Windows Analysis Report SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dll

Overview

General Information

Sample Name:	SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dll
Analysis ID:	544197
MD5:	5c9f3e803604beb0fd134699e214db4c
SHA1:	3e775ec10dce6ce1bfc8c7aa299eef7e762c5fcc
SHA256:	a7efe0ee7f8d77a65b1fff3ba0cee76acb43223365dc348fa43ceecf93bcf7f0
Tags:	dllDridex
Infos:
Most interesting Screenshot:

Detection

Dridex

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Yara detected Dridex unpacked file

Multi AV Scanner detection for submitted file

Sigma detected: Suspicious Call by Ordinal

Tries to delay execution (extensive OutputDebugStringW loop)

C2 URLs / IPs found in malware configuration

Creates a DirectInput object (often for capturing keystrokes)

Uses 32bit PE files

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

AV process strings found (often used to terminate AV products)

Sample file is different than original file name gathered from version info

One or more processes crash

Contains functionality to query locales information (e.g. system language)

Uses code obfuscation techniques (call, push, ret)

Checks if the current process is being debugged

Internet Provider seen in connection with other malware

Detected potential crypto function

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to call native functions

Creates a process in suspended mode (likely to inject code)

IP address seen in connection with other malware

Entry point lies outside standard sections

Abnormal high CPU Usage

Classification

Signatures

AV Detection:

Found malware configuration

Source: 2.0.rundll32.exe.6e700000.2.unpack

Malware Configuration Extractor: Dridex {"Version": 22201, "C2 list": ["144.91.122.102:443", "85.10.248.28:593", "185.4.135.27:5228", "80.211.3.13:8116"], "RC4 keys": ["3IC8sFlUX9XZuoBQY9u5LhcZnHsV7E5r", "hnk63OiMfIbUqQnY7gkPwplwC0Ue5ZkZBYMCTYTjntqX7zsy9OvtNUlthJZXRtFF6P52Zbz6R5"]}

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dll	Virustotal: Detection: 18%			Perma Link
Source: SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dll	ReversingLabs: Detection: 25%

Compliance:

Uses 32bit PE files

Source: SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: powrprof.pdbE source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000005.00000003.677574023.00000000052D1000.00000004.00000001.sdmp, WerFault.exe, 00000005.00000003.672747235.000000000500F000.00000004.00000001.sdmp
Source:	Binary string: sfc_os.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: bcrypt.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000005.00000003.677574023.00000000052D1000.00000004.00000001.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 00000005.00000003.677574023.00000000052D1000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 00000005.00000003.677596575.0000000005480000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb source: loaddll32.exe, 00000000.00000003.673149439.000000004B280000.00000004.00000001.sdmp, WerFault.exe, 00000005.00000003.677574023.00000000052D1000.00000004.00000001.sdmp
Source:	Binary string: sechost.pdbC source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 00000005.00000003.677596575.0000000005480000.00000004.00000040.sdmp
Source:	Binary string: wimm32.pdby source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: combase.pdbQ source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000005.00000003.677574023.00000000052D1000.00000004.00000001.sdmp
Source:	Binary string: rundll32.pdbk source: WerFault.exe, 00000005.00000003.677574023.00000000052D1000.00000004.00000001.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: shell32.pdb source: WerFault.exe, 00000005.00000003.677596575.0000000005480000.00000004.00000040.sdmp
Source:	Binary string: wUxTheme.pdba source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000005.00000003.677574023.00000000052D1000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000005.00000003.677574023.00000000052D1000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: mpr.pdb source: WerFault.exe, 00000005.00000003.677596575.0000000005480000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000005.00000003.677574023.00000000052D1000.00000004.00000001.sdmp
Source:	Binary string: setupapi.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: mpr.pdb; source: WerFault.exe, 00000005.00000003.677596575.0000000005480000.00000004.00000040.sdmp
Source:	Binary string: imagehlp.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: wUxTheme.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: dwmapi.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: RFFGTEQ.pdb source: SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dll
Source:	Binary string: shcore.pdbk source: WerFault.exe, 00000005.00000003.677596575.0000000005480000.00000004.00000040.sdmp
Source:	Binary string: profapi.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: ws2_32.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: dwmapi.pdbp source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: winspool.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000005.00000003.677574023.00000000052D1000.00000004.00000001.sdmp
Source:	Binary string: shell32.pdbk source: WerFault.exe, 00000005.00000003.677596575.0000000005480000.00000004.00000040.sdmp
Source:	Binary string: sfc.pdb8 source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: profapi.pdbm source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: propsys.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdbUGP source: loaddll32.exe, 00000000.00000003.673149439.000000004B280000.00000004.00000001.sdmp
Source:	Binary string: cfgmgr32.pdbk source: WerFault.exe, 00000005.00000003.677596575.0000000005480000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: msctf.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: AcLayers.pdb source: WerFault.exe, 00000005.00000003.677574023.00000000052D1000.00000004.00000001.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 00000005.00000003.677596575.0000000005480000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 00000005.00000003.677596575.0000000005480000.00000004.00000040.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000005.00000003.677596575.0000000005480000.00000004.00000040.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 00000005.00000003.677596575.0000000005480000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: rundll32.pdb source: WerFault.exe, 00000005.00000003.677574023.00000000052D1000.00000004.00000001.sdmp
Source:	Binary string: oleaut32.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: sfc.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000005.00000003.677574023.00000000052D1000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000005.00000003.677574023.00000000052D1000.00000004.00000001.sdmp
Source:	Binary string: setupapi.pdbO source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: fltLib.pdbw source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdbk source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp

