Windows Analysis Report SecuriteInfo.com.W32.AIDetect.malware1.23460.908

Overview

General Information

Sample Name:	SecuriteInfo.com.W32.AIDetect.malware1.23460.908 (renamed file extension from 908 to dll)
Analysis ID:	544184
MD5:	d633b0989e97dc05b09b6233fb53cf37
SHA1:	6e5a7f0493fea40bd213209ad06f4dd9069969ed
SHA256:	03ba158e40b1f9c80c0430cd9a06f00bcbddd3826a5965fccb4ac5b242b91a2c
Tags:	dllDridex
Infos:
Most interesting Screenshot:

Detection

Dridex

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Yara detected Dridex unpacked file

Multi AV Scanner detection for submitted file

Sigma detected: Suspicious Call by Ordinal

Tries to delay execution (extensive OutputDebugStringW loop)

C2 URLs / IPs found in malware configuration

Uses 32bit PE files

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

AV process strings found (often used to terminate AV products)

Sample file is different than original file name gathered from version info

One or more processes crash

Contains functionality to query locales information (e.g. system language)

Uses code obfuscation techniques (call, push, ret)

Checks if the current process is being debugged

Internet Provider seen in connection with other malware

Detected potential crypto function

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to call native functions

Creates a process in suspended mode (likely to inject code)

IP address seen in connection with other malware

Entry point lies outside standard sections

Abnormal high CPU Usage

Classification

Signatures

AV Detection:

Found malware configuration

Source: 3.0.rundll32.exe.6ec30000.2.unpack

Malware Configuration Extractor: Dridex {"Version": 22201, "C2 list": ["144.91.122.102:443", "85.10.248.28:593", "185.4.135.27:5228", "80.211.3.13:8116"], "RC4 keys": ["3IC8sFlUX9XZuoBQY9u5LhcZnHsV7E5r", "hnk63OiMfIbUqQnY7gkPwplwC0Ue5ZkZBYMCTYTjntqX7zsy9OvtNUlthJZXRtFF6P52Zbz6R5"]}

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.W32.AIDetect.malware1.23460.dll	Virustotal: Detection: 21%			Perma Link
Source: SecuriteInfo.com.W32.AIDetect.malware1.23460.dll	ReversingLabs: Detection: 30%

Compliance:

Uses 32bit PE files

Source: SecuriteInfo.com.W32.AIDetect.malware1.23460.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: SecuriteInfo.com.W32.AIDetect.malware1.23460.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000007.00000003.303782308.0000000004B40000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.303942043.0000000000BC6000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.303834846.0000000000BC6000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.304271486.0000000000BC6000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
Source:	Binary string: bcrypt.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: sfc_os.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
Source:	Binary string: nCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernel32.pdb source: WerFault.exe, 00000007.00000002.320531767.00000000005D2000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdbB source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb source: loaddll32.exe, 00000000.00000003.303520820.000000004B280000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.303914781.0000000000BC0000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.304429295.0000000000BC0000.00000004.00000001.sdmp
Source:	Binary string: oleaut32.pdb6 source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdb* source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: shell32.pdb source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000007.00000003.303838980.0000000000BCC000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.304202527.0000000000BCC000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.303947553.0000000000BCC000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: mpr.pdb source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
Source:	Binary string: setupapi.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: imagehlp.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: wUxTheme.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: dwmapi.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: winspool.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: fltLib.pdb8 source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: RFFGTEQ.pdb source: SecuriteInfo.com.W32.AIDetect.malware1.23460.dll
Source:	Binary string: shcore.pdbk source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb( source: WerFault.exe, 00000007.00000003.303914781.0000000000BC0000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.304429295.0000000000BC0000.00000004.00000001.sdmp
Source:	Binary string: profapi.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: ws2_32.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: winspool.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
Source:	Binary string: shell32.pdbk source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: mpr.pdbe source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: propsys.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdbUGP source: loaddll32.exe, 00000000.00000003.303520820.000000004B280000.00000004.00000001.sdmp
Source:	Binary string: cfgmgr32.pdbk source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdbk source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: msctf.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: AcLayers.pdb source: WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
Source:	Binary string: profapi.pdbD source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb( source: WerFault.exe, 00000007.00000003.303838980.0000000000BCC000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.304202527.0000000000BCC000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.303947553.0000000000BCC000.00000004.00000001.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb( source: WerFault.exe, 00000007.00000003.303942043.0000000000BC6000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.303834846.0000000000BC6000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.304271486.0000000000BC6000.00000004.00000001.sdmp
Source:	Binary string: rundll32.pdb source: WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
Source:	Binary string: oleaut32.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: sfc.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdb, source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
Source:	Binary string: sfc.pdbf source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp

Networking:

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	IPs: 144.91.122.102:443
Source: Malware configuration extractor	IPs: 85.10.248.28:593
Source: Malware configuration extractor	IPs: 185.4.135.27:5228
Source: Malware configuration extractor	IPs: 80.211.3.13:8116

Internet Provider seen in connection with other malware

Source: Joe Sandbox View	ASN Name: TOPHOSTGR TOPHOSTGR
Source: Joe Sandbox View	ASN Name: HETZNER-ASDE HETZNER-ASDE

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 185.4.135.27 185.4.135.27
Source: Joe Sandbox View	IP Address: 85.10.248.28 85.10.248.28

Source: WerFault.exe, 00000007.00000002.321092369.0000000004ABC000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.319185333.0000000004ABC000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: Amcache.hve.7.dr	String found in binary or memory: http://upx.sf.net
Source: loaddll32.exe, 00000000.00000002.819400491.000000006EC4F000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000000.300427683.000000006EC4F000.00000002.00020000.sdmp	String found in binary or memory: http://www.n4pkg6fy8o.gaDVarFileInfo$

E-Banking Fraud:

Yara detected Dridex unpacked file

Source: Yara match	File source: 3.0.rundll32.exe.6ec30000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.6ec30000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.rundll32.exe.6ec30000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.6ec30000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.819315155.000000006EC31000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.300409127.000000006EC31000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.329263853.000000006EC31000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.298329265.000000006EC31000.00000020.00020000.sdmp, type: MEMORY

System Summary:

Uses 32bit PE files

Source: SecuriteInfo.com.W32.AIDetect.malware1.23460.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Sample file is different than original file name gathered from version info

Source: SecuriteInfo.com.W32.AIDetect.malware1.23460.dll

Binary or memory string: OriginalFilenameIha.dllD vs SecuriteInfo.com.W32.AIDetect.malware1.23460.dll

One or more processes crash

Source: C:\Windows\SysWOW64\rundll32.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 672

Detected potential crypto function

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EC40730	0_2_6EC40730
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EC49370	0_2_6EC49370
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EC3A4E8	0_2_6EC3A4E8
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EC31494	0_2_6EC31494
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EC38428	0_2_6EC38428
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EC4143C	0_2_6EC4143C

Contains functionality to call native functions

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EC42234 NtDelayExecution,		0_2_6EC42234
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EC42820 NtAllocateVirtualMemory,		0_2_6EC42820

Abnormal high CPU Usage

Source: C:\Windows\System32\loaddll32.exe

Process Stats: CPU usage > 98%

Source: SecuriteInfo.com.W32.AIDetect.malware1.23460.dll	Virustotal: Detection: 21%
Source: SecuriteInfo.com.W32.AIDetect.malware1.23460.dll	ReversingLabs: Detection: 30%

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetect.malware1.23460.dll",#1

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetect.malware1.23460.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetect.malware1.23460.dll",#1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetect.malware1.23460.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 672
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetect.malware1.23460.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetect.malware1.23460.dll",#1	Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2964

