC3		2_2_01065DC3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_010639C3		2_2_010639C3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_010713DB		2_2_010713DB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0106FBEF		2_2_0106FBEF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0106B7EC		2_2_0106B7EC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_010835E3		2_2_010835E3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01066BFE		2_2_01066BFE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0107D5FE		2_2_0107D5FE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01061DF9		2_2_01061DF9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0106F20D		2_2_0106F20D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01071C12		2_2_01071C12
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01082C16		2_2_01082C16
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01070824		2_2_01070824
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01070A37		2_2_01070A37
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0107CC3F		2_2_0107CC3F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01063E3B		2_2_01063E3B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0107645F		2_2_0107645F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01080C66		2_2_01080C66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01081C71		2_2_01081C71
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0107E478		2_2_0107E478
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01063085		2_2_01063085
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0106C69B		2_2_0106C69B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0106F699		2_2_0106F699
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0106D899		2_2_0106D899
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_010704A4		2_2_010704A4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0106F4A5		2_2_0106F4A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_010668AD		2_2_010668AD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01073ABE		2_2_01073ABE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0107B0BA		2_2_0107B0BA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_010654C0		2_2_010654C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01077EDD		2_2_01077EDD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01080AD3		2_2_01080AD3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0106A8E8		2_2_0106A8E8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_010820F8		2_2_010820F8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0106BEF5		2_2_0106BEF5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0106E6FD		2_2_0106E6FD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDAA6D0		2_2_6EDAA6D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDAE6E0		2_2_6EDAE6E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDA66E0		2_2_6EDA66E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDA5EA0		2_2_6EDA5EA0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDB0F10		2_2_6EDB0F10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDA1C10		2_2_6EDA1C10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDA75F4		2_2_6EDA75F4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDA9D50		2_2_6EDA9D50
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDC0A61		2_2_6EDC0A61
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDAD380		2_2_6EDAD380
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDA38C0		2_2_6EDA38C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDB01D0		2_2_6EDB01D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DC06EF		5_2_00DC06EF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DBED95		5_2_00DBED95
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DB7EDD		5_2_00DB7EDD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DC0AD3		5_2_00DC0AD3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DA54C0		5_2_00DA54C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DC20F8		5_2_00DC20F8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DAE6FD		5_2_00DAE6FD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DABEF5		5_2_00DABEF5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DAA8E8		5_2_00DAA8E8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DAC69B		5_2_00DAC69B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DAF699		5_2_00DAF699
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DAD899		5_2_00DAD899
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DA3085		5_2_00DA3085
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DBB0BA		5_2_00DBB0BA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DAAEB9		5_2_00DAAEB9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DB3ABE		5_2_00DB3ABE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DB56A9		5_2_00DB56A9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DA68AD		5_2_00DA68AD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DB04A4		5_2_00DB04A4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DAF4A5		5_2_00DAF4A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DB645F		5_2_00DB645F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DB604E		5_2_00DB604E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DBE478		5_2_00DBE478
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DC1C71		5_2_00DC1C71
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DC0C66		5_2_00DC0C66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DBBA18		5_2_00DBBA18
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DB1C12		5_2_00DB1C12
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DC2C16		5_2_00DC2C16
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DAF20D		5_2_00DAF20D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DA3E3B		5_2_00DA3E3B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DBCC3F		5_2_00DBCC3F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DB0A37		5_2_00DB0A37
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DB0824		5_2_00DB0824
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DB13DB		5_2_00DB13DB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DBE7DA		5_2_00DBE7DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DB89DA		5_2_00DB89DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DA5DC3		5_2_00DA5DC3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DA39C3		5_2_00DA39C3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DB4DC5		5_2_00DB4DC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DB0FC5		5_2_00DB0FC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DA2DC5		5_2_00DA2DC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DA1DF9		5_2_00DA1DF9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DA6BFE		5_2_00DA6BFE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DBD5FE		5_2_00DBD5FE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DB91F7		5_2_00DB91F7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DAFBEF		5_2_00DAFBEF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DAB7EC		5_2_00DAB7EC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DC35E3		5_2_00DC35E3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DB6B91		5_2_00DB6B91
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DA938F		5_2_00DA938F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DC1987		5_2_00DC1987
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DA7D87		5_2_00DA7D87
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DAF984		5_2_00DAF984
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DA33A9		5_2_00DA33A9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DBBFA1		5_2_00DBBFA1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DB77A7		5_2_00DB77A7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DA8D59		5_2_00DA8D59
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DA635F		5_2_00DA635F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DC2D4F		5_2_00DC2D4F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DC314A		5_2_00DC314A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DA4F42		5_2_00DA4F42
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DBC145		5_2_00DBC145
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DA2B7C		5_2_00DA2B7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DB5B7C		5_2_00DB5B7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DA597D		5_2_00DA597D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DBC772		5_2_00DBC772
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DA2176		5_2_00DA2176
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DA2575		5_2_00DA2575
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DA996C		5_2_00DA996C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DA196D		5_2_00DA196D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DBF561		5_2_00DBF561
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DA5166		5_2_00DA5166
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DADD66		5_2_00DADD66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DC2560		5_2_00DC2560
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DA9565		5_2_00DA9565
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DB8518		5_2_00DB8518
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DA8112		5_2_00DA8112
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DA4716		5_2_00DA4716
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DA5314		5_2_00DA5314
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DBD10B		5_2_00DBD10B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DB710D		5_2_00DB710D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DC3306		5_2_00DC3306
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DB473A		5_2_00DB473A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DA7739		5_2_00DA7739
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DB3130		5_2_00DB3130
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DAE336		5_2_00DAE336
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DAB12E		5_2_00DAB12E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DBCF2C		5_2_00DBCF2C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DA6125		5_2_00DA6125