Networking:

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	IPs: 144.91.122.102:443
Source: Malware configuration extractor	IPs: 85.10.248.28:593
Source: Malware configuration extractor	IPs: 185.4.135.27:5228
Source: Malware configuration extractor	IPs: 80.211.3.13:8116

Internet Provider seen in connection with other malware

Source: Joe Sandbox View	ASN Name: TOPHOSTGR TOPHOSTGR
Source: Joe Sandbox View	ASN Name: HETZNER-ASDE HETZNER-ASDE

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 185.4.135.27 185.4.135.27
Source: Joe Sandbox View	IP Address: 85.10.248.28 85.10.248.28

Source: WerFault.exe, 00000005.00000002.698763311.0000000004F7F000.00000004.00000001.sdmp, WerFault.exe, 00000005.00000003.690108064.0000000004F7F000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: Amcache.hve.5.dr	String found in binary or memory: http://upx.sf.net
Source: loaddll32.exe, 00000000.00000002.1058180186.000000006E71F000.00000002.00020000.sdmp, rundll32.exe, 00000002.00000000.666345580.000000006E71F000.00000002.00020000.sdmp	String found in binary or memory: http://www.n4pkg6fy8o.gaDVarFileInfo$

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Creates a DirectInput object (often for capturing keystrokes)

Source: loaddll32.exe, 00000000.00000002.1057800999.0000000000A8B000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

Yara detected Dridex unpacked file

Source: Yara match	File source: 2.0.rundll32.exe.6e700000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.rundll32.exe.6e700000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.6e700000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.6e700000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000000.668687209.000000006E701000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1058145995.000000006E701000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.666259789.000000006E701000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.700452681.000000006E701000.00000020.00020000.sdmp, type: MEMORY

System Summary:

Uses 32bit PE files

Source: SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Sample file is different than original file name gathered from version info

Source: SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dll

Binary or memory string: OriginalFilenameIha.dllD vs SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dll

One or more processes crash

Source: C:\Windows\SysWOW64\rundll32.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 484 -s 684

Detected potential crypto function

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E710730	0_2_6E710730
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E719370	0_2_6E719370
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E71143C	0_2_6E71143C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E708428	0_2_6E708428
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E70A4E8	0_2_6E70A4E8
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E701494	0_2_6E701494

Contains functionality to call native functions

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E712234 NtDelayExecution,		0_2_6E712234
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E712820 NtAllocateVirtualMemory,		0_2_6E712820

Abnormal high CPU Usage

Source: C:\Windows\System32\loaddll32.exe

Process Stats: CPU usage > 98%

Source: SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dll	Virustotal: Detection: 18%
Source: SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dll	ReversingLabs: Detection: 25%