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WERE1C9.tmp

Jump to behavior

Source: classification engine

Classification label: mal76.troj.evad.winDLL@6/6@0/4

Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: SecuriteInfo.com.W32.AIDetect.malware1.23460.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: SecuriteInfo.com.W32.AIDetect.malware1.23460.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000007.00000003.303782308.0000000004B40000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.303942043.0000000000BC6000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.303834846.0000000000BC6000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.304271486.0000000000BC6000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
Source:	Binary string: bcrypt.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: sfc_os.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
Source:	Binary string: nCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernel32.pdb source: WerFault.exe, 00000007.00000002.320531767.00000000005D2000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdbB source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb source: loaddll32.exe, 00000000.00000003.303520820.000000004B280000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.303914781.0000000000BC0000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.304429295.0000000000BC0000.00000004.00000001.sdmp
Source:	Binary string: oleaut32.pdb6 source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdb* source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: shell32.pdb source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000007.00000003.303838980.0000000000BCC000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.304202527.0000000000BCC000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.303947553.0000000000BCC000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: mpr.pdb source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
Source:	Binary string: setupapi.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: imagehlp.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: wUxTheme.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: dwmapi.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: winspool.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: fltLib.pdb8 source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: RFFGTEQ.pdb source: SecuriteInfo.com.W32.AIDetect.malware1.23460.dll
Source:	Binary string: shcore.pdbk source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb( source: WerFault.exe, 00000007.00000003.303914781.0000000000BC0000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.304429295.0000000000BC0000.00000004.00000001.sdmp
Source:	Binary string: profapi.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: ws2_32.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: winspool.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
Source:	Binary string: shell32.pdbk source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: mpr.pdbe source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: propsys.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdbUGP source: loaddll32.exe, 00000000.00000003.303520820.000000004B280000.00000004.00000001.sdmp
Source:	Binary string: cfgmgr32.pdbk source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdbk source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: msctf.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: AcLayers.pdb source: WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
Source:	Binary string: profapi.pdbD source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb( source: WerFault.exe, 00000007.00000003.303838980.0000000000BCC000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.304202527.0000000000BCC000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.303947553.0000000000BCC000.00000004.00000001.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb( source: WerFault.exe, 00000007.00000003.303942043.0000000000BC6000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.303834846.0000000000BC6000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.304271486.0000000000BC6000.00000004.00000001.sdmp
Source:	Binary string: rundll32.pdb source: WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
Source:	Binary string: oleaut32.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: sfc.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdb, source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
Source:	Binary string: sfc.pdbf source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp

Data Obfuscation:

Uses code obfuscation techniques (call, push, ret)

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6EC3F6A8 push esi; mov dword ptr [esp], 00000000h

0_2_6EC3F6A9

Entry point lies outside standard sections

Source: initial sample

Static PE information: section where entry point is pointing to: .rdata

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Tries to delay execution (extensive OutputDebugStringW loop)

Source: C:\Windows\System32\loaddll32.exe

Section loaded: OutputDebugStringW count: 1663

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Windows\System32\loaddll32.exe

Window / User API: threadDelayed 1663

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6EC40730 GetTokenInformation,GetSystemInfo,GetTokenInformation,

0_2_6EC40730

Source: Amcache.hve.7.dr	Binary or memory string: VMware
Source: Amcache.hve.7.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: @scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.7.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual disk SCSI Disk Devicehbin
Source: Amcache.hve.7.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.7.dr	Binary or memory string: VMware7,1
Source: Amcache.hve.7.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.7.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW71.00V.13989454.B64.1906190538,BiosReleaseDate:06/19/2019,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware7,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: WerFault.exe, 00000007.00000002.321017706.0000000004A70000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.319269722.0000000004AB2000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000002.321082427.0000000004AB2000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.7.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.7.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.7.dr	Binary or memory string: VMware, Inc.me
Source: Amcache.hve.7.dr	Binary or memory string: VMware-42 35 d8 20 48 cb c7 ff-aa 5e d0 37 a0 49 53 d7
Source: Amcache.hve.7.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000

Anti Debugging:

Checks if the current process is being debugged

Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort			Jump to behavior

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6EC36D0C GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA,

0_2_6EC36D0C

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6EC43138 RtlAddVectoredExceptionHandler,

0_2_6EC43138

HIPS / PFW / Operating System Protection Evasion:

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetect.malware1.23460.dll",#1

Jump to behavior

Source: loaddll32.exe, 00000000.00000002.818868274.00000000014D0000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000000.297621027.0000000002B60000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000000.300203284.0000000002B60000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: loaddll32.exe, 00000000.00000002.818868274.00000000014D0000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000000.297621027.0000000002B60000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000000.300203284.0000000002B60000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: loaddll32.exe, 00000000.00000002.818868274.00000000014D0000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000000.297621027.0000000002B60000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000000.300203284.0000000002B60000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: loaddll32.exe, 00000000.00000002.818868274.00000000014D0000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000000.297621027.0000000002B60000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000000.300203284.0000000002B60000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Contains functionality to query locales information (e.g. system language)

Source: C:\Windows\System32\loaddll32.exe

Code function: GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA,

0_2_6EC36D0C

Source: C:\Windows\System32\loaddll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

0_2_6EC36D0C

Lowering of HIPS / PFW / Operating System Security Settings:

AV process strings found (often used to terminate AV products)

Source: Amcache.hve.7.dr, Amcache.hve.LOG1.7.dr	Binary or memory string: c:\users\user\desktop\procexp.exe
Source: Amcache.hve.7.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.7.dr, Amcache.hve.LOG1.7.dr	Binary or memory string: procexp.exe

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.4.135.27	unknown	Greece	199246	TOPHOSTGR	true
85.10.248.28	unknown	Germany	24940	HETZNER-ASDE	true
80.211.3.13	unknown	Italy	31034	ARUBA-ASNIT	true
144.91.122.102	unknown	Germany	51167	CONTABODE	true

AV Detection:

Found malware configuration

Source: 3.0.rundll32.exe.6ec30000.2.unpack

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.W32.AIDetect.malware1.23460.dll	Virustotal: Detection: 21%			Perma Link
Source: SecuriteInfo.com.W32.AIDetect.malware1.23460.dll	ReversingLabs: Detection: 30%

Compliance:

Uses 32bit PE files

Source: SecuriteInfo.com.W32.AIDetect.malware1.23460.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: SecuriteInfo.com.W32.AIDetect.malware1.23460.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000007.00000003.303782308.0000000004B40000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.303942043.0000000000BC6000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.303834846.0000000000BC6000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.304271486.0000000000BC6000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
Source:	Binary string: bcrypt.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: sfc_os.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
Source:	Binary string: nCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernel32.pdb source: WerFault.exe, 00000007.00000002.320531767.00000000005D2000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdbB source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb source: loaddll32.exe, 00000000.00000003.303520820.000000004B280000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.303914781.0000000000BC0000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.304429295.0000000000BC0000.00000004.00000001.sdmp
Source:	Binary string: oleaut32.pdb6 source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdb* source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: shell32.pdb source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000007.00000003.303838980.0000000000BCC000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.304202527.0000000000BCC000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.303947553.0000000000BCC000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: mpr.pdb source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
Source:	Binary string: setupapi.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: imagehlp.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: wUxTheme.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: dwmapi.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: winspool.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: fltLib.pdb8 source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: RFFGTEQ.pdb source: SecuriteInfo.com.W32.AIDetect.malware1.23460.dll
Source:	Binary string: shcore.pdbk source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb( source: WerFault.exe, 00000007.00000003.303914781.0000000000BC0000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.304429295.0000000000BC0000.00000004.00000001.sdmp
Source:	Binary string: profapi.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: ws2_32.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: winspool.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
Source:	Binary string: shell32.pdbk source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: mpr.pdbe source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: propsys.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdbUGP source: loaddll32.exe, 00000000.00000003.303520820.000000004B280000.00000004.00000001.sdmp
Source:	Binary string: cfgmgr32.pdbk source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdbk source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: msctf.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: AcLayers.pdb source: WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
Source:	Binary string: profapi.pdbD source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb( source: WerFault.exe, 00000007.00000003.303838980.0000000000BCC000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.304202527.0000000000BCC000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.303947553.0000000000BCC000.00000004.00000001.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb( source: WerFault.exe, 00000007.00000003.303942043.0000000000BC6000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.303834846.0000000000BC6000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.304271486.0000000000BC6000.00000004.00000001.sdmp
Source:	Binary string: rundll32.pdb source: WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
Source:	Binary string: oleaut32.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: sfc.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdb, source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
Source:	Binary string: sfc.pdbf source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp

Networking:

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	IPs: 144.91.122.102:443
Source: Malware configuration extractor	IPs: 85.10.248.28:593
Source: Malware configuration extractor	IPs: 185.4.135.27:5228
Source: Malware configuration extractor	IPs: 80.211.3.13:8116

Internet Provider seen in connection with other malware

Source: Joe Sandbox View	ASN Name: TOPHOSTGR TOPHOSTGR
Source: Joe Sandbox View	ASN Name: HETZNER-ASDE HETZNER-ASDE

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 185.4.135.27 185.4.135.27
Source: Joe Sandbox View	IP Address: 85.10.248.28 85.10.248.28

Source: WerFault.exe, 00000007.00000002.321092369.0000000004ABC000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.319185333.0000000004ABC000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: Amcache.hve.7.dr	String found in binary or memory: http://upx.sf.net
Source: loaddll32.exe, 00000000.00000002.819400491.000000006EC4F000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000000.300427683.000000006EC4F000.00000002.00020000.sdmp	String found in binary or memory: http://www.n4pkg6fy8o.gaDVarFileInfo$

E-Banking Fraud:

Yara detected Dridex unpacked file

Source: Yara match	File source: 3.0.rundll32.exe.6ec30000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.6ec30000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.rundll32.exe.6ec30000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.6ec30000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.819315155.000000006EC31000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.300409127.000000006EC31000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.329263853.000000006EC31000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.298329265.000000006EC31000.00000020.00020000.sdmp, type: MEMORY

System Summary:

Uses 32bit PE files

Source: SecuriteInfo.com.W32.AIDetect.malware1.23460.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Sample file is different than original file name gathered from version info

Source: SecuriteInfo.com.W32.AIDetect.malware1.23460.dll

Binary or memory string: OriginalFilenameIha.dllD vs SecuriteInfo.com.W32.AIDetect.malware1.23460.dll

One or more processes crash

Source: C:\Windows\SysWOW64\rundll32.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 672

Detected potential crypto function

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EC40730	0_2_6EC40730
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EC49370	0_2_6EC49370
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EC3A4E8	0_2_6EC3A4E8
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EC31494	0_2_6EC31494
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EC38428	0_2_6EC38428
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EC4143C	0_2_6EC4143C

Contains functionality to call native functions

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EC42234 NtDelayExecution,		0_2_6EC42234
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EC42820 NtAllocateVirtualMemory,		0_2_6EC42820

Abnormal high CPU Usage

Source: C:\Windows\System32\loaddll32.exe

Process Stats: CPU usage > 98%

Source: SecuriteInfo.com.W32.AIDetect.malware1.23460.dll	Virustotal: Detection: 21%
Source: SecuriteInfo.com.W32.AIDetect.malware1.23460.dll	ReversingLabs: Detection: 30%

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetect.malware1.23460.dll",#1

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetect.malware1.23460.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetect.malware1.23460.dll",#1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetect.malware1.23460.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 672
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetect.malware1.23460.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetect.malware1.23460.dll",#1	Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2964

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WERE1C9.tmp

Jump to behavior

Source: classification engine

Classification label: mal76.troj.evad.winDLL@6/6@0/4

Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: SecuriteInfo.com.W32.AIDetect.malware1.23460.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: SecuriteInfo.com.W32.AIDetect.malware1.23460.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000007.00000003.303782308.0000000004B40000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.303942043.0000000000BC6000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.303834846.0000000000BC6000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.304271486.0000000000BC6000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
Source:	Binary string: bcrypt.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: sfc_os.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
Source:	Binary string: nCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernel32.pdb source: WerFault.exe, 00000007.00000002.320531767.00000000005D2000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdbB source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb source: loaddll32.exe, 00000000.00000003.303520820.000000004B280000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.303914781.0000000000BC0000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.304429295.0000000000BC0000.00000004.00000001.sdmp
Source:	Binary string: oleaut32.pdb6 source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdb* source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: shell32.pdb source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000007.00000003.303838980.0000000000BCC000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.304202527.0000000000BCC000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.303947553.0000000000BCC000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: mpr.pdb source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
Source:	Binary string: setupapi.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: imagehlp.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: wUxTheme.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: dwmapi.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: winspool.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: fltLib.pdb8 source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: RFFGTEQ.pdb source: SecuriteInfo.com.W32.AIDetect.malware1.23460.dll
Source:	Binary string: shcore.pdbk source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb( source: WerFault.exe, 00000007.00000003.303914781.0000000000BC0000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.304429295.0000000000BC0000.00000004.00000001.sdmp
Source:	Binary string: profapi.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: ws2_32.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: winspool.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
Source:	Binary string: shell32.pdbk source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: mpr.pdbe source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: propsys.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdbUGP source: loaddll32.exe, 00000000.00000003.303520820.000000004B280000.00000004.00000001.sdmp
Source:	Binary string: cfgmgr32.pdbk source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdbk source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: msctf.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: AcLayers.pdb source: WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
Source:	Binary string: profapi.pdbD source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb( source: WerFault.exe, 00000007.00000003.303838980.0000000000BCC000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.304202527.0000000000BCC000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.303947553.0000000000BCC000.00000004.00000001.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb( source: WerFault.exe, 00000007.00000003.303942043.0000000000BC6000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.303834846.0000000000BC6000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.304271486.0000000000BC6000.00000004.00000001.sdmp
Source:	Binary string: rundll32.pdb source: WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
Source:	Binary string: oleaut32.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: sfc.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdb, source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
Source:	Binary string: sfc.pdbf source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp

Data Obfuscation:

Uses code obfuscation techniques (call, push, ret)

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6EC3F6A8 push esi; mov dword ptr [esp], 00000000h

0_2_6EC3F6A9

Entry point lies outside standard sections

Source: initial sample

Static PE information: section where entry point is pointing to: .rdata

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Tries to delay execution (extensive OutputDebugStringW loop)

Source: C:\Windows\System32\loaddll32.exe

Section loaded: OutputDebugStringW count: 1663

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Windows\System32\loaddll32.exe

Window / User API: threadDelayed 1663

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6EC40730 GetTokenInformation,GetSystemInfo,GetTokenInformation,

0_2_6EC40730

Source: Amcache.hve.7.dr	Binary or memory string: VMware
Source: Amcache.hve.7.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: @scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.7.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual disk SCSI Disk Devicehbin
Source: Amcache.hve.7.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.7.dr	Binary or memory string: VMware7,1
Source: Amcache.hve.7.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.7.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW71.00V.13989454.B64.1906190538,BiosReleaseDate:06/19/2019,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware7,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: WerFault.exe, 00000007.00000002.321017706.0000000004A70000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.319269722.0000000004AB2000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000002.321082427.0000000004AB2000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.7.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.7.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.7.dr	Binary or memory string: VMware, Inc.me
Source: Amcache.hve.7.dr	Binary or memory string: VMware-42 35 d8 20 48 cb c7 ff-aa 5e d0 37 a0 49 53 d7
Source: Amcache.hve.7.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000

Anti Debugging:

Checks if the current process is being debugged

Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort			Jump to behavior

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Source: C:\Windows\System32\loaddll32.exe

0_2_6EC36D0C

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6EC43138 RtlAddVectoredExceptionHandler,

0_2_6EC43138

HIPS / PFW / Operating System Protection Evasion:

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetect.malware1.23460.dll",#1

Jump to behavior

Source: loaddll32.exe, 00000000.00000002.818868274.00000000014D0000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000000.297621027.0000000002B60000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000000.300203284.0000000002B60000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: loaddll32.exe, 00000000.00000002.818868274.00000000014D0000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000000.297621027.0000000002B60000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000000.300203284.0000000002B60000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: loaddll32.exe, 00000000.00000002.818868274.00000000014D0000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000000.297621027.0000000002B60000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000000.300203284.0000000002B60000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: loaddll32.exe, 00000000.00000002.818868274.00000000014D0000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000000.297621027.0000000002B60000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000000.300203284.0000000002B60000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Contains functionality to query locales information (e.g. system language)

Source: C:\Windows\System32\loaddll32.exe

0_2_6EC36D0C

Source: C:\Windows\System32\loaddll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

0_2_6EC36D0C

Lowering of HIPS / PFW / Operating System Security Settings:

AV process strings found (often used to terminate AV products)

Source: Amcache.hve.7.dr, Amcache.hve.LOG1.7.dr	Binary or memory string: c:\users\user\desktop\procexp.exe
Source: Amcache.hve.7.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.7.dr, Amcache.hve.LOG1.7.dr	Binary or memory string: procexp.exe

ID:	544184
Product:	CloudBasic
Start time:	20:09:32
Start date:	22.12.2021
Sample:	SecuriteInfo.com.W32.AIDetect.malware1.23460.908
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	d633b0989e97dc05b09b6233fb53cf37
SHA1:	6e5a7f0493fea40bd213209ad06f4dd9069969ed
SHA256:	03ba158e40b1f9c80c0430cd9a06f00bcbddd3826a5965fccb4ac5b242b91a2c
Filetype:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60%

Name	Type	MD5	SHA1	SHA256
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_435bf9987f6a7ee95ec1aabecf98fbf5b0b7b2_82810a17_131cfb8a\Report.wer	Little-endian UTF-16 Unicode text, with CRLF line terminators	D9FB776CB5A4EF1F641889E6E9193B1B	C9C86D8EFB07E52133951F821B054C8C7BA3FA78	AD8A021C47C521CA5F0437F2197D7A0BF831319A24A380FD6A8DE275C6199D5D
C:\ProgramData\Microsoft\Windows\WER\Temp\WERE1C9.tmp.dmp	Mini DuMP crash report, 14 streams, Thu Dec 23 04:10:37 2021, 0x1205a4 type	D33CA82EBE6E92E8C9EE3BF9999FE093	F9B632E7D4E0AFCB543086B5F1858720220575CB	0AFA0AC6A780D0EDF0ECFD74C0468568FA4715940874F9D73AEABB5536D1005D
C:\ProgramData\Microsoft\Windows\WER\Temp\WERE8FD.tmp.WERInternalMetadata.xml	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators	A19806F072B83C8F9677DE08F86CB46E	2F9E8BF4485B23CA8F91777A8648D2091A12E1D9	6A2050363CCD46EC2B084E078F8066624B4819D01F9888765C09AA4E6FD2E30A
C:\ProgramData\Microsoft\Windows\WER\Temp\WEREBBD.tmp.xml	XML 1.0 document, ASCII text, with CRLF line terminators	BA36C1BA3C0332D7CE22587788D18B9A	00E9266E46602FB7F9BDF52C9347468CFF0A7B91	8CDF1624CA332715098C4F4ABFB257ECE778B94981822151202E1FCEAA8A17F7
C:\Windows\appcompat\Programs\Amcache.hve	MS Windows registry file, NT/2000 or above	1FED069D51D64B2EF9E749426956732F	CDD1104BFD69A697852499ABBF5006E98AE7AB8F	D6774A26604D1DAF5505219F21A1B9221CDBEBDB769C051A661F72308868A734
C:\Windows\appcompat\Programs\Amcache.hve.LOG1	MS Windows registry file, NT/2000 or above	C5C78BB71FE7AB8673AEE48EF6AA728D	A471D1595856DC590BE90997573CD33E1168A753	9430DBD473E740ACCF71017BEB7808AF2F945697F3A1E48023BB16EA5465DBA3

Windows Analysis Report SecuriteInfo.com.W32.AIDetect.malware1.23460.908

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection:

Compliance:

Networking:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs