Windows Analysis Report nIQCsrVbbw.dll

Overview

General Information

Sample Name: nIQCsrVbbw.dll
Analysis ID: 553359
MD5: 06b75d254c6844f78c7d7eefa5b1243e
SHA1: af4b4dccf317dbeeab97868a9514a7c9e496c8d3
SHA256: b0e46325319e75a2490a73045a60030961851c07d266df73d7e048799e133ec7
Tags: 32dllexe
Infos:

Most interesting Screenshot:

Detection

Emotet
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Multi AV Scanner detection for submitted file
Yara detected Emotet
System process connects to network (likely due to code injection or exploit)
Antivirus detection for URL or domain
Multi AV Scanner detection for domain / URL
Sigma detected: Suspicious Call by Ordinal
C2 URLs / IPs found in malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
One or more processes crash
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query locales information (e.g. system language)
Deletes files inside the Windows folder
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Creates files inside the system directory
Internet Provider seen in connection with other malware
Detected potential crypto function
Found potential string decryption / allocating functions
Found evasive API chain (may stop execution after checking a module file name)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to dynamically determine API calls
Contains functionality which may be used to detect a debugger (GetProcessHeap)
IP address seen in connection with other malware
AV process strings found (often used to terminate AV products)
PE file contains an invalid checksum
PE file contains strange resources
Tries to load missing DLLs
Contains functionality to read the PEB
Drops PE files to the windows directory (C:\Windows)
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Detected TCP or UDP traffic on non-standard ports
Checks if the current process is being debugged
Connects to several IPs in different countries
Potential key logger detected (key state polling based)
Registers a DLL
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Found large amount of non-executed APIs
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

AV Detection:

barindex
Found malware configuration
Source: 4.2.rundll32.exe.2d20000.0.raw.unpack Malware Configuration Extractor: Emotet {"C2 list": ["45.138.98.34:80", "69.16.218.101:8080", "51.210.242.234:8080", "185.148.168.220:8080", "142.4.219.173:8080", "54.38.242.185:443", "191.252.103.16:80", "104.131.62.48:8080", "62.171.178.147:8080", "217.182.143.207:443", "168.197.250.14:80", "37.44.244.177:8080", "66.42.57.149:443", "210.57.209.142:8080", "159.69.237.188:443", "116.124.128.206:8080", "128.199.192.135:8080", "195.154.146.35:443", "185.148.168.15:8080", "195.77.239.39:8080", "207.148.81.119:8080", "85.214.67.203:8080", "190.90.233.66:443", "78.46.73.125:443", "78.47.204.80:443", "37.59.209.141:8080", "54.37.228.122:443"], "Public Key": ["RUNTMSAAAAD0LxqDNhonUYwk8sqo7IWuUllRdUiUBnACc6romsQoe1YJD7wIe4AheqYofpZFucPDXCZ0z9i+ooUffqeoLZU0", "RUNLMSAAAADYNZPXY4tQxd/N4Wn5sTYAm5tUOxY2ol1ELrI4MNhHNi640vSLasjYTHpFRBoG+o84vtr7AJachCzOHjaAJFCW"]}
Multi AV Scanner detection for submitted file
Source: nIQCsrVbbw.dll Virustotal: Detection: 15% Perma Link
Source: nIQCsrVbbw.dll ReversingLabs: Detection: 16%
Antivirus detection for URL or domain
Source: https://45.138.98.34:80/pzThWGIkVuQKGXKeHBqdbAz# Avira URL Cloud: Label: malware
Source: https://45.138.98.34/ Avira URL Cloud: Label: malware
Source: https://45.138.98.34:80/pzThWGIkVuQKGXKeHBqdbAz Avira URL Cloud: Label: malware
Multi AV Scanner detection for domain / URL
Source: https://45.138.98.34/ Virustotal: Detection: 10% Perma Link

Compliance:

barindex
Uses 32bit PE files
Source: nIQCsrVbbw.dll Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
Source: Binary string: propsys.pdbT source: WerFault.exe, 0000000C.00000003.327749292.00000000050E8000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.327800302.00000000050E8000.00000004.00000040.sdmp
Source: Binary string: ws2_32.pdb source: WerFault.exe, 0000000C.00000003.327749292.00000000050E8000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.327800302.00000000050E8000.00000004.00000040.sdmp
Source: Binary string: wimm32.pdbN source: WerFault.exe, 0000000C.00000003.327749292.00000000050E8000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.327800302.00000000050E8000.00000004.00000040.sdmp
Source: Binary string: winspool.pdb source: WerFault.exe, 0000000C.00000003.327749292.00000000050E8000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.327800302.00000000050E8000.00000004.00000040.sdmp
Source: Binary string: wgdi32full.pdb source: WerFault.exe, 0000000C.00000003.327732640.0000000004FF1000.00000004.00000001.sdmp
Source: Binary string: wkernel32.pdb source: WerFault.exe, 0000000C.00000003.323068869.00000000031B1000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.322735848.0000000004CD5000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.327732640.0000000004FF1000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.322759628.00000000031B1000.00000004.00000001.sdmp
Source: Binary string: bcrypt.pdb source: WerFault.exe, 0000000C.00000003.327749292.00000000050E8000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.327800302.00000000050E8000.00000004.00000040.sdmp
Source: Binary string: sechost.pdb source: WerFault.exe, 0000000C.00000003.327739778.00000000050E2000.00000004.00000040.sdmp
Source: Binary string: iphlpapi.pdb source: WerFault.exe, 0000000C.00000003.327749292.00000000050E8000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.327800302.00000000050E8000.00000004.00000040.sdmp
Source: Binary string: ucrtbase.pdb source: WerFault.exe, 0000000C.00000003.327732640.0000000004FF1000.00000004.00000001.sdmp
Source: Binary string: msvcrt.pdb source: WerFault.exe, 0000000C.00000003.327732640.0000000004FF1000.00000004.00000001.sdmp
Source: Binary string: nCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernel32.pdb source: WerFault.exe, 0000000C.00000002.339350125.0000000002CD2000.00000004.00000001.sdmp
Source: Binary string: propsys.pdb source: WerFault.exe, 0000000C.00000003.327749292.00000000050E8000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.327800302.00000000050E8000.00000004.00000040.sdmp
Source: Binary string: wrpcrt4.pdb source: WerFault.exe, 0000000C.00000003.327792469.00000000050E5000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.327739778.00000000050E2000.00000004.00000040.sdmp
Source: Binary string: wntdll.pdb source: WerFault.exe, 0000000C.00000003.323389840.00000000031AB000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.327732640.0000000004FF1000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.322753338.00000000031AB000.00000004.00000001.sdmp
Source: Binary string: wrpcrt4.pdbk source: WerFault.exe, 0000000C.00000003.327792469.00000000050E5000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.327739778.00000000050E2000.00000004.00000040.sdmp
Source: Binary string: shcore.pdb source: WerFault.exe, 0000000C.00000003.327749292.00000000050E8000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.327800302.00000000050E8000.00000004.00000040.sdmp
Source: Binary string: oleaut32.pdbj source: WerFault.exe, 0000000C.00000003.327749292.00000000050E8000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.327800302.00000000050E8000.00000004.00000040.sdmp
Source: Binary string: wgdi32.pdb source: WerFault.exe, 0000000C.00000003.327732640.0000000004FF1000.00000004.00000001.sdmp
Source: Binary string: advapi32.pdb source: WerFault.exe, 0000000C.00000003.327732640.0000000004FF1000.00000004.00000001.sdmp
Source: Binary string: wsspicli.pdb source: WerFault.exe, 0000000C.00000003.327786271.00000000050E0000.00000004.00000040.sdmp
Source: Binary string: Kernel.Appcore.pdb source: WerFault.exe, 0000000C.00000003.327786271.00000000050E0000.00000004.00000040.sdmp
Source: Binary string: msvcp_win.pdb source: WerFault.exe, 0000000C.00000003.327732640.0000000004FF1000.00000004.00000001.sdmp
Source: Binary string: cryptbase.pdb source: WerFault.exe, 0000000C.00000003.327786271.00000000050E0000.00000004.00000040.sdmp
Source: Binary string: bcrypt.pdbv source: WerFault.exe, 0000000C.00000003.327749292.00000000050E8000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.327800302.00000000050E8000.00000004.00000040.sdmp
Source: Binary string: wkernelbase.pdb source: WerFault.exe, 0000000C.00000003.322765718.00000000031B7000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.327732640.0000000004FF1000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.322971705.00000000031B7000.00000004.00000001.sdmp
Source: Binary string: wimm32.pdb source: WerFault.exe, 0000000C.00000003.327749292.00000000050E8000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.327800302.00000000050E8000.00000004.00000040.sdmp
Source: Binary string: sechost.pdbk source: WerFault.exe, 0000000C.00000003.327739778.00000000050E2000.00000004.00000040.sdmp
Source: Binary string: wkernelbase.pdb( source: WerFault.exe, 0000000C.00000003.322765718.00000000031B7000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.322971705.00000000031B7000.00000004.00000001.sdmp
Source: Binary string: bcryptprimitives.pdb source: WerFault.exe, 0000000C.00000003.327786271.00000000050E0000.00000004.00000040.sdmp
Source: Binary string: shlwapi.pdb source: WerFault.exe, 0000000C.00000003.327786271.00000000050E0000.00000004.00000040.sdmp
Source: Binary string: wwin32u.pdb source: WerFault.exe, 0000000C.00000003.327732640.0000000004FF1000.00000004.00000001.sdmp
Source: Binary string: combase.pdb source: WerFault.exe, 0000000C.00000003.327749292.00000000050E8000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.327800302.00000000050E8000.00000004.00000040.sdmp
Source: Binary string: winspool.pdb, source: WerFault.exe, 0000000C.00000003.327749292.00000000050E8000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.327800302.00000000050E8000.00000004.00000040.sdmp
Source: Binary string: wkernel32.pdb( source: WerFault.exe, 0000000C.00000003.323068869.00000000031B1000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.322759628.00000000031B1000.00000004.00000001.sdmp
Source: Binary string: oleaut32.pdb source: WerFault.exe, 0000000C.00000003.327749292.00000000050E8000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.327800302.00000000050E8000.00000004.00000040.sdmp
Source: Binary string: apphelp.pdb source: WerFault.exe, 0000000C.00000003.327732640.0000000004FF1000.00000004.00000001.sdmp
Source: Binary string: wuser32.pdb source: WerFault.exe, 0000000C.00000003.327732640.0000000004FF1000.00000004.00000001.sdmp
Source: Binary string: wntdll.pdb( source: WerFault.exe, 0000000C.00000003.323389840.00000000031AB000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.322753338.00000000031AB000.00000004.00000001.sdmp