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dll",#1

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dll",#1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 484 -s 684
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dll",#1	Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess484

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WERAB57.tmp

Jump to behavior

Source: classification engine

Classification label: mal76.troj.evad.winDLL@6/6@0/4

Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: powrprof.pdbE source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000005.00000003.677574023.00000000052D1000.00000004.00000001.sdmp, WerFault.exe, 00000005.00000003.672747235.000000000500F000.00000004.00000001.sdmp
Source:	Binary string: sfc_os.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: bcrypt.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000005.00000003.677574023.00000000052D1000.00000004.00000001.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 00000005.00000003.677574023.00000000052D1000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 00000005.00000003.677596575.0000000005480000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb source: loaddll32.exe, 00000000.00000003.673149439.000000004B280000.00000004.00000001.sdmp, WerFault.exe, 00000005.00000003.677574023.00000000052D1000.00000004.00000001.sdmp
Source:	Binary string: sechost.pdbC source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 00000005.00000003.677596575.0000000005480000.00000004.00000040.sdmp
Source:	Binary string: wimm32.pdby source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: combase.pdbQ source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000005.00000003.677574023.00000000052D1000.00000004.00000001.sdmp
Source:	Binary string: rundll32.pdbk source: WerFault.exe, 00000005.00000003.677574023.00000000052D1000.00000004.00000001.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: shell32.pdb source: WerFault.exe, 00000005.00000003.677596575.0000000005480000.00000004.00000040.sdmp
Source:	Binary string: wUxTheme.pdba source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000005.00000003.677574023.00000000052D1000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000005.00000003.677574023.00000000052D1000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: mpr.pdb source: WerFault.exe, 00000005.00000003.677596575.0000000005480000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000005.00000003.677574023.00000000052D1000.00000004.00000001.sdmp
Source:	Binary string: setupapi.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: mpr.pdb; source: WerFault.exe, 00000005.00000003.677596575.0000000005480000.00000004.00000040.sdmp
Source:	Binary string: imagehlp.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: wUxTheme.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: dwmapi.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: RFFGTEQ.pdb source: SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dll
Source:	Binary string: shcore.pdbk source: WerFault.exe, 00000005.00000003.677596575.0000000005480000.00000004.00000040.sdmp
Source:	Binary string: profapi.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: ws2_32.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: dwmapi.pdbp source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: winspool.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000005.00000003.677574023.00000000052D1000.00000004.00000001.sdmp
Source:	Binary string: shell32.pdbk source: WerFault.exe, 00000005.00000003.677596575.0000000005480000.00000004.00000040.sdmp
Source:	Binary string: sfc.pdb8 source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: profapi.pdbm source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: propsys.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdbUGP source: loaddll32.exe, 00000000.00000003.673149439.000000004B280000.00000004.00000001.sdmp
Source:	Binary string: cfgmgr32.pdbk source: WerFault.exe, 00000005.00000003.677596575.0000000005480000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: msctf.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: AcLayers.pdb source: WerFault.exe, 00000005.00000003.677574023.00000000052D1000.00000004.00000001.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 00000005.00000003.677596575.0000000005480000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 00000005.00000003.677596575.0000000005480000.00000004.00000040.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000005.00000003.677596575.0000000005480000.00000004.00000040.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 00000005.00000003.677596575.0000000005480000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: rundll32.pdb source: WerFault.exe, 00000005.00000003.677574023.00000000052D1000.00000004.00000001.sdmp
Source:	Binary string: oleaut32.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: sfc.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000005.00000003.677574023.00000000052D1000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000005.00000003.677574023.00000000052D1000.00000004.00000001.sdmp
Source:	Binary string: setupapi.pdbO source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: fltLib.pdbw source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdbk source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp

Data Obfuscation:

Uses code obfuscation techniques (call, push, ret)

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E70F6A8 push esi; mov dword ptr [esp], 00000000h

0_2_6E70F6A9

Entry point lies outside standard sections

Source: initial sample

Static PE information: section where entry point is pointing to: .rdata

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Tries to delay execution (extensive OutputDebugStringW loop)

Source: C:\Windows\System32\loaddll32.exe

Section loaded: OutputDebugStringW count: 1186

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Windows\System32\loaddll32.exe

Window / User API: threadDelayed 1186

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E710730 GetTokenInformation,GetSystemInfo,GetTokenInformation,

0_2_6E710730

Source: Amcache.hve.5.dr	Binary or memory string: VMware
Source: Amcache.hve.5.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: @scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.5.dr	Binary or memory string: VMware-42 35 9c fb 73 fa 4e 1b-fb a4 60 e7 7b e5 4a ed
Source: WerFault.exe, 00000005.00000003.688241826.0000000004F41000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll <arg nm="proclsp" val="2195" />
Source: Amcache.hve.5.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual disk SCSI Disk Devicehbin
Source: WerFault.exe, 00000005.00000003.690151958.0000000004F42000.00000004.00000001.sdmp, WerFault.exe, 00000005.00000002.698634468.0000000004F42000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAWH=
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.5.dr	Binary or memory string: VMware7,1
Source: Amcache.hve.5.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.5.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW71.00V.13989454.B64.1906190538,BiosReleaseDate:06/19/2019,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware7,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: WerFault.exe, 00000005.00000002.698763311.0000000004F7F000.00000004.00000001.sdmp, WerFault.exe, 00000005.00000003.690108064.0000000004F7F000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.5.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.5.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.5.dr	Binary or memory string: VMware, Inc.me
Source: Amcache.hve.5.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000

Anti Debugging:

Checks if the current process is being debugged

Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort			Jump to behavior

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E706D0C GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA,

0_2_6E706D0C

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E713138 RtlAddVectoredExceptionHandler,

0_2_6E713138

HIPS / PFW / Operating System Protection Evasion:

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dll",#1

Jump to behavior

Source: loaddll32.exe, 00000000.00000002.1057946372.0000000001300000.00000002.00020000.sdmp, rundll32.exe, 00000002.00000000.668105044.0000000003540000.00000002.00020000.sdmp, rundll32.exe, 00000002.00000000.665553158.0000000003540000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: loaddll32.exe, 00000000.00000002.1057946372.0000000001300000.00000002.00020000.sdmp, rundll32.exe, 00000002.00000000.668105044.0000000003540000.00000002.00020000.sdmp, rundll32.exe, 00000002.00000000.665553158.0000000003540000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: loaddll32.exe, 00000000.00000002.1057946372.0000000001300000.00000002.00020000.sdmp, rundll32.exe, 00000002.00000000.668105044.0000000003540000.00000002.00020000.sdmp, rundll32.exe, 00000002.00000000.665553158.0000000003540000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: loaddll32.exe, 00000000.00000002.1057946372.0000000001300000.00000002.00020000.sdmp, rundll32.exe, 00000002.00000000.668105044.0000000003540000.00000002.00020000.sdmp, rundll32.exe, 00000002.00000000.665553158.0000000003540000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Contains functionality to query locales information (e.g. system language)

Source: C:\Windows\System32\loaddll32.exe

Code function: GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA,

0_2_6E706D0C

Source: C:\Windows\System32\loaddll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

0_2_6E706D0C

Lowering of HIPS / PFW / Operating System Security Settings:

AV process strings found (often used to terminate AV products)

Source: Amcache.hve.5.dr

Binary or memory string: c:\program files\windows defender\msmpeng.exe

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.4.135.27	unknown	Greece	199246	TOPHOSTGR	true
85.10.248.28	unknown	Germany	24940	HETZNER-ASDE	true
80.211.3.13	unknown	Italy	31034	ARUBA-ASNIT	true
144.91.122.102	unknown	Germany	51167	CONTABODE	true

AV Detection:

Found malware configuration

Source: 2.0.rundll32.exe.6e700000.2.unpack

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dll	Virustotal: Detection: 18%			Perma Link
Source: SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dll	ReversingLabs: Detection: 25%

Compliance:

Uses 32bit PE files

Source: SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: powrprof.pdbE source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000005.00000003.677574023.00000000052D1000.00000004.00000001.sdmp, WerFault.exe, 00000005.00000003.672747235.000000000500F000.00000004.00000001.sdmp
Source:	Binary string: sfc_os.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: bcrypt.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000005.00000003.677574023.00000000052D1000.00000004.00000001.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 00000005.00000003.677574023.00000000052D1000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 00000005.00000003.677596575.0000000005480000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb source: loaddll32.exe, 00000000.00000003.673149439.000000004B280000.00000004.00000001.sdmp, WerFault.exe, 00000005.00000003.677574023.00000000052D1000.00000004.00000001.sdmp
Source:	Binary string: sechost.pdbC source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 00000005.00000003.677596575.0000000005480000.00000004.00000040.sdmp
Source:	Binary string: wimm32.pdby source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: combase.pdbQ source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000005.00000003.677574023.00000000052D1000.00000004.00000001.sdmp
Source:	Binary string: rundll32.pdbk source: WerFault.exe, 00000005.00000003.677574023.00000000052D1000.00000004.00000001.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: shell32.pdb source: WerFault.exe, 00000005.00000003.677596575.0000000005480000.00000004.00000040.sdmp
Source:	Binary string: wUxTheme.pdba source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000005.00000003.677574023.00000000052D1000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000005.00000003.677574023.00000000052D1000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: mpr.pdb source: WerFault.exe, 00000005.00000003.677596575.0000000005480000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000005.00000003.677574023.00000000052D1000.00000004.00000001.sdmp
Source:	Binary string: setupapi.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: mpr.pdb; source: WerFault.exe, 00000005.00000003.677596575.0000000005480000.00000004.00000040.sdmp
Source:	Binary string: imagehlp.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: wUxTheme.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: dwmapi.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: RFFGTEQ.pdb source: SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dll
Source:	Binary string: shcore.pdbk source: WerFault.exe, 00000005.00000003.677596575.0000000005480000.00000004.00000040.sdmp
Source:	Binary string: profapi.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: ws2_32.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: dwmapi.pdbp source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: winspool.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000005.00000003.677574023.00000000052D1000.00000004.00000001.sdmp
Source:	Binary string: shell32.pdbk source: WerFault.exe, 00000005.00000003.677596575.0000000005480000.00000004.00000040.sdmp
Source:	Binary string: sfc.pdb8 source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: profapi.pdbm source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: propsys.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdbUGP source: loaddll32.exe, 00000000.00000003.673149439.000000004B280000.00000004.00000001.sdmp
Source:	Binary string: cfgmgr32.pdbk source: WerFault.exe, 00000005.00000003.677596575.0000000005480000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: msctf.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: AcLayers.pdb source: WerFault.exe, 00000005.00000003.677574023.00000000052D1000.00000004.00000001.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 00000005.00000003.677596575.0000000005480000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 00000005.00000003.677596575.0000000005480000.00000004.00000040.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000005.00000003.677596575.0000000005480000.00000004.00000040.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 00000005.00000003.677596575.0000000005480000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: rundll32.pdb source: WerFault.exe, 00000005.00000003.677574023.00000000052D1000.00000004.00000001.sdmp
Source:	Binary string: oleaut32.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: sfc.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000005.00000003.677574023.00000000052D1000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000005.00000003.677574023.00000000052D1000.00000004.00000001.sdmp
Source:	Binary string: setupapi.pdbO source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: fltLib.pdbw source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdbk source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp

Networking:

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	IPs: 144.91.122.102:443
Source: Malware configuration extractor	IPs: 85.10.248.28:593
Source: Malware configuration extractor	IPs: 185.4.135.27:5228
Source: Malware configuration extractor	IPs: 80.211.3.13:8116

Internet Provider seen in connection with other malware

Source: Joe Sandbox View	ASN Name: TOPHOSTGR TOPHOSTGR
Source: Joe Sandbox View	ASN Name: HETZNER-ASDE HETZNER-ASDE

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 185.4.135.27 185.4.135.27
Source: Joe Sandbox View	IP Address: 85.10.248.28 85.10.248.28

