Windows Analysis Report nIQCsrVbbw.dll

Overview

General Information

Sample Name:	nIQCsrVbbw.dll
Analysis ID:	553359
MD5:	06b75d254c6844f78c7d7eefa5b1243e
SHA1:	af4b4dccf317dbeeab97868a9514a7c9e496c8d3
SHA256:	b0e46325319e75a2490a73045a60030961851c07d266df73d7e048799e133ec7
Tags:	32dllexe
Infos:
Most interesting Screenshot:

Detection

Emotet

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Multi AV Scanner detection for submitted file

Yara detected Emotet

System process connects to network (likely due to code injection or exploit)

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Sigma detected: Suspicious Call by Ordinal

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

One or more processes crash

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Deletes files inside the Windows folder

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Creates files inside the system directory

Internet Provider seen in connection with other malware

Detected potential crypto function

Found potential string decryption / allocating functions

Found evasive API chain (may stop execution after checking a module file name)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to dynamically determine API calls

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

AV process strings found (often used to terminate AV products)

PE file contains an invalid checksum

PE file contains strange resources

Tries to load missing DLLs

Contains functionality to read the PEB

Drops PE files to the windows directory (C:\Windows)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Detected TCP or UDP traffic on non-standard ports

Checks if the current process is being debugged

Connects to several IPs in different countries

Potential key logger detected (key state polling based)

Registers a DLL

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Signatures

AV Detection:

Found malware configuration

Source: 4.2.rundll32.exe.2d20000.0.raw.unpack

Malware Configuration Extractor: Emotet {"C2 list": ["45.138.98.34:80", "69.16.218.101:8080", "51.210.242.234:8080", "185.148.168.220:8080", "142.4.219.173:8080", "54.38.242.185:443", "191.252.103.16:80", "104.131.62.48:8080", "62.171.178.147:8080", "217.182.143.207:443", "168.197.250.14:80", "37.44.244.177:8080", "66.42.57.149:443", "210.57.209.142:8080", "159.69.237.188:443", "116.124.128.206:8080", "128.199.192.135:8080", "195.154.146.35:443", "185.148.168.15:8080", "195.77.239.39:8080", "207.148.81.119:8080", "85.214.67.203:8080", "190.90.233.66:443", "78.46.73.125:443", "78.47.204.80:443", "37.59.209.141:8080", "54.37.228.122:443"], "Public Key": ["RUNTMSAAAAD0LxqDNhonUYwk8sqo7IWuUllRdUiUBnACc6romsQoe1YJD7wIe4AheqYofpZFucPDXCZ0z9i+ooUffqeoLZU0", "RUNLMSAAAADYNZPXY4tQxd/N4Wn5sTYAm5tUOxY2ol1ELrI4MNhHNi640vSLasjYTHpFRBoG+o84vtr7AJachCzOHjaAJFCW"]}

Multi AV Scanner detection for submitted file

Source: nIQCsrVbbw.dll	Virustotal: Detection: 15%			Perma Link
Source: nIQCsrVbbw.dll	ReversingLabs: Detection: 16%

Antivirus detection for URL or domain

Source: https://45.138.98.34:80/pzThWGIkVuQKGXKeHBqdbAz#	Avira URL Cloud: Label: malware
Source: https://45.138.98.34/	Avira URL Cloud: Label: malware
Source: https://45.138.98.34:80/pzThWGIkVuQKGXKeHBqdbAz	Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Source: https://45.138.98.34/

Virustotal: Detection: 10%

Perma Link

Compliance:

Uses 32bit PE files

Source: nIQCsrVbbw.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source:	Binary string: propsys.pdbT source: WerFault.exe, 0000000C.00000003.327749292.00000000050E8000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.327800302.00000000050E8000.00000004.00000040.sdmp
Source:	Binary string: ws2_32.pdb source: WerFault.exe, 0000000C.00000003.327749292.00000000050E8000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.327800302.00000000050E8000.00000004.00000040.sdmp
Source:	Binary string: wimm32.pdbN source: WerFault.exe, 0000000C.00000003.327749292.00000000050E8000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.327800302.00000000050E8000.00000004.00000040.sdmp
Source:	Binary string: winspool.pdb source: WerFault.exe, 0000000C.00000003.327749292.00000000050E8000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.327800302.00000000050E8000.00000004.00000040.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 0000000C.00000003.327732640.0000000004FF1000.00000004.00000001.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 0000000C.00000003.323068869.00000000031B1000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.322735848.0000000004CD5000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.327732640.0000000004FF1000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.322759628.00000000031B1000.00000004.00000001.sdmp
Source:	Binary string: bcrypt.pdb source: WerFault.exe, 0000000C.00000003.327749292.00000000050E8000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.327800302.00000000050E8000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 0000000C.00000003.327739778.00000000050E2000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdb source: WerFault.exe, 0000000C.00000003.327749292.00000000050E8000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.327800302.00000000050E8000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 0000000C.00000003.327732640.0000000004FF1000.00000004.00000001.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 0000000C.00000003.327732640.0000000004FF1000.00000004.00000001.sdmp
Source:	Binary string: nCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernel32.pdb source: WerFault.exe, 0000000C.00000002.339350125.0000000002CD2000.00000004.00000001.sdmp
Source:	Binary string: propsys.pdb source: WerFault.exe, 0000000C.00000003.327749292.00000000050E8000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.327800302.00000000050E8000.00000004.00000040.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 0000000C.00000003.327792469.00000000050E5000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.327739778.00000000050E2000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 0000000C.00000003.323389840.00000000031AB000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.327732640.0000000004FF1000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.322753338.00000000031AB000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdbk source: WerFault.exe, 0000000C.00000003.327792469.00000000050E5000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.327739778.00000000050E2000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 0000000C.00000003.327749292.00000000050E8000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.327800302.00000000050E8000.00000004.00000040.sdmp
Source:	Binary string: oleaut32.pdbj source: WerFault.exe, 0000000C.00000003.327749292.00000000050E8000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.327800302.00000000050E8000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 0000000C.00000003.327732640.0000000004FF1000.00000004.00000001.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 0000000C.00000003.327732640.0000000004FF1000.00000004.00000001.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 0000000C.00000003.327786271.00000000050E0000.00000004.00000040.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 0000000C.00000003.327786271.00000000050E0000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 0000000C.00000003.327732640.0000000004FF1000.00000004.00000001.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 0000000C.00000003.327786271.00000000050E0000.00000004.00000040.sdmp
Source:	Binary string: bcrypt.pdbv source: WerFault.exe, 0000000C.00000003.327749292.00000000050E8000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.327800302.00000000050E8000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 0000000C.00000003.322765718.00000000031B7000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.327732640.0000000004FF1000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.322971705.00000000031B7000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 0000000C.00000003.327749292.00000000050E8000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.327800302.00000000050E8000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdbk source: WerFault.exe, 0000000C.00000003.327739778.00000000050E2000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb( source: WerFault.exe, 0000000C.00000003.322765718.00000000031B7000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.322971705.00000000031B7000.00000004.00000001.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 0000000C.00000003.327786271.00000000050E0000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 0000000C.00000003.327786271.00000000050E0000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 0000000C.00000003.327732640.0000000004FF1000.00000004.00000001.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 0000000C.00000003.327749292.00000000050E8000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.327800302.00000000050E8000.00000004.00000040.sdmp
Source:	Binary string: winspool.pdb, source: WerFault.exe, 0000000C.00000003.327749292.00000000050E8000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.327800302.00000000050E8000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb( source: WerFault.exe, 0000000C.00000003.323068869.00000000031B1000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.322759628.00000000031B1000.00000004.00000001.sdmp
Source:	Binary string: oleaut32.pdb source: WerFault.exe, 0000000C.00000003.327749292.00000000050E8000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.327800302.00000000050E8000.00000004.00000040.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 0000000C.00000003.327732640.0000000004FF1000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 0000000C.00000003.327732640.0000000004FF1000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb( source: WerFault.exe, 0000000C.00000003.323389840.00000000031AB000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.322753338.00000000031AB000.00000004.00000001.sdmp

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Source: Traffic	Snort IDS: 2404332 ET CNC Feodo Tracker Reported CnC Server TCP group 17 192.168.2.3:49743 -> 45.138.98.34:80
Source: Traffic	Snort IDS: 2404338 ET CNC Feodo Tracker Reported CnC Server TCP group 20 192.168.2.3:49744 -> 69.16.218.101:8080

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 69.16.218.101 144			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 45.138.98.34 80			Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	IPs: 45.138.98.34:80
Source: Malware configuration extractor	IPs: 69.16.218.101:8080
Source: Malware configuration extractor	IPs: 51.210.242.234:8080
Source: Malware configuration extractor	IPs: 185.148.168.220:8080
Source: Malware configuration extractor	IPs: 142.4.219.173:8080
Source: Malware configuration extractor	IPs: 54.38.242.185:443
Source: Malware configuration extractor	IPs: 191.252.103.16:80
Source: Malware configuration extractor	IPs: 104.131.62.48:8080
Source: Malware configuration extractor	IPs: 62.171.178.147:8080
Source: Malware configuration extractor	IPs: 217.182.143.207:443
Source: Malware configuration extractor	IPs: 168.197.250.14:80
Source: Malware configuration extractor	IPs: 37.44.244.177:8080
Source: Malware configuration extractor	IPs: 66.42.57.149:443
Source: Malware configuration extractor	IPs: 210.57.209.142:8080
Source: Malware configuration extractor	IPs: 159.69.237.188:443
Source: Malware configuration extractor	IPs: 116.124.128.206:8080
Source: Malware configuration extractor	IPs: 128.199.192.135:8080
Source: Malware configuration extractor	IPs: 195.154.146.35:443
Source: Malware configuration extractor	IPs: 185.148.168.15:8080
Source: Malware configuration extractor	IPs: 195.77.239.39:8080
Source: Malware configuration extractor	IPs: 207.148.81.119:8080
Source: Malware configuration extractor	IPs: 85.214.67.203:8080
Source: Malware configuration extractor	IPs: 190.90.233.66:443
Source: Malware configuration extractor	IPs: 78.46.73.125:443
Source: Malware configuration extractor	IPs: 78.47.204.80:443
Source: Malware configuration extractor	IPs: 37.59.209.141:8080
Source: Malware configuration extractor	IPs: 54.37.228.122:443

Internet Provider seen in connection with other malware

Source: Joe Sandbox View	ASN Name: AS-CHOOPAUS AS-CHOOPAUS
Source: Joe Sandbox View	ASN Name: DIGITALOCEAN-ASNUS DIGITALOCEAN-ASNUS

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 207.148.81.119 207.148.81.119
Source: Joe Sandbox View	IP Address: 104.131.62.48 104.131.62.48

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.2.3:49749 -> 69.16.218.101:8080

Connects to several IPs in different countries

Source: unknown

Network traffic detected: IP country count 11

Source: unknown	TCP traffic detected without corresponding DNS query: 45.138.98.34
Source: unknown	TCP traffic detected without corresponding DNS query: 45.138.98.34
Source: unknown	TCP traffic detected without corresponding DNS query: 45.138.98.34
Source: unknown	TCP traffic detected without corresponding DNS query: 69.16.218.101
Source: unknown	TCP traffic detected without corresponding DNS query: 69.16.218.101
Source: unknown	TCP traffic detected without corresponding DNS query: 69.16.218.101
Source: unknown	TCP traffic detected without corresponding DNS query: 69.16.218.101
Source: unknown	TCP traffic detected without corresponding DNS query: 69.16.218.101
Source: unknown	TCP traffic detected without corresponding DNS query: 69.16.218.101
Source: unknown	TCP traffic detected without corresponding DNS query: 69.16.218.101
Source: unknown	TCP traffic detected without corresponding DNS query: 69.16.218.101
Source: unknown	TCP traffic detected without corresponding DNS query: 69.16.218.101
Source: unknown	TCP traffic detected without corresponding DNS query: 69.16.218.101
Source: unknown	TCP traffic detected without corresponding DNS query: 69.16.218.101
Source: unknown	TCP traffic detected without corresponding DNS query: 69.16.218.101
Source: unknown	TCP traffic detected without corresponding DNS query: 69.16.218.101

Source: svchost.exe, 00000016.00000003.431804996.000001641CD85000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","N equals www.facebook.com (Facebook)
Source: svchost.exe, 00000016.00000003.431804996.000001641CD85000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","N equals www.twitter.com (Twitter)
Source: svchost.exe, 00000016.00000003.431818578.000001641CD96000.00000004.00000001.sdmp, svchost.exe, 00000016.00000003.431804996.000001641CD85000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2022-01-07T11:33:20.1626869Z\|\|.\|\|d5cdcec3-04df-404e-ba07-3240047c89f9\|\|1152921505694348672\|\|Null\|\|fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailab
Source: svchost.exe, 00000016.00000003.431818578.000001641CD96000.00000004.00000001.sdmp, svchost.exe, 00000016.00000003.431804996.000001641CD85000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2022-01-07T11:33:20.1626869Z\|\|.\|\|d5cdcec3-04df-404e-ba07-3240047c89f9\|\|1152921505694348672\|\|Null\|\|fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailab

Source: rundll32.exe, 0000000B.00000002.691887680.000000000341F000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.357629848.000000000341F000.00000004.00000001.sdmp, svchost.exe, 00000016.00000002.448427231.000001641CD00000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: svchost.exe, 00000016.00000002.448280014.000001641C4EF000.00000004.00000001.sdmp	String found in binary or memory: http://crl.ver)
Source: rundll32.exe, 0000000B.00000003.354490654.0000000005C43000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000002.691887680.000000000341F000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.357629848.000000000341F000.00000004.00000001.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/
Source: rundll32.exe, 0000000B.00000003.354490654.0000000005C43000.00000004.00000001.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/.R
Source: rundll32.exe, 0000000B.00000002.691823696.00000000033D6000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.357685602.00000000033D6000.00000004.00000001.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: rundll32.exe, 0000000B.00000002.691887680.000000000341F000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.357629848.000000000341F000.00000004.00000001.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.11.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: rundll32.exe, 0000000B.00000003.354490654.0000000005C43000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000002.691823696.00000000033D6000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.355162517.0000000003459000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000002.691915726.0000000003480000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.357685602.00000000033D6000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.355348418.000000000347F000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.357547662.0000000003480000.00000004.00000001.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?b75da39e41bf0
Source: rundll32.exe, 0000000B.00000002.691887680.000000000341F000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.357629848.000000000341F000.00000004.00000001.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabUW
Source: svchost.exe, 00000016.00000003.424406324.000001641CD5D000.00000004.00000001.sdmp, svchost.exe, 00000016.00000003.424442797.000001641CD80000.00000004.00000001.sdmp, svchost.exe, 00000016.00000003.424316902.000001641CD70000.00000004.00000001.sdmp, svchost.exe, 00000016.00000003.424335971.000001641CD80000.00000004.00000001.sdmp	String found in binary or memory: http://help.disneyplus.com.
Source: Amcache.hve.12.dr	String found in binary or memory: http://upx.sf.net
Source: rundll32.exe, 0000000B.00000002.691823696.00000000033D6000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.357685602.00000000033D6000.00000004.00000001.sdmp	String found in binary or memory: https://45.138.98.34/
Source: rundll32.exe, 0000000B.00000002.691823696.00000000033D6000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.357685602.00000000033D6000.00000004.00000001.sdmp	String found in binary or memory: https://45.138.98.34:80/pzThWGIkVuQKGXKeHBqdbAz
Source: rundll32.exe, 0000000B.00000002.691823696.00000000033D6000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.357685602.00000000033D6000.00000004.00000001.sdmp	String found in binary or memory: https://45.138.98.34:80/pzThWGIkVuQKGXKeHBqdbAz#
Source: rundll32.exe, 0000000B.00000002.691823696.00000000033D6000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.357685602.00000000033D6000.00000004.00000001.sdmp	String found in binary or memory: https://69.16.218.101/
Source: rundll32.exe, 0000000B.00000002.691823696.00000000033D6000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.357685602.00000000033D6000.00000004.00000001.sdmp	String found in binary or memory: https://69.16.218.101/X.
Source: rundll32.exe, 0000000B.00000002.691823696.00000000033D6000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.357685602.00000000033D6000.00000004.00000001.sdmp	String found in binary or memory: https://69.16.218.101:8080/GBwdsVvnKKEsOdMLrBySKnfjLZwMjZtlJDuPNHQIXAc
Source: rundll32.exe, 0000000B.00000002.691823696.00000000033D6000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.357685602.00000000033D6000.00000004.00000001.sdmp	String found in binary or memory: https://69.16.218.101:8080/GBwdsVvnKKEsOdMLrBySKnfjLZwMjZtlJDuPNHQIXAc1
Source: rundll32.exe, 0000000B.00000003.357685602.00000000033D6000.00000004.00000001.sdmp	String found in binary or memory: https://69.16.218.101:8080/GBwdsVvnKKEsOdMLrBySKnfjLZwMjZtlJDuPNHQIXAcDk6
Source: rundll32.exe, 0000000B.00000002.691823696.00000000033D6000.00000004.00000001.sdmp	String found in binary or memory: https://69.16.218.101:8080/GBwdsVvnKKEsOdMLrBySKnfjLZwMjZtlJDuPNHQIXAcDk7
Source: rundll32.exe, 0000000B.00000002.691823696.00000000033D6000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.357685602.00000000033D6000.00000004.00000001.sdmp	String found in binary or memory: https://69.16.218.101:8080/GBwdsVvnKKEsOdMLrBySKnfjLZwMjZtlJDuPNHQIXAcY
Source: svchost.exe, 00000016.00000003.424406324.000001641CD5D000.00000004.00000001.sdmp, svchost.exe, 00000016.00000003.424442797.000001641CD80000.00000004.00000001.sdmp, svchost.exe, 00000016.00000003.424316902.000001641CD70000.00000004.00000001.sdmp, svchost.exe, 00000016.00000003.424335971.000001641CD80000.00000004.00000001.sdmp	String found in binary or memory: https://disneyplus.com/legal.
Source: svchost.exe, 00000016.00000003.424406324.000001641CD5D000.00000004.00000001.sdmp, svchost.exe, 00000016.00000003.424442797.000001641CD80000.00000004.00000001.sdmp, svchost.exe, 00000016.00000003.424316902.000001641CD70000.00000004.00000001.sdmp, svchost.exe, 00000016.00000003.424335971.000001641CD80000.00000004.00000001.sdmp	String found in binary or memory: https://www.disneyplus.com/legal/privacy-policy
Source: svchost.exe, 00000016.00000003.424406324.000001641CD5D000.00000004.00000001.sdmp, svchost.exe, 00000016.00000003.424442797.000001641CD80000.00000004.00000001.sdmp, svchost.exe, 00000016.00000003.424316902.000001641CD70000.00000004.00000001.sdmp, svchost.exe, 00000016.00000003.424335971.000001641CD80000.00000004.00000001.sdmp	String found in binary or memory: https://www.disneyplus.com/legal/your-california-privacy-rights
Source: svchost.exe, 00000016.00000003.425939891.000001641CDAB000.00000004.00000001.sdmp, svchost.exe, 00000016.00000003.425986683.000001641CD7B000.00000004.00000001.sdmp, svchost.exe, 00000016.00000003.425998694.000001641CD94000.00000004.00000001.sdmp, svchost.exe, 00000016.00000003.426066267.000001641D202000.00000004.00000001.sdmp, svchost.exe, 00000016.00000003.425960822.000001641CDAB000.00000004.00000001.sdmp	String found in binary or memory: https://www.tiktok.com/legal/report/feedback

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 3_2_10001280 recvfrom,

3_2_10001280

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Potential key logger detected (key state polling based)

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_10027958 GetKeyState,GetKeyState,GetKeyState,GetKeyState,SendMessageA,	3_2_10027958
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10027958 GetKeyState,GetKeyState,GetKeyState,GetKeyState,SendMessageA