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 2404332 ET CNC Feodo Tracker Reported CnC Server TCP group 17 192.168.2.3:49743 -> 45.138.98.34:80
Source: Traffic Snort IDS: 2404338 ET CNC Feodo Tracker Reported CnC Server TCP group 20 192.168.2.3:49744 -> 69.16.218.101:8080
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\SysWOW64\rundll32.exe Network Connect: 69.16.218.101 144 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Network Connect: 45.138.98.34 80 Jump to behavior
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor IPs: 45.138.98.34:80
Source: Malware configuration extractor IPs: 69.16.218.101:8080
Source: Malware configuration extractor IPs: 51.210.242.234:8080
Source: Malware configuration extractor IPs: 185.148.168.220:8080
Source: Malware configuration extractor IPs: 142.4.219.173:8080
Source: Malware configuration extractor IPs: 54.38.242.185:443
Source: Malware configuration extractor IPs: 191.252.103.16:80
Source: Malware configuration extractor IPs: 104.131.62.48:8080
Source: Malware configuration extractor IPs: 62.171.178.147:8080
Source: Malware configuration extractor IPs: 217.182.143.207:443
Source: Malware configuration extractor IPs: 168.197.250.14:80
Source: Malware configuration extractor IPs: 37.44.244.177:8080
Source: Malware configuration extractor IPs: 66.42.57.149:443
Source: Malware configuration extractor IPs: 210.57.209.142:8080
Source: Malware configuration extractor IPs: 159.69.237.188:443
Source: Malware configuration extractor IPs: 116.124.128.206:8080
Source: Malware configuration extractor IPs: 128.199.192.135:8080
Source: Malware configuration extractor IPs: 195.154.146.35:443
Source: Malware configuration extractor IPs: 185.148.168.15:8080
Source: Malware configuration extractor IPs: 195.77.239.39:8080
Source: Malware configuration extractor IPs: 207.148.81.119:8080
Source: Malware configuration extractor IPs: 85.214.67.203:8080
Source: Malware configuration extractor IPs: 190.90.233.66:443
Source: Malware configuration extractor IPs: 78.46.73.125:443
Source: Malware configuration extractor IPs: 78.47.204.80:443
Source: Malware configuration extractor IPs: 37.59.209.141:8080
Source: Malware configuration extractor IPs: 54.37.228.122:443
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: AS-CHOOPAUS AS-CHOOPAUS
Source: Joe Sandbox View ASN Name: DIGITALOCEAN-ASNUS DIGITALOCEAN-ASNUS
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 207.148.81.119 207.148.81.119
Source: Joe Sandbox View IP Address: 104.131.62.48 104.131.62.48
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.3:49749 -> 69.16.218.101:8080
Connects to several IPs in different countries
Source: unknown Network traffic detected: IP country count 11
Source: unknown TCP traffic detected without corresponding DNS query: 45.138.98.34
Source: unknown TCP traffic detected without corresponding DNS query: 45.138.98.34
Source: unknown TCP traffic detected without corresponding DNS query: 45.138.98.34
Source: unknown TCP traffic detected without corresponding DNS query: 69.16.218.101
Source: unknown TCP traffic detected without corresponding DNS query: 69.16.218.101
Source: unknown TCP traffic detected without corresponding DNS query: 69.16.218.101
Source: unknown TCP traffic detected without corresponding DNS query: 69.16.218.101
Source: unknown TCP traffic detected without corresponding DNS query: 69.16.218.101
Source: unknown TCP traffic detected without corresponding DNS query: 69.16.218.101
Source: unknown TCP traffic detected without corresponding DNS query: 69.16.218.101
Source: unknown TCP traffic detected without corresponding DNS query: 69.16.218.101
Source: unknown TCP traffic detected without corresponding DNS query: 69.16.218.101
Source: unknown TCP traffic detected without corresponding DNS query: 69.16.218.101
Source: unknown TCP traffic detected without corresponding DNS query: 69.16.218.101
Source: unknown TCP traffic detected without corresponding DNS query: 69.16.218.101
Source: unknown TCP traffic detected without corresponding DNS query: 69.16.218.101
Source: svchost.exe, 00000016.00000003.431804996.000001641CD85000.00000004.00000001.sdmp String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","N equals www.facebook.com (Facebook)
Source: svchost.exe, 00000016.00000003.431804996.000001641CD85000.00000004.00000001.sdmp String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","N equals www.twitter.com (Twitter)
Source: svchost.exe, 00000016.00000003.431818578.000001641CD96000.00000004.00000001.sdmp, svchost.exe, 00000016.00000003.431804996.000001641CD85000.00000004.00000001.sdmp String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2022-01-07T11:33:20.1626869Z||.||d5cdcec3-04df-404e-ba07-3240047c89f9||1152921505694348672||Null||fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailab
Source: svchost.exe, 00000016.00000003.431818578.000001641CD96000.00000004.00000001.sdmp, svchost.exe, 00000016.00000003.431804996.000001641CD85000.00000004.00000001.sdmp String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2022-01-07T11:33:20.1626869Z||.||d5cdcec3-04df-404e-ba07-3240047c89f9||1152921505694348672||Null||fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailab
Source: rundll32.exe, 0000000B.00000002.691887680.000000000341F000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.357629848.000000000341F000.00000004.00000001.sdmp, svchost.exe, 00000016.00000002.448427231.000001641CD00000.00000004.00000001.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: svchost.exe, 00000016.00000002.448280014.000001641C4EF000.00000004.00000001.sdmp String found in binary or memory: http://crl.ver)
Source: rundll32.exe, 0000000B.00000003.354490654.0000000005C43000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000002.691887680.000000000341F000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.357629848.000000000341F000.00000004.00000001.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/
Source: rundll32.exe, 0000000B.00000003.354490654.0000000005C43000.00000004.00000001.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/.R
Source: rundll32.exe, 0000000B.00000002.691823696.00000000033D6000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.357685602.00000000033D6000.00000004.00000001.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: rundll32.exe, 0000000B.00000002.691887680.000000000341F000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.357629848.000000000341F000.00000004.00000001.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.11.dr String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: rundll32.exe, 0000000B.00000003.354490654.0000000005C43000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000002.691823696.00000000033D6000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.355162517.0000000003459000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000002.691915726.0000000003480000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.357685602.00000000033D6000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.355348418.000000000347F000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.357547662.0000000003480000.00000004.00000001.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?b75da39e41bf0
Source: rundll32.exe, 0000000B.00000002.691887680.000000000341F000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.357629848.000000000341F000.00000004.00000001.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabUW
Source: svchost.exe, 00000016.00000003.424406324.000001641CD5D000.00000004.00000001.sdmp, svchost.exe, 00000016.00000003.424442797.000001641CD80000.00000004.00000001.sdmp, svchost.exe, 00000016.00000003.424316902.000001641CD70000.00000004.00000001.sdmp, svchost.exe, 00000016.00000003.424335971.000001641CD80000.00000004.00000001.sdmp String found in binary or memory: http://help.disneyplus.com.
Source: Amcache.hve.12.dr String found in binary or memory: http://upx.sf.net
Source: rundll32.exe, 0000000B.00000002.691823696.00000000033D6000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.357685602.00000000033D6000.00000004.00000001.sdmp String found in binary or memory: https://45.138.98.34/
Source: rundll32.exe, 0000000B.00000002.691823696.00000000033D6000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.357685602.00000000033D6000.00000004.00000001.sdmp String found in binary or memory: https://45.138.98.34:80/pzThWGIkVuQKGXKeHBqdbAz
Source: rundll32.exe, 0000000B.00000002.691823696.00000000033D6000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.357685602.00000000033D6000.00000004.00000001.sdmp String found in binary or memory: https://45.138.98.34:80/pzThWGIkVuQKGXKeHBqdbAz#
Source: rundll32.exe, 0000000B.00000002.691823696.00000000033D6000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.357685602.00000000033D6000.00000004.00000001.sdmp String found in binary or memory: https://69.16.218.101/
Source: rundll32.exe, 0000000B.00000002.691823696.00000000033D6000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.357685602.00000000033D6000.00000004.00000001.sdmp String found in binary or memory: https://69.16.218.101/X.
Source: rundll32.exe, 0000000B.00000002.691823696.00000000033D6000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.357685602.00000000033D6000.00000004.00000001.sdmp String found in binary or memory: https://69.16.218.101:8080/GBwdsVvnKKEsOdMLrBySKnfjLZwMjZtlJDuPNHQIXAc
Source: rundll32.exe, 0000000B.00000002.691823696.00000000033D6000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.357685602.00000000033D6000.00000004.00000001.sdmp String found in binary or memory: https://69.16.218.101:8080/GBwdsVvnKKEsOdMLrBySKnfjLZwMjZtlJDuPNHQIXAc1
Source: rundll32.exe, 0000000B.00000003.357685602.00000000033D6000.00000004.00000001.sdmp String found in binary or memory: https://69.16.218.101:8080/GBwdsVvnKKEsOdMLrBySKnfjLZwMjZtlJDuPNHQIXAcDk6
Source: rundll32.exe, 0000000B.00000002.691823696.00000000033D6000.00000004.00000001.sdmp String found in binary or memory: https://69.16.218.101:8080/GBwdsVvnKKEsOdMLrBySKnfjLZwMjZtlJDuPNHQIXAcDk7
Source: rundll32.exe, 0000000B.00000002.691823696.00000000033D6000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.357685602.00000000033D6000.00000004.00000001.sdmp String found in binary or memory: https://69.16.218.101:8080/GBwdsVvnKKEsOdMLrBySKnfjLZwMjZtlJDuPNHQIXAcY
Source: svchost.exe, 00000016.00000003.424406324.000001641CD5D000.00000004.00000001.sdmp, svchost.exe, 00000016.00000003.424442797.000001641CD80000.00000004.00000001.sdmp, svchost.exe, 00000016.00000003.424316902.000001641CD70000.00000004.00000001.sdmp, svchost.exe, 00000016.00000003.424335971.000001641CD80000.00000004.00000001.sdmp String found in binary or memory: https://disneyplus.com/legal.
Source: svchost.exe, 00000016.00000003.424406324.000001641CD5D000.00000004.00000001.sdmp, svchost.exe, 00000016.00000003.424442797.000001641CD80000.00000004.00000001.sdmp, svchost.exe, 00000016.00000003.424316902.000001641CD70000.00000004.00000001.sdmp, svchost.exe, 00000016.00000003.424335971.000001641CD80000.00000004.00000001.sdmp String found in binary or memory: https://www.disneyplus.com/legal/privacy-policy
Source: svchost.exe, 00000016.00000003.424406324.000001641CD5D000.00000004.00000001.sdmp, svchost.exe, 00000016.00000003.424442797.000001641CD80000.00000004.00000001.sdmp, svchost.exe, 00000016.00000003.424316902.000001641CD70000.00000004.00000001.sdmp, svchost.exe, 00000016.00000003.424335971.000001641CD80000.00000004.00000001.sdmp String found in binary or memory: https://www.disneyplus.com/legal/your-california-privacy-rights
Source: svchost.exe, 00000016.00000003.425939891.000001641CDAB000.00000004.00000001.sdmp, svchost.exe, 00000016.00000003.425986683.000001641CD7B000.00000004.00000001.sdmp, svchost.exe, 00000016.00000003.425998694.000001641CD94000.00000004.00000001.sdmp, svchost.exe, 00000016.00000003.426066267.000001641D202000.00000004.00000001.sdmp, svchost.exe, 00000016.00000003.425960822.000001641CDAB000.00000004.00000001.sdmp String found in binary or memory: https://www.tiktok.com/legal/report/feedback
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 3_2_10001280 recvfrom, 3_2_10001280

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Potential key logger detected (key state polling based)
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 3_2_10027958 GetKeyState,GetKeyState,GetKeyState,GetKeyState,SendMessageA, 3_2_10027958
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_10027958 GetKeyState,GetKeyState,GetKeyState,GetKeyState,SendMessageA, 4_2_10027958
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 5_2_10027958 GetKeyState,GetKeyState,GetKeyState,GetKeyState,SendMessageA, 5_2_10027958

E-Banking Fraud:

barindex
Yara detected Emotet
Source: Yara match File source: 5.2.rundll32.exe.4d20000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.5d80000.18.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.4d80000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.5aa0000.14.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.4ee0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.4c40000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rundll32.exe.4f60000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.4c70000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.5bb0000.17.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.loaddll32.exe.2980000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.4ee0000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.4480000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.5680000.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.56b0000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.4580000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.loaddll32.exe.2980000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.2d20000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.52b0000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.rundll32.exe.2d20000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.56b0000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.5aa0000.14.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.4f40000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rundll32.exe.51f0000.11.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.4580000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.5d80000.18.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.rundll32.exe.2e20000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rundll32.exe.5320000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.loaddll32.exe.27a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.5990000.12.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.5b80000.16.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rundll32.exe.2eb0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.3280000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.54f0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rundll32.exe.5320000.12.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.5db0000.19.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.59c0000.13.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.4c40000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.5410000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.4f70000.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.6000000.20.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.5410000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.52e0000.11.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.6000000.20.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rundll32.exe.4c40000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.loaddll32.exe.27a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rundll32.exe.5350000.13.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rundll32.exe.4f00000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.4f40000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.2d20000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.5ad0000.15.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.3280000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rundll32.exe.4d50000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.loaddll32.exe.27a0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.46c0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rundll32.exe.4d20000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.regsvr32.exe.dd0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.4c50000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rundll32.exe.51c0000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.4c80000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rundll32.exe.4f90000.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.4d80000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.regsvr32.exe.dd0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.52b0000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rundll32.exe.4700000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rundll32.exe.4c70000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.4c50000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.rundll32.exe.2d20000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.5650000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.6030000.21.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rundll32.exe.4c40000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.4f10000.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rundll32.exe.4f00000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rundll32.exe.4f30000.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.loaddll32.exe.27a0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rundll32.exe.51c0000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rundll32.exe.2eb0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rundll32.exe.4f60000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.4db0000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.5650000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.54f0000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.regsvr32.exe.4930000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.5b80000.16.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.5440000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.loaddll32.exe.27a0000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.56e0000.11.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.32b0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.loaddll32.exe.2980000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.loaddll32.exe.27a0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.5520000.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.5990000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000B.00000002.692416013.00000000054F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.318376552.0000000004F91000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.322328065.0000000002D20000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.692912261.0000000005AA0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.693049451.0000000005B80000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.692792483.0000000005990000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.319220718.0000000004C50000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.340184392.0000000002981000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.313088625.00000000027A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.692538587.0000000005681000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.692564390.00000000056B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.304136320.0000000004931000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.318188927.0000000004C71000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.692047710.0000000004C71000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.313923443.00000000027A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.319469836.0000000004F11000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.692594246.00000000056E1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.318296344.0000000004F00000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.322840736.0000000004481000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.693077342.0000000005BB1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.340127468.00000000027A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.318566617.0000000005320000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.313015794.0000000002D20000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.318521400.00000000051F1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.317820038.0000000002EB0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.693386084.0000000006031000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.318320563.0000000004F31000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.692022013.0000000004C40000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.693354364.0000000006000000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.319637287.00000000052B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.318160754.0000000004C40000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.318877954.0000000004580000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.313073617.0000000002E21000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.692503192.0000000005650000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.318025809.0000000004701000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.303858298.0000000000DD0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.691678754.00000000032B1000.00000020.00000010.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.318347085.0000000004F60000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.692337885.0000000005410000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.319268493.0000000004C81000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.318598439.0000000005351000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.693231899.0000000005D80000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.319350113.0000000004DB1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.319315094.0000000004D80000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.692973628.0000000005AD1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.319560099.0000000004F71000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.314281816.0000000002981000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.692836661.00000000059C1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.691624077.0000000003280000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.318240143.0000000004D51000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.692363013.0000000005441000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.693267062.0000000005DB1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.319417804.0000000004EE0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.318218247.0000000004D20000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.313185864.0000000002981000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.318476243.00000000051C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.319512030.0000000004F40000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.319678344.00000000052E1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.319057129.00000000046C1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.692450211.0000000005521000.00000020.00000001.sdmp, type: MEMORY

System Summary:

barindex
Uses 32bit PE files
Source: nIQCsrVbbw.dll Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
One or more processes crash
Source: C:\Windows\System32\svchost.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 7120 -ip 7120
Deletes files inside the Windows folder
Source: C:\Windows\SysWOW64\rundll32.exe File deleted: C:\Windows\SysWOW64\Gwwrzypqggddo\faunqcxbnkzdy.fxb:Zone.Identifier Jump to behavior
Creates files inside the system directory
Source: C:\Windows\SysWOW64\rundll32.exe File created: C:\Windows\SysWOW64\Gwwrzypqggddo\ Jump to behavior
Detected potential crypto function
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_0299EFDD 1_2_0299EFDD
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_0298C6B8 1_2_0298C6B8
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_02990ABA 1_2_02990ABA
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_02990EBC 1_2_02990EBC
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_029A46BD 1_2_029A46BD
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_029A36AA 1_2_029A36AA
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_0298BAA9 1_2_0298BAA9
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_02993EAA 1_2_02993EAA
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_02981CA1 1_2_02981CA1
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_0299A2A5 1_2_0299A2A5
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_0299CCD9 1_2_0299CCD9
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_0299D8DB 1_2_0299D8DB
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_0299CAD5 1_2_0299CAD5
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_029880C0 1_2_029880C0
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_0299BEFD 1_2_0299BEFD
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_0298F0E9 1_2_0298F0E9
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_029A3EE9 1_2_029A3EE9
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_029A00EF 1_2_029A00EF
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_0299E4E5 1_2_0299E4E5
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_029A2009 1_2_029A2009
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_02997A0F 1_2_02997A0F
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_02999A01 1_2_02999A01
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_02998806 1_2_02998806
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_02983431 1_2_02983431
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_02988636 1_2_02988636
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_0298B820 1_2_0298B820
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_02992E5D 1_2_02992E5D
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_0299B257 1_2_0299B257
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_0298E640 1_2_0298E640
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_0299F840 1_2_0299F840
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_02987442 1_2_02987442
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_0298A445 1_2_0298A445
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_02994244 1_2_02994244
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_02987078 1_2_02987078
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_02987E79 1_2_02987E79
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_0299567B 1_2_0299567B
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_0299DC71 1_2_0299DC71
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_0298A871 1_2_0298A871
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_0298DE74 1_2_0298DE74
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_0299A474 1_2_0299A474
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_029A3263 1_2_029A3263
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_029A0A64 1_2_029A0A64
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_02994A66 1_2_02994A66
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_02982194 1_2_02982194
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_0298238C 1_2_0298238C
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_0298FB8E 1_2_0298FB8E
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_02993D85 1_2_02993D85
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_02996187 1_2_02996187
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_02990F86 1_2_02990F86
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_029857B8 1_2_029857B8
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_0299D1BC 1_2_0299D1BC
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_0298BFBE 1_2_0298BFBE
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_029A17BD 1_2_029A17BD
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_029A07AA 1_2_029A07AA
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_02998FAE 1_2_02998FAE
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_029877A3 1_2_029877A3
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_0298C5D8 1_2_0298C5D8
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_0298E7DE 1_2_0298E7DE
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_0299FBDE 1_2_0299FBDE
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_0299C5D5 1_2_0299C5D5
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_0299E1F8 1_2_0299E1F8
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_02984BFC 1_2_02984BFC
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_029985FF 1_2_029985FF
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_029855FF 1_2_029855FF
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_02999DF5 1_2_02999DF5
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_029967E6 1_2_029967E6
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_02995515 1_2_02995515
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_0299AD08 1_2_0299AD08
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_029A2B09 1_2_029A2B09
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_0298670B 1_2_0298670B
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_0298EF0C 1_2_0298EF0C
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_02981F38 1_2_02981F38
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_02998D3D 1_2_02998D3D
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_02995333 1_2_02995333
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_0299FF58 1_2_0299FF58
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_02997D5B 1_2_02997D5B
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_029A2D53 1_2_029A2D53
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_0299E955 1_2_0299E955
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_0299654A 1_2_0299654A
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_0298D14C 1_2_0298D14C
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_02992142 1_2_02992142
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_02995779 1_2_02995779
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_02986B7A 1_2_02986B7A
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_0299017B 1_2_0299017B
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_02994F74 1_2_02994F74
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_02999774 1_2_02999774
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_0298F369 1_2_0298F369
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 3_2_100291F6 3_2_100291F6
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 3_2_1002F378 3_2_1002F378
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 3_2_100403D7 3_2_100403D7
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 3_2_1004250B 3_2_1004250B
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 3_2_10041557 3_2_10041557
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 3_2_100395A1 3_2_100395A1
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 3_2_1002F784 3_2_1002F784
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 3_2_1004091B 3_2_1004091B
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 3_2_1002EACF 3_2_1002EACF
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 3_2_1002FBA4 3_2_1002FBA4
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 3_2_10035D96 3_2_10035D96
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 3_2_10040E5F 3_2_10040E5F
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 3_2_1002EFA4 3_2_1002EFA4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_100291F6 4_2_100291F6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_1002F378 4_2_1002F378
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_100403D7 4_2_100403D7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_1004250B 4_2_1004250B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_10041557 4_2_10041557
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_100395A1 4_2_100395A1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_1002F784 4_2_1002F784
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_1004091B 4_2_1004091B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_1002EACF 4_2_1002EACF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_1002FBA4 4_2_1002FBA4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_10035D96 4_2_10035D96
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_10040E5F 4_2_10040E5F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_1002EFA4 4_2_1002EFA4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 5_2_100291F6 5_2_100291F6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 5_2_1002F378 5_2_1002F378
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 5_2_100403D7 5_2_100403D7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 5_2_1004250B 5_2_1004250B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 5_2_10041557 5_2_10041557
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 5_2_100395A1 5_2_100395A1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 5_2_1002F784 5_2_1002F784
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 5_2_1004091B 5_2_1004091B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 5_2_1002EACF 5_2_1002EACF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 5_2_1002FBA4 5_2_1002FBA4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 5_2_10035D96 5_2_10035D96
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 5_2_10040E5F 5_2_10040E5F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 5_2_1002EFA4 5_2_1002EFA4
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: String function: 10030E38 appears 58 times
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: String function: 10030535 appears 87 times
Source: C:\Windows\SysWOW64\rundll32.exe Code function: String function: 10030E38 appears 116 times
Source: C:\Windows\SysWOW64\rundll32.exe Code function: String function: 1003578B appears 46 times
Source: C:\Windows\SysWOW64\rundll32.exe Code function: String function: 10030535 appears 174 times
Source: C:\Windows\SysWOW64\rundll32.exe Code function: String function: 10030568 appears 32 times
PE file contains strange resources
Source: nIQCsrVbbw.dll Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Tries to load missing DLLs
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: sfc.dll Jump to behavior
Source: nIQCsrVbbw.dll Virustotal: Detection: 15%
Source: nIQCsrVbbw.dll ReversingLabs: Detection: 16%
Source: nIQCsrVbbw.dll Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Windows\System32\loaddll32.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\nIQCsrVbbw.dll"
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\nIQCsrVbbw.dll",#1
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\nIQCsrVbbw.dll
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nIQCsrVbbw.dll",#1
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\nIQCsrVbbw.dll,DllRegisterServer
Source: C:\Windows\SysWOW64\regsvr32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\nIQCsrVbbw.dll",DllRegisterServer
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\nIQCsrVbbw.dll",DllRegisterServer
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 7120 -ip 7120
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Gwwrzypqggddo\faunqcxbnkzdy.fxb",DpwIzoKqIHOYx
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Gwwrzypqggddo\faunqcxbnkzdy.fxb",DllRegisterServer
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7120 -s 512
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\nIQCsrVbbw.dll",#1 Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\nIQCsrVbbw.dll Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\nIQCsrVbbw.dll,DllRegisterServer Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nIQCsrVbbw.dll",#1 Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\nIQCsrVbbw.dll",DllRegisterServer Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\nIQCsrVbbw.dll",DllRegisterServer Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Gwwrzypqggddo\faunqcxbnkzdy.fxb",DpwIzoKqIHOYx Jump to behavior
Source: C:\Windows\System32\svchost.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 7120 -ip 7120 Jump to behavior
Source: C:\Windows\System32\svchost.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7120 -s 512 Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Gwwrzypqggddo\faunqcxbnkzdy.fxb",DllRegisterServer Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32 Jump to behavior
Source: C:\Windows\System32\svchost.exe File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WERF34C.tmp Jump to behavior
Source: classification engine Classification label: mal100.troj.evad.winDLL@27/10@0/27
Source: C:\Windows\SysWOW64\rundll32.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nIQCsrVbbw.dll",#1
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7120
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \BaseNamedObjects\Local\SM0:4664:64:WilError_01
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 3_2_10021183 LoadResource,LockResource,SizeofResource, 3_2_10021183
Source: C:\Windows\SysWOW64\rundll32.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\svchost.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\svchost.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: Binary string: propsys.pdbT source: WerFault.exe, 0000000C.00000003.327749292.00000000050E8000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.327800302.00000000050E8000.00000004.00000040.sdmp
Source: Binary string: ws2_32.pdb source: WerFault.exe, 0000000C.00000003.327749292.00000000050E8000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.327800302.00000000050E8000.00000004.00000040.sdmp
Source: Binary string: wimm32.pdbN source: WerFault.exe, 0000000C.00000003.327749292.00000000050E8000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.327800302.00000000050E8000.00000004.00000040.sdmp
Source: Binary string: winspool.pdb source: WerFault.exe, 0000000C.00000003.327749292.00000000050E8000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.327800302.00000000050E8000.00000004.00000040.sdmp
Source: Binary string: wgdi32full.pdb source: WerFault.exe, 0000000C.00000003.327732640.0000000004FF1000.00000004.00000001.sdmp
Source: Binary string: wkernel32.pdb source: WerFault.exe, 0000000C.00000003.323068869.00000000031B1000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.322735848.0000000004CD5000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.327732640.0000000004FF1000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.322759628.00000000031B1000.00000004.00000001.sdmp
Source: Binary string: bcrypt.pdb source: WerFault.exe, 0000000C.00000003.327749292.00000000050E8000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.327800302.00000000050E8000.00000004.00000040.sdmp
Source: Binary string: sechost.pdb source: WerFault.exe, 0000000C.00000003.327739778.00000000050E2000.00000004.00000040.sdmp
Source: Binary string: iphlpapi.pdb source: WerFault.exe, 0000000C.00000003.327749292.00000000050E8000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.327800302.00000000050E8000.00000004.00000040.sdmp
Source: Binary string: ucrtbase.pdb source: WerFault.exe, 0000000C.00000003.327732640.0000000004FF1000.00000004.00000001.sdmp
Source: Binary string: msvcrt.pdb source: WerFault.exe, 0000000C.00000003.327732640.0000000004FF1000.00000004.00000001.sdmp
Source: Binary string: nCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernel32.pdb source: WerFault.exe, 0000000C.00000002.339350125.0000000002CD2000.00000004.00000001.sdmp
Source: Binary string: propsys.pdb source: WerFault.exe, 0000000C.00000003.327749292.00000000050E8000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.327800302.00000000050E8000.00000004.00000040.sdmp
Source: Binary string: wrpcrt4.pdb source: WerFault.exe, 0000000C.00000003.327792469.00000000050E5000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.327739778.00000000050E2000.00000004.00000040.sdmp
Source: Binary string: wntdll.pdb source: WerFault.exe, 0000000C.00000003.323389840.00000000031AB000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.327732640.0000000004FF1000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.322753338.00000000031AB000.00000004.00000001.sdmp
Source: Binary string: wrpcrt4.pdbk source: WerFault.exe, 0000000C.00000003.327792469.00000000050E5000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.327739778.00000000050E2000.00000004.00000040.sdmp
Source: Binary string: shcore.pdb source: WerFault.exe, 0000000C.00000003.327749292.00000000050E8000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.327800302.00000000050E8000.00000004.00000040.sdmp
Source: Binary string: oleaut32.pdbj source: WerFault.exe, 0000000C.00000003.327749292.00000000050E8000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.327800302.00000000050E8000.00000004.00000040.sdmp
Source: Binary string: wgdi32.pdb source: WerFault.exe, 0000000C.00000003.327732640.0000000004FF1000.00000004.00000001.sdmp
Source: Binary string: advapi32.pdb source: WerFault.exe, 0000000C.00000003.327732640.0000000004FF1000.00000004.00000001.sdmp
Source: Binary string: wsspicli.pdb source: WerFault.exe, 0000000C.00000003.327786271.00000000050E0000.00000004.00000040.sdmp
Source: Binary string: Kernel.Appcore.pdb source: WerFault.exe, 0000000C.00000003.327786271.00000000050E0000.00000004.00000040.sdmp
Source: Binary string: msvcp_win.pdb source: WerFault.exe, 0000000C.00000003.327732640.0000000004FF1000.00000004.00000001.sdmp
Source: Binary string: cryptbase.pdb source: WerFault.exe, 0000000C.00000003.327786271.00000000050E0000.00000004.00000040.sdmp
Source: Binary string: bcrypt.pdbv source: WerFault.exe, 0000000C.00000003.327749292.00000000050E8000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.327800302.00000000050E8000.00000004.00000040.sdmp
Source: Binary string: wkernelbase.pdb source: WerFault.exe, 0000000C.00000003.322765718.00000000031B7000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.327732640.0000000004FF1000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.322971705.00000000031B7000.00000004.00000001.sdmp
Source: Binary string: wimm32.pdb source: WerFault.exe, 0000000C.00000003.327749292.00000000050E8000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.327800302.00000000050E8000.00000004.00000040.sdmp
Source: Binary string: sechost.pdbk source: WerFault.exe, 0000000C.00000003.327739778.00000000050E2000.00000004.00000040.sdmp
Source: Binary string: wkernelbase.pdb( source: WerFault.exe, 0000000C.00000003.322765718.00000000031B7000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.322971705.00000000031B7000.00000004.00000001.sdmp
Source: Binary string: bcryptprimitives.pdb source: WerFault.exe, 0000000C.00000003.327786271.00000000050E0000.00000004.00000040.sdmp
Source: Binary string: shlwapi.pdb source: WerFault.exe, 0000000C.00000003.327786271.00000000050E0000.00000004.00000040.sdmp
Source: Binary string: wwin32u.pdb source: WerFault.exe, 0000000C.00000003.327732640.0000000004FF1000.00000004.00000001.sdmp
Source: Binary string: combase.pdb source: WerFault.exe, 0000000C.00000003.327749292.00000000050E8000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.327800302.00000000050E8000.00000004.00000040.sdmp
Source: Binary string: winspool.pdb, source: WerFault.exe, 0000000C.00000003.327749292.00000000050E8000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.327800302.00000000050E8000.00000004.00000040.sdmp
Source: Binary string: wkernel32.pdb( source: WerFault.exe, 0000000C.00000003.323068869.00000000031B1000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.322759628.00000000031B1000.00000004.00000001.sdmp
Source: Binary string: oleaut32.pdb source: WerFault.exe, 0000000C.00000003.327749292.00000000050E8000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.327800302.00000000050E8000.00000004.00000040.sdmp
Source: Binary string: apphelp.pdb source: WerFault.exe, 0000000C.00000003.327732640.0000000004FF1000.00000004.00000001.sdmp
Source: Binary string: wuser32.pdb source: WerFault.exe, 0000000C.00000003.327732640.0000000004FF1000.00000004.00000001.sdmp
Source: Binary string: wntdll.pdb( source: WerFault.exe, 0000000C.00000003.323389840.00000000031AB000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.322753338.00000000031AB000.00000004.00000001.sdmp
Source: nIQCsrVbbw.dll Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: nIQCsrVbbw.dll Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: nIQCsrVbbw.dll Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: nIQCsrVbbw.dll Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: nIQCsrVbbw.dll Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation:

barindex
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_029908E0 push esp; iretd 1_2_029908E3
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_02981195 push cs; iretd 1_2_02981197
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 3_2_1003060D push ecx; ret 3_2_10030620
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 3_2_10030E7D push ecx; ret 3_2_10030E90
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_1003060D push ecx; ret 4_2_10030620
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_10030E7D push ecx; ret 4_2_10030E90
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 5_2_1003060D push ecx; ret 5_2_10030620
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 5_2_10030E7D push ecx; ret 5_2_10030E90
Contains functionality to dynamically determine API calls
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 3_2_1003E278 LoadLibraryA,GetProcAddress,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer, 3_2_1003E278
PE file contains an invalid checksum
Source: nIQCsrVbbw.dll Static PE information: real checksum: 0x970bf should be: 0x943a9
Registers a DLL
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\nIQCsrVbbw.dll

Persistence and Installation Behavior:

barindex
Drops PE files to the windows directory (C:\Windows)
Source: C:\Windows\SysWOW64\rundll32.exe PE file moved: C:\Windows\SysWOW64\Gwwrzypqggddo\faunqcxbnkzdy.fxb Jump to behavior

Hooking and other Techniques for Hiding and Protection:

barindex
Hides that the sample has been downloaded from the Internet (zone.identifier)
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Gwwrzypqggddo\faunqcxbnkzdy.fxb:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Fdefiewemfg\uqkg.jkn:Zone.Identifier read attributes | delete Jump to behavior
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 3_2_100250A3 IsIconic,GetWindowPlacement,GetWindowRect, 3_2_100250A3
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 3_2_1001DFC0 IsIconic,SendMessageA,GetSystemMetrics,GetSystemMetrics,GetClientRect,DrawIcon, 3_2_1001DFC0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_100250A3 IsIconic,GetWindowPlacement,GetWindowRect, 4_2_100250A3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_1001DFC0 IsIconic,SendMessageA,GetSystemMetrics,GetSystemMetrics,GetClientRect,DrawIcon, 4_2_1001DFC0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 5_2_100250A3 IsIconic,GetWindowPlacement,GetWindowRect, 5_2_100250A3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 5_2_1001DFC0 IsIconic,SendMessageA,GetSystemMetrics,GetSystemMetrics,GetClientRect,DrawIcon, 5_2_1001DFC0
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Windows\SysWOW64\rundll32.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\svchost.exe TID: 2504 Thread sleep time: -30000s >= -30000s Jump to behavior
Found evasive API chain (may stop execution after checking a module file name)
Source: C:\Windows\SysWOW64\regsvr32.exe Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep
Source: C:\Windows\SysWOW64\rundll32.exe Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep
Found large amount of non-executed APIs
Source: C:\Windows\SysWOW64\regsvr32.exe API coverage: 4.6 %
Source: C:\Windows\SysWOW64\rundll32.exe API coverage: 5.0 %
Source: C:\Windows\SysWOW64\rundll32.exe API coverage: 5.1 %
Source: C:\Windows\System32\svchost.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe API call chain: ExitProcess graph end node
Source: C:\Windows\SysWOW64\rundll32.exe API call chain: ExitProcess graph end node
Source: C:\Windows\SysWOW64\rundll32.exe API call chain: ExitProcess graph end node
Source: C:\Windows\SysWOW64\rundll32.exe API call chain: ExitProcess graph end node
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: Amcache.hve.12.dr Binary or memory string: VMware
Source: Amcache.hve.12.dr Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000
Source: Amcache.hve.12.dr Binary or memory string: @scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.12.dr Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.12.dr Binary or memory string: VMware, Inc.
Source: svchost.exe, 00000016.00000002.448270189.000001641C4E4000.00000004.00000001.sdmp Binary or memory string: Hyper-V RAWdisplaycatalogmp.microsoft.com
Source: Amcache.hve.12.dr Binary or memory string: VMware Virtual disk SCSI Disk Devicehbin
Source: Amcache.hve.12.dr Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.12.dr Binary or memory string: VMware7,1
Source: Amcache.hve.12.dr Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.12.dr Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.12.dr Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW71.00V.13989454.B64.1906190538,BiosReleaseDate:06/19/2019,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware7,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: rundll32.exe, 0000000B.00000002.691823696.00000000033D6000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.357685602.00000000033D6000.00000004.00000001.sdmp, svchost.exe, 00000016.00000002.448280014.000001641C4EF000.00000004.00000001.sdmp, svchost.exe, 00000016.00000002.448190130.000001641C484000.00000004.00000001.sdmp Binary or memory string: Hyper-V RAW
Source: Amcache.hve.12.dr Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.12.dr Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.12.dr Binary or memory string: VMware, Inc.me
Source: Amcache.hve.12.dr Binary or memory string: VMware-42 35 d8 20 48 cb c7 ff-aa 5e d0 37 a0 49 53 d7
Source: Amcache.hve.12.dr Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: rundll32.exe, 0000000B.00000002.691823696.00000000033D6000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.357685602.00000000033D6000.00000004.00000001.sdmp Binary or memory string: Hyper-V RAW@
Source: Amcache.hve.12.dr Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000

Anti Debugging:

barindex
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 3_2_1002DB0D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 3_2_1002DB0D
Contains functionality to dynamically determine API calls
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 3_2_1003E278 LoadLibraryA,GetProcAddress,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer, 3_2_1003E278
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 3_2_10002D40 SetLastError,SetLastError,SetLastError,SetLastError,GetNativeSystemInfo,SetLastError,VirtualAlloc,VirtualAlloc,SetLastError,GetProcessHeap,HeapAlloc,VirtualFree,SetLastError,VirtualAlloc,SetLastError, 3_2_10002D40
Contains functionality to read the PEB
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_0298F7F7 mov eax, dword ptr fs:[00000030h] 1_2_0298F7F7
Checks if the current process is being debugged
Source: C:\Windows\System32\loaddll32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process queried: DebugPort Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_0298C6B8 LdrInitializeThunk, 1_2_0298C6B8
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 3_2_1003A8D4 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 3_2_1003A8D4
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 3_2_1002DB0D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 3_2_1002DB0D
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 3_2_10032CB9 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 3_2_10032CB9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_1003A8D4 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 4_2_1003A8D4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_1002DB0D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 4_2_1002DB0D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_10032CB9 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 4_2_10032CB9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 5_2_1003A8D4 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 5_2_1003A8D4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 5_2_1002DB0D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 5_2_1002DB0D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 5_2_10032CB9 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 5_2_10032CB9

HIPS / PFW / Operating System Protection Evasion:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\SysWOW64\rundll32.exe Network Connect: 69.16.218.101 144 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Network Connect: 45.138.98.34 80 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nIQCsrVbbw.dll",#1 Jump to behavior
Source: C:\Windows\System32\svchost.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 7120 -ip 7120 Jump to behavior
Source: C:\Windows\System32\svchost.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7120 -s 512 Jump to behavior
Source: loaddll32.exe, 00000001.00000000.312986839.0000000001250000.00000002.00020000.sdmp, loaddll32.exe, 00000001.00000000.313854287.0000000001250000.00000002.00020000.sdmp, rundll32.exe, 0000000B.00000002.691985354.0000000003830000.00000002.00020000.sdmp Binary or memory string: Program Manager
Source: loaddll32.exe, 00000001.00000000.312986839.0000000001250000.00000002.00020000.sdmp, loaddll32.exe, 00000001.00000000.313854287.0000000001250000.00000002.00020000.sdmp, rundll32.exe, 0000000B.00000002.691985354.0000000003830000.00000002.00020000.sdmp Binary or memory string: Shell_TrayWnd
Source: loaddll32.exe, 00000001.00000000.312986839.0000000001250000.00000002.00020000.sdmp, loaddll32.exe, 00000001.00000000.313854287.0000000001250000.00000002.00020000.sdmp, rundll32.exe, 0000000B.00000002.691985354.0000000003830000.00000002.00020000.sdmp Binary or memory string: Progman
Source: loaddll32.exe, 00000001.00000000.312986839.0000000001250000.00000002.00020000.sdmp, loaddll32.exe, 00000001.00000000.313854287.0000000001250000.00000002.00020000.sdmp, rundll32.exe, 0000000B.00000002.691985354.0000000003830000.00000002.00020000.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\SysWOW64\rundll32.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Contains functionality to query locales information (e.g. system language)
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: GetLocaleInfoA, 3_2_1003E000
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,InterlockedDecrement,InterlockedDecrement, 3_2_1003D098
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: _strcpy_s,GetLocaleInfoA,__snwprintf_s,LoadLibraryA, 3_2_1002129B
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,InterlockedDecrement,InterlockedDecrement, 3_2_1003D35E
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,__invoke_watson,___crtGetLocaleInfoW, 3_2_1003850E
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: GetLocaleInfoA,GetLocaleInfoA,GetACP, 3_2_1003D7AE
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo, 3_2_1003C7D2
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: __getptd,_LcidFromHexString,GetLocaleInfoA, 3_2_1003D8C5
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: GetLocaleInfoA,_LcidFromHexString,_GetPrimaryLen,_strlen, 3_2_1003D95D
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage, 3_2_1003D9D1
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: GetLocaleInfoA,GetLocaleInfoA,_LocaleUpdate::_LocaleUpdate,___ascii_strnicmp,__tolower_l,__tolower_l, 3_2_1003F9F4
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: _LocaleUpdate::_LocaleUpdate,GetLocaleInfoW, 3_2_1003EA86
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetLastError,GetLocaleInfoW,__alloca_probe_16,_malloc,GetLocaleInfoW,WideCharToMultiByte,__freea,GetLocaleInfoA, 3_2_1003EABA
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage, 3_2_1003DBA3
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat, 3_2_1003EBF9
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA, 3_2_1003DC64
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA, 3_2_1003DCCB
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,_ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itoa_s, 3_2_1003DD07
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement, 3_2_1003CE40
Source: C:\Windows\SysWOW64\rundll32.exe Code function: GetLocaleInfoA, 4_2_1003E000
Source: C:\Windows\SysWOW64\rundll32.exe Code function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,InterlockedDecrement,InterlockedDecrement, 4_2_1003D098
Source: C:\Windows\SysWOW64\rundll32.exe Code function: _strcpy_s,GetLocaleInfoA,__snwprintf_s,LoadLibraryA, 4_2_1002129B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,InterlockedDecrement,InterlockedDecrement, 4_2_1003D35E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,__invoke_watson,___crtGetLocaleInfoW, 4_2_1003850E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: GetLocaleInfoA,GetLocaleInfoA,GetACP, 4_2_1003D7AE
Source: C:\Windows\SysWOW64\rundll32.exe Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo, 4_2_1003C7D2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: __getptd,_LcidFromHexString,GetLocaleInfoA, 4_2_1003D8C5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: GetLocaleInfoA,_LcidFromHexString,_GetPrimaryLen,_strlen, 4_2_1003D95D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage, 4_2_1003D9D1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: GetLocaleInfoA,GetLocaleInfoA,_LocaleUpdate::_LocaleUpdate,___ascii_strnicmp,__tolower_l,__tolower_l, 4_2_1003F9F4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: _LocaleUpdate::_LocaleUpdate,GetLocaleInfoW, 4_2_1003EA86
Source: C:\Windows\SysWOW64\rundll32.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetLastError,GetLocaleInfoW,__alloca_probe_16,_malloc,GetLocaleInfoW,WideCharToMultiByte,__freea,GetLocaleInfoA, 4_2_1003EABA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage, 4_2_1003DBA3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat, 4_2_1003EBF9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA, 4_2_1003DC64
Source: C:\Windows\SysWOW64\rundll32.exe Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA, 4_2_1003DCCB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,_ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itoa_s, 4_2_1003DD07
Source: C:\Windows\SysWOW64\rundll32.exe Code function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement, 4_2_1003CE40
Source: C:\Windows\SysWOW64\rundll32.exe Code function: GetLocaleInfoA, 5_2_1003E000
Source: C:\Windows\SysWOW64\rundll32.exe Code function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,InterlockedDecrement,InterlockedDecrement, 5_2_1003D098
Source: C:\Windows\SysWOW64\rundll32.exe Code function: _strcpy_s,GetLocaleInfoA,__snwprintf_s,LoadLibraryA, 5_2_1002129B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,InterlockedDecrement,InterlockedDecrement, 5_2_1003D35E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,__invoke_watson,___crtGetLocaleInfoW, 5_2_1003850E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: GetLocaleInfoA,GetLocaleInfoA,GetACP, 5_2_1003D7AE
Source: C:\Windows\SysWOW64\rundll32.exe Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo, 5_2_1003C7D2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: __getptd,_LcidFromHexString,GetLocaleInfoA, 5_2_1003D8C5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: GetLocaleInfoA,_LcidFromHexString,_GetPrimaryLen,_strlen, 5_2_1003D95D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage, 5_2_1003D9D1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: GetLocaleInfoA,GetLocaleInfoA,_LocaleUpdate::_LocaleUpdate,___ascii_strnicmp,__tolower_l,__tolower_l, 5_2_1003F9F4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: _LocaleUpdate::_LocaleUpdate,GetLocaleInfoW, 5_2_1003EA86
Source: C:\Windows\SysWOW64\rundll32.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetLastError,GetLocaleInfoW,__alloca_probe_16,_malloc,GetLocaleInfoW,WideCharToMultiByte,__freea,GetLocaleInfoA, 5_2_1003EABA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage, 5_2_1003DBA3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat, 5_2_1003EBF9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA, 5_2_1003DC64
Source: C:\Windows\SysWOW64\rundll32.exe Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA, 5_2_1003DCCB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,_ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itoa_s, 5_2_1003DD07
Source: C:\Windows\SysWOW64\rundll32.exe Code function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement, 5_2_1003CE40
Source: C:\Windows\SysWOW64\rundll32.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 3_2_1003732F GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter, 3_2_1003732F
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 3_2_10024F01 _memset,GetVersionExA, 3_2_10024F01

Lowering of HIPS / PFW / Operating System Security Settings:

barindex
AV process strings found (often used to terminate AV products)
Source: Amcache.hve.12.dr, Amcache.hve.LOG1.12.dr Binary or memory string: c:\users\user\desktop\procexp.exe
Source: Amcache.hve.12.dr Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.12.dr, Amcache.hve.LOG1.12.dr Binary or memory string: procexp.exe

Stealing of Sensitive Information:

barindex
Yara detected Emotet
Source: Yara match File source: 5.2.rundll32.exe.4d20000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.5d80000.18.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.4d80000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.5aa0000.14.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.4ee0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.4c40000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rundll32.exe.4f60000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.4c70000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.5bb0000.17.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.loaddll32.exe.2980000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.4ee0000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.4480000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.5680000.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.56b0000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.4580000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.loaddll32.exe.2980000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.2d20000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.52b0000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.rundll32.exe.2d20000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.56b0000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.5aa0000.14.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.4f40000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rundll32.exe.51f0000.11.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.4580000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.5d80000.18.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.rundll32.exe.2e20000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rundll32.exe.5320000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.loaddll32.exe.27a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.5990000.12.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.5b80000.16.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rundll32.exe.2eb0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.3280000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.54f0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rundll32.exe.5320000.12.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.5db0000.19.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.59c0000.13.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.4c40000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.5410000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.4f70000.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.6000000.20.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.5410000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.52e0000.11.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.6000000.20.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rundll32.exe.4c40000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.loaddll32.exe.27a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rundll32.exe.5350000.13.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rundll32.exe.4f00000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.4f40000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.2d20000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.5ad0000.15.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.3280000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rundll32.exe.4d50000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.loaddll32.exe.27a0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.46c0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rundll32.exe.4d20000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.regsvr32.exe.dd0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.4c50000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rundll32.exe.51c0000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.4c80000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rundll32.exe.4f90000.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.4d80000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.regsvr32.exe.dd0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.52b0000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rundll32.exe.4700000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rundll32.exe.4c70000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.4c50000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.rundll32.exe.2d20000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.5650000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.6030000.21.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rundll32.exe.4c40000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.4f10000.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rundll32.exe.4f00000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rundll32.exe.4f30000.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.loaddll32.exe.27a0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rundll32.exe.51c0000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rundll32.exe.2eb0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rundll32.exe.4f60000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.4db0000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.5650000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.54f0000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.regsvr32.exe.4930000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.5b80000.16.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.5440000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.loaddll32.exe.27a0000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.56e0000.11.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.32b0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.loaddll32.exe.2980000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.loaddll32.exe.27a0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.5520000.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.5990000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000B.00000002.692416013.00000000054F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.318376552.0000000004F91000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.322328065.0000000002D20000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.692912261.0000000005AA0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.693049451.0000000005B80000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.692792483.0000000005990000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.319220718.0000000004C50000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.340184392.0000000002981000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.313088625.00000000027A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.692538587.0000000005681000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.692564390.00000000056B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.304136320.0000000004931000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.318188927.0000000004C71000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.692047710.0000000004C71000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.313923443.00000000027A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.319469836.0000000004F11000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.692594246.00000000056E1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.318296344.0000000004F00000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.322840736.0000000004481000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.693077342.0000000005BB1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.340127468.00000000027A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.318566617.0000000005320000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.313015794.0000000002D20000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.318521400.00000000051F1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.317820038.0000000002EB0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.693386084.0000000006031000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.318320563.0000000004F31000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.692022013.0000000004C40000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.693354364.0000000006000000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.319637287.00000000052B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.318160754.0000000004C40000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.318877954.0000000004580000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.313073617.0000000002E21000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.692503192.0000000005650000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.318025809.0000000004701000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.303858298.0000000000DD0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.691678754.00000000032B1000.00000020.00000010.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.318347085.0000000004F60000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.692337885.0000000005410000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.319268493.0000000004C81000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.318598439.0000000005351000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.693231899.0000000005D80000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.319350113.0000000004DB1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.319315094.0000000004D80000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.692973628.0000000005AD1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.319560099.0000000004F71000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.314281816.0000000002981000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.692836661.00000000059C1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.691624077.0000000003280000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.318240143.0000000004D51000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.692363013.0000000005441000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.693267062.0000000005DB1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.319417804.0000000004EE0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.318218247.0000000004D20000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.313185864.0000000002981000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.318476243.00000000051C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.319512030.0000000004F40000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.319678344.00000000052E1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.319057129.00000000046C1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.692450211.0000000005521000.00000020.00000001.sdmp, type: MEMORY

Remote Access Functionality:

barindex
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 3_2_10001160 WSAStartup,_memset,htonl,htons,socket,bind,setsockopt, 3_2_10001160
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_10001160 WSAStartup,_memset,htonl,htons,socket,bind,setsockopt, 4_2_10001160
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 5_2_10001160 WSAStartup,_memset,htonl,htons,socket,bind,setsockopt, 5_2_10001160