Source: WerFault.exe, 00000005.00000002.698763311.0000000004F7F000.00000004.00000001.sdmp, WerFault.exe, 00000005.00000003.690108064.0000000004F7F000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: Amcache.hve.5.dr	String found in binary or memory: http://upx.sf.net
Source: loaddll32.exe, 00000000.00000002.1058180186.000000006E71F000.00000002.00020000.sdmp, rundll32.exe, 00000002.00000000.666345580.000000006E71F000.00000002.00020000.sdmp	String found in binary or memory: http://www.n4pkg6fy8o.gaDVarFileInfo$

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Creates a DirectInput object (often for capturing keystrokes)

Source: loaddll32.exe, 00000000.00000002.1057800999.0000000000A8B000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

Yara detected Dridex unpacked file

Source: Yara match	File source: 2.0.rundll32.exe.6e700000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.rundll32.exe.6e700000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.6e700000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.6e700000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000000.668687209.000000006E701000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1058145995.000000006E701000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.666259789.000000006E701000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.700452681.000000006E701000.00000020.00020000.sdmp, type: MEMORY

System Summary:

Uses 32bit PE files

Source: SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Sample file is different than original file name gathered from version info

Source: SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dll

Binary or memory string: OriginalFilenameIha.dllD vs SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dll

One or more processes crash

Source: C:\Windows\SysWOW64\rundll32.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 484 -s 684

Detected potential crypto function

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E710730	0_2_6E710730
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E719370	0_2_6E719370
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E71143C	0_2_6E71143C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E708428	0_2_6E708428
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E70A4E8	0_2_6E70A4E8
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E701494	0_2_6E701494

Contains functionality to call native functions

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E712234 NtDelayExecution,		0_2_6E712234
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E712820 NtAllocateVirtualMemory,		0_2_6E712820

Abnormal high CPU Usage

Source: C:\Windows\System32\loaddll32.exe

Process Stats: CPU usage > 98%

Source: SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dll	Virustotal: Detection: 18%
Source: SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dll	ReversingLabs: Detection: 25%

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dll",#1

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dll",#1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 484 -s 684
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dll",#1	Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess484

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WERAB57.tmp

Jump to behavior

Source: classification engine

Classification label: mal76.troj.evad.winDLL@6/6@0/4

Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: powrprof.pdbE source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000005.00000003.677574023.00000000052D1000.00000004.00000001.sdmp, WerFault.exe, 00000005.00000003.672747235.000000000500F000.00000004.00000001.sdmp
Source:	Binary string: sfc_os.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: bcrypt.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000005.00000003.677574023.00000000052D1000.00000004.00000001.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 00000005.00000003.677574023.00000000052D1000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 00000005.00000003.677596575.0000000005480000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb source: loaddll32.exe, 00000000.00000003.673149439.000000004B280000.00000004.00000001.sdmp, WerFault.exe, 00000005.00000003.677574023.00000000052D1000.00000004.00000001.sdmp
Source:	Binary string: sechost.pdbC source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 00000005.00000003.677596575.0000000005480000.00000004.00000040.sdmp
Source:	Binary string: wimm32.pdby source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: combase.pdbQ source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000005.00000003.677574023.00000000052D1000.00000004.00000001.sdmp
Source:	Binary string: rundll32.pdbk source: WerFault.exe, 00000005.00000003.677574023.00000000052D1000.00000004.00000001.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: shell32.pdb source: WerFault.exe, 00000005.00000003.677596575.0000000005480000.00000004.00000040.sdmp
Source:	Binary string: wUxTheme.pdba source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000005.00000003.677574023.00000000052D1000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000005.00000003.677574023.00000000052D1000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: mpr.pdb source: WerFault.exe, 00000005.00000003.677596575.0000000005480000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000005.00000003.677574023.00000000052D1000.00000004.00000001.sdmp
Source:	Binary string: setupapi.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: mpr.pdb; source: WerFault.exe, 00000005.00000003.677596575.0000000005480000.00000004.00000040.sdmp
Source:	Binary string: imagehlp.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: wUxTheme.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: dwmapi.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: RFFGTEQ.pdb source: SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dll
Source:	Binary string: shcore.pdbk source: WerFault.exe, 00000005.00000003.677596575.0000000005480000.00000004.00000040.sdmp
Source:	Binary string: profapi.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: ws2_32.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: dwmapi.pdbp source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: winspool.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000005.00000003.677574023.00000000052D1000.00000004.00000001.sdmp
Source:	Binary string: shell32.pdbk source: WerFault.exe, 00000005.00000003.677596575.0000000005480000.00000004.00000040.sdmp
Source:	Binary string: sfc.pdb8 source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: profapi.pdbm source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: propsys.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdbUGP source: loaddll32.exe, 00000000.00000003.673149439.000000004B280000.00000004.00000001.sdmp
Source:	Binary string: cfgmgr32.pdbk source: WerFault.exe, 00000005.00000003.677596575.0000000005480000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: msctf.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: AcLayers.pdb source: WerFault.exe, 00000005.00000003.677574023.00000000052D1000.00000004.00000001.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 00000005.00000003.677596575.0000000005480000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 00000005.00000003.677596575.0000000005480000.00000004.00000040.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000005.00000003.677596575.0000000005480000.00000004.00000040.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 00000005.00000003.677596575.0000000005480000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: rundll32.pdb source: WerFault.exe, 00000005.00000003.677574023.00000000052D1000.00000004.00000001.sdmp
Source:	Binary string: oleaut32.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: sfc.pdb source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000005.00000003.677574023.00000000052D1000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000005.00000003.677574023.00000000052D1000.00000004.00000001.sdmp
Source:	Binary string: setupapi.pdbO source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: fltLib.pdbw source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdbk source: WerFault.exe, 00000005.00000003.677665252.0000000005486000.00000004.00000040.sdmp