Found potential string decryption / allocating functions

Source: C:\Windows\System32\loaddll32.exe	Code function: String function: 6EDBD350 appears 32 times
Source: C:\Windows\System32\loaddll32.exe	Code function: String function: 6EDA1C10 appears 92 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6EDBD350 appears 33 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6EDA1C10 appears 97 times

Abnormal high CPU Usage

Source: C:\Windows\SysWOW64\rundll32.exe

Process Stats: CPU usage > 98%

Tries to load missing DLLs

Source: C:\Windows\System32\svchost.exe	Section loaded: xboxlivetitleid.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cdpsgshims.dll			Jump to behavior

Sample is known by Antivirus

Source: mal2.dll

ReversingLabs: Detection: 24%

PE file has an executable .text section and no other executable section

Source: mal2.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads software policies

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\mal2.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\mal2.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\mal2.dll,Control_RunDLL
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\mal2.dll",#1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\mal2.dll,axamexdrqyrgb
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\mal2.dll,bhramccfbdd
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\mal2.dll",Control_RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Xjvbeeymcqp\hqokwlnubzbb.uql",vvWvMRmVQ
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\mal2.dll",Control_RunDLL
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\mal2.dll",Control_RunDLL
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1456 -ip 1456
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 304
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 168 -p 1456 -ip 1456
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 312
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\mal2.dll",#1			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\mal2.dll,Control_RunDLL			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\mal2.dll,axamexdrqyrgb			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\mal2.dll,bhramccfbdd			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\mal2.dll",#1			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Xjvbeeymcqp\hqokwlnubzbb.uql",vvWvMRmVQ			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\mal2.dll",Control_RunDLL			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\mal2.dll",Control_RunDLL			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\mal2.dll",Control_RunDLL			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1456 -ip 1456			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 304			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 168 -p 1456 -ip 1456			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 312			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown			Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Creates temporary files

Source: C:\Windows\System32\svchost.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WERD250.tmp

Jump to behavior

Classification label

Source: classification engine

Classification label: mal76.troj.evad.winDLL@39/21@0/31

Reads ini files

Source: C:\Windows\SysWOW64\rundll32.exe

File read: C:\Users\desktop.ini

Jump to behavior

Runs a DLL by calling functions

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\mal2.dll,Control_RunDLL

Found detection on Joe Sandbox Cloud Basic with higher score

Source: mal2.dll

Joe Sandbox Cloud Basic: Detection: clean Score: 0

Perma Link

Creates mutexes

Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7132:120:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:5544:64:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:4568:64:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1456

Reads the hosts file

Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Found GUI installer (many successful clicks)

Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: mal2.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

PE file contains a debug data directory

Source: mal2.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Binary contains paths to debug symbols

Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000016.00000003.584277033.00000000047F1000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.609321694.0000000004C21000.00000004.00000001.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000016.00000003.584277033.00000000047F1000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.609321694.0000000004C21000.00000004.00000001.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000016.00000003.573738619.0000000000F47000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.584277033.00000000047F1000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.609321694.0000000004C21000.00000004.00000001.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000016.00000003.584277033.00000000047F1000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.609321694.0000000004C21000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000016.00000003.584277033.00000000047F1000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.581262316.0000000000917000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.609321694.0000000004C21000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000016.00000003.584277033.00000000047F1000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.609321694.0000000004C21000.00000004.00000001.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000016.00000003.584277033.00000000047F1000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.609321694.0000000004C21000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000016.00000003.584277033.00000000047F1000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.603106130.0000000000B7D000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.609321694.0000000004C21000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.602476954.0000000000B7D000.00000004.00000001.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000016.00000003.584277033.00000000047F1000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.609321694.0000000004C21000.00000004.00000001.sdmp
Source:	Binary string: upwntdll.pdb source: WerFault.exe, 00000019.00000003.602237788.0000000000BBB000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000016.00000003.584277033.00000000047F1000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.609321694.0000000004C21000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdbk source: WerFault.exe, 00000016.00000003.584277033.00000000047F1000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.609321694.0000000004C21000.00000004.00000001.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000016.00000003.584277033.00000000047F1000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.609321694.0000000004C21000.00000004.00000001.sdmp
Source:	Binary string: oCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernel32.pdb source: WerFault.exe, 00000016.00000002.593818088.00000000003D2000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb( source: WerFault.exe, 00000019.00000003.603106130.0000000000B7D000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.602476954.0000000000B7D000.00000004.00000001.sdmp

Data Obfuscation:

Uses code obfuscation techniques (call, push, ret)

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007A151C push ds; ret		0_2_007A1527
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007A150F push ds; ret		0_2_007A1527
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0106150F push ds; ret		2_2_01061527
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0106151C push ds; ret		2_2_01061527
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDC9153 push ecx; ret		2_2_6EDC9166
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DA151C push ds; ret		5_2_00DA1527
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DA150F push ds; ret		5_2_00DA1527

Contains functionality to dynamically determine API calls

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6EDAE4E0 WaitForSingleObjectEx,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetCurrentProcess,CreateMutexA,CloseHandle,ReleaseMutex,

0_2_6EDAE4E0

Persistence and Installation Behavior:

Drops PE files to the windows directory (C:\Windows)

Source: C:\Windows\SysWOW64\rundll32.exe

PE file moved: C:\Windows\SysWOW64\Xjvbeeymcqp\hqokwlnubzbb.uql

Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\SysWOW64\rundll32.exe

File opened: C:\Windows\SysWOW64\Xjvbeeymcqp\hqokwlnubzbb.uql:Zone.Identifier read attributes | delete

Jump to behavior

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Windows\SysWOW64\WerFault.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Disables application error messsages (SetErrorMode)

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Windows\System32\svchost.exe TID: 6152	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4644	Thread sleep time: -30000s >= -30000s			Jump to behavior

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Queries disk information (often used to detect virtual machines)

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Found large amount of non-executed APIs

Source: C:\Windows\System32\loaddll32.exe	API coverage: 7.3 %
Source: C:\Windows\SysWOW64\rundll32.exe	API coverage: 9.8 %

Queries a list of all running processes

Source: C:\Windows\System32\svchost.exe

Process information queried: ProcessInformation

Jump to behavior

Contains functionality to enumerate / list files inside a directory

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDC2FE7 FindFirstFileExW,		0_2_6EDC2FE7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDC2FE7 FindFirstFileExW,		2_2_6EDC2FE7

Checks the free space of harddrives

Source: C:\Windows\SysWOW64\rundll32.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: Amcache.hve.22.dr	Binary or memory string: VMware
Source: Amcache.hve.22.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000
Source: Amcache.hve.22.dr	Binary or memory string: @scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.22.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.22.dr	Binary or memory string: VMware, Inc.
Source: svchost.exe, 00000004.00000002.567333158.0000028217E61000.00000004.00000001.sdmp	Binary or memory string: @Hyper-V RAW
Source: Amcache.hve.22.dr	Binary or memory string: VMware Virtual disk SCSI Disk Devicehbin
Source: WerFault.exe, 00000019.00000003.639184264.0000000001110000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000002.640688899.0000000001112000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAWigabit Network Connection-WFP Native MAC Layer LightWeight Filter-0000
Source: Amcache.hve.22.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.22.dr	Binary or memory string: VMware7,1
Source: Amcache.hve.22.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.22.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.22.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW71.00V.13989454.B64.1906190538,BiosReleaseDate:06/19/2019,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware7,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: svchost.exe, 00000004.00000002.565370387.0000028212829000.00000004.00000001.sdmp, svchost.exe, 00000004.00000002.567296199.0000028217E55000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000002.640605241.00000000010E0000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.639184264.0000000001110000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000002.640688899.0000000001112000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.22.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.22.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.22.dr	Binary or memory string: VMware, Inc.me
Source: Amcache.hve.22.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.22.dr	Binary or memory string: VMware-42 35 bb 32 33 75 d2 27-52 00 3c e2 4b d4 32 71
Source: svchost.exe, 00000007.00000002.661162395.00000227EB441000.00000004.00000001.sdmp, svchost.exe, 00000009.00000002.661148493.0000016AA0A29000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.22.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000

Anti Debugging:

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6EDBD1CC IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6EDBD1CC

Contains functionality to dynamically determine API calls

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6EDAE4E0 WaitForSingleObjectEx,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetCurrentProcess,CreateMutexA,CloseHandle,ReleaseMutex,

0_2_6EDAE4E0

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6EDA1290 GetProcessHeap,HeapAlloc,RtlAllocateHeap,HeapFree,

0_2_6EDA1290

Contains functionality to read the PEB

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007B4315 mov eax, dword ptr fs:[00000030h]		0_2_007B4315
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDBC050 mov eax, dword ptr fs:[00000030h]		0_2_6EDBC050
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDBBFE0 mov esi, dword ptr fs:[00000030h]		0_2_6EDBBFE0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDBBFE0 mov eax, dword ptr fs:[00000030h]		0_2_6EDBBFE0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDC12CB mov ecx, dword ptr fs:[00000030h]		0_2_6EDC12CB
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDC298C mov eax, dword ptr fs:[00000030h]		0_2_6EDC298C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01074315 mov eax, dword ptr fs:[00000030h]		2_2_01074315
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDBC050 mov eax, dword ptr fs:[00000030h]		2_2_6EDBC050
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDBBFE0 mov esi, dword ptr fs:[00000030h]		2_2_6EDBBFE0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDBBFE0 mov eax, dword ptr fs:[00000030h]		2_2_6EDBBFE0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDC12CB mov ecx, dword ptr fs:[00000030h]		2_2_6EDC12CB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDC298C mov eax, dword ptr fs:[00000030h]		2_2_6EDC298C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DB4315 mov eax, dword ptr fs:[00000030h]		5_2_00DB4315

Checks if the current process is being debugged

Source: C:\Windows\System32\loaddll32.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process queried: DebugPort			Jump to behavior

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_007AE259 LdrInitializeThunk,

0_2_007AE259

Contains functionality to register its own exception handler

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDBCB22 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6EDBCB22
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDBD1CC IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6EDBD1CC
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDC29E6 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6EDC29E6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDBCB22 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		2_2_6EDBCB22
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDBD1CC IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		2_2_6EDBD1CC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDC29E6 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		2_2_6EDC29E6

HIPS / PFW / Operating System Protection Evasion:

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\mal2.dll",#1			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1456 -ip 1456			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 304			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 168 -p 1456 -ip 1456			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 312			Jump to behavior

May try to detect the Windows Explorer process (often used for injection)

Source: loaddll32.exe, 00000000.00000000.567467606.0000000001430000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.568950962.0000000001430000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.596918132.0000000001430000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.598640462.0000000001430000.00000002.00020000.sdmp, rundll32.exe, 0000000E.00000002.662938655.00000000030F0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: loaddll32.exe, 00000000.00000000.567467606.0000000001430000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.568950962.0000000001430000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.596918132.0000000001430000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.598640462.0000000001430000.00000002.00020000.sdmp, rundll32.exe, 0000000E.00000002.662938655.00000000030F0000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: loaddll32.exe, 00000000.00000000.567467606.0000000001430000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.568950962.0000000001430000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.596918132.0000000001430000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.598640462.0000000001430000.00000002.00020000.sdmp, rundll32.exe, 0000000E.00000002.662938655.00000000030F0000.00000002.00020000.sdmp	Binary or memory string: SProgram Managerl
Source: loaddll32.exe, 00000000.00000000.567467606.0000000001430000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.568950962.0000000001430000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.596918132.0000000001430000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.598640462.0000000001430000.00000002.00020000.sdmp, rundll32.exe, 0000000E.00000002.662938655.00000000030F0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd,
Source: loaddll32.exe, 00000000.00000000.567467606.0000000001430000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.568950962.0000000001430000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.596918132.0000000001430000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.598640462.0000000001430000.00000002.00020000.sdmp, rundll32.exe, 0000000E.00000002.662938655.00000000030F0000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Queries the volume information (name, serial number etc) of a device

Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation			Jump to behavior

Contains functionality to query CPU information (cpuid)

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6EDBCC44 cpuid

0_2_6EDBCC44

Contains functionality to query local / system time

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6EDBCE15 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6EDBCE15

Lowering of HIPS / PFW / Operating System Security Settings:

Changes security center settings (notifications, updates, antivirus, firewall)

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cval

Jump to behavior

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : FirewallProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiSpywareProduct

AV process strings found (often used to terminate AV products)

Source: Amcache.hve.22.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.22.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: svchost.exe, 0000000C.00000002.661306381.000001F0AB03E000.00000004.00000001.sdmp	Binary or memory string: (@\REGISTRY\USER\S-1-5-19ws Defender\MsMpeng.exe
Source: svchost.exe, 0000000C.00000002.661514183.000001F0AB102000.00000004.00000001.sdmp, svchost.exe, 0000000C.00000002.661194912.000001F0AB029000.00000004.00000001.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Stealing of Sensitive Information:

Yara detected Emotet

Source: Yara match	File source: 0.0.loaddll32.exe.d33b80.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.ba0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.7a0000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.7a0000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.d33b80.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.1060000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.7a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.d33b80.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.7a0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.d33b80.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.7a0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.da0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.1060000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.650000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.782138.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.650000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.7a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.d33b80.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.782138.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.da0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.7a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.d33b80.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.d33b80.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.7a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.32a2138.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.7a0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.d33b80.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.7a0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.32a2138.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.d13d58.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.ba0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.d33b80.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.d33b80.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.d13d58.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.566657802.00000000007A0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.567231949.0000000000D2C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.597839039.00000000007A0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.596491370.00000000007A0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.564537877.000000000076A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.564875818.000000000328A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.568652514.00000000007A0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.643009162.0000000000D2C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.545043648.0000000001060000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.596841009.0000000000D2C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.526115475.0000000003368000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.564451857.0000000000650000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.598456484.0000000000D2C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.543502348.0000000000BA0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.568840979.0000000000D2C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.564446850.0000000000DA0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.543542843.0000000000CFA000.00000004.00000020.sdmp, type: MEMORY