Data Obfuscation:

Uses code obfuscation techniques (call, push, ret)

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E70F6A8 push esi; mov dword ptr [esp], 00000000h

0_2_6E70F6A9

Entry point lies outside standard sections

Source: initial sample

Static PE information: section where entry point is pointing to: .rdata

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Tries to delay execution (extensive OutputDebugStringW loop)

Source: C:\Windows\System32\loaddll32.exe

Section loaded: OutputDebugStringW count: 1186

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Windows\System32\loaddll32.exe

Window / User API: threadDelayed 1186

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E710730 GetTokenInformation,GetSystemInfo,GetTokenInformation,

0_2_6E710730

Source: Amcache.hve.5.dr	Binary or memory string: VMware
Source: Amcache.hve.5.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: @scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.5.dr	Binary or memory string: VMware-42 35 9c fb 73 fa 4e 1b-fb a4 60 e7 7b e5 4a ed
Source: WerFault.exe, 00000005.00000003.688241826.0000000004F41000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll <arg nm="proclsp" val="2195" />
Source: Amcache.hve.5.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual disk SCSI Disk Devicehbin
Source: WerFault.exe, 00000005.00000003.690151958.0000000004F42000.00000004.00000001.sdmp, WerFault.exe, 00000005.00000002.698634468.0000000004F42000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAWH=
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.5.dr	Binary or memory string: VMware7,1
Source: Amcache.hve.5.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.5.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW71.00V.13989454.B64.1906190538,BiosReleaseDate:06/19/2019,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware7,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: WerFault.exe, 00000005.00000002.698763311.0000000004F7F000.00000004.00000001.sdmp, WerFault.exe, 00000005.00000003.690108064.0000000004F7F000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.5.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.5.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.5.dr	Binary or memory string: VMware, Inc.me
Source: Amcache.hve.5.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000

Anti Debugging:

Checks if the current process is being debugged

Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort			Jump to behavior

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Source: C:\Windows\System32\loaddll32.exe

0_2_6E706D0C

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E713138 RtlAddVectoredExceptionHandler,

0_2_6E713138

HIPS / PFW / Operating System Protection Evasion:

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dll",#1

Jump to behavior

Source: loaddll32.exe, 00000000.00000002.1057946372.0000000001300000.00000002.00020000.sdmp, rundll32.exe, 00000002.00000000.668105044.0000000003540000.00000002.00020000.sdmp, rundll32.exe, 00000002.00000000.665553158.0000000003540000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: loaddll32.exe, 00000000.00000002.1057946372.0000000001300000.00000002.00020000.sdmp, rundll32.exe, 00000002.00000000.668105044.0000000003540000.00000002.00020000.sdmp, rundll32.exe, 00000002.00000000.665553158.0000000003540000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: loaddll32.exe, 00000000.00000002.1057946372.0000000001300000.00000002.00020000.sdmp, rundll32.exe, 00000002.00000000.668105044.0000000003540000.00000002.00020000.sdmp, rundll32.exe, 00000002.00000000.665553158.0000000003540000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: loaddll32.exe, 00000000.00000002.1057946372.0000000001300000.00000002.00020000.sdmp, rundll32.exe, 00000002.00000000.668105044.0000000003540000.00000002.00020000.sdmp, rundll32.exe, 00000002.00000000.665553158.0000000003540000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Contains functionality to query locales information (e.g. system language)

Source: C:\Windows\System32\loaddll32.exe

0_2_6E706D0C

Source: C:\Windows\System32\loaddll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

0_2_6E706D0C

Lowering of HIPS / PFW / Operating System Security Settings:

AV process strings found (often used to terminate AV products)

Source: Amcache.hve.5.dr

Binary or memory string: c:\program files\windows defender\msmpeng.exe

ID:	544197
Product:	CloudBasic
Start time:	20:36:43
Start date:	22.12.2021
Sample:	SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dll
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	5c9f3e803604beb0fd134699e214db4c
SHA1:	3e775ec10dce6ce1bfc8c7aa299eef7e762c5fcc
SHA256:	a7efe0ee7f8d77a65b1fff3ba0cee76acb43223365dc348fa43ceecf93bcf7f0
Filetype:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60%

Name	Type	MD5	SHA1	SHA256
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_ec956fef9dabf4719f57ed463929b5a2167ca669_82810a17_1b64c96e\Report.wer	Little-endian UTF-16 Unicode text, with CRLF line terminators	FC092A755927F7FB196190805F465715	2AC3F6E6673E7670FCE801ED0820EE32D3120276	1A40899BE4A975B17148FF0B9CE22C8C13389663499173A7AD7A9CAC46EF243C
C:\ProgramData\Microsoft\Windows\WER\Temp\WERAB57.tmp.dmp	Mini DuMP crash report, 14 streams, Wed Dec 22 19:37:45 2021, 0x1205a4 type	DE794CB3009E8F88013CA58667F948F7	865AE5B19BB10D2EE7CDEFD828817ED2EA76951F	259DEC3D8B355579D5CF80AE49C6DD3659CDA7EC4040AE1E097112D5FFEEF982
C:\ProgramData\Microsoft\Windows\WER\Temp\WERB356.tmp.WERInternalMetadata.xml	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators	F3C6E33D3022626D3C393EC9A2317434	4A9115CA377BB8A9ED6B1E5DA79C2CBD891340F4	93D78D1669E1FB29AE2876AED3A484615EF1F9D0D3443F149E372964B922D2A6
C:\ProgramData\Microsoft\Windows\WER\Temp\WERB5B9.tmp.xml	XML 1.0 document, ASCII text, with CRLF line terminators	BBA4EA3158A563DE73FBE4511BAC4894	5E62581B07F03D9FE618AC54C4975C13FF9F2AA8	4C34C446850D96801BE53C1E6AC8B274B3CDFBF80EF4A8A254DB0835512616D7
C:\Windows\appcompat\Programs\Amcache.hve	MS Windows registry file, NT/2000 or above	5FCCAA1F580580ADFBA6D01B21B7760A	F41F9AEE67E8C84AB55DC92F23CD540559C1FF98	9372D3323C0368D1EFF1CE7DEA255304D280BC31A2B6262670F84505079BEFD5
C:\Windows\appcompat\Programs\Amcache.hve.LOG1	MS Windows registry file, NT/2000 or above	2D4DC3EEC62F40AD1FD716F5AB51E0FB	11B406A201ADFC26F59007A628BCD3C573FD2CA9	7F8B4D9FC5F08107BB29EC36163C697A57713D1592BD83ACEDA0E28488FE3AFF

Windows Analysis Report SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dll

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection:

Compliance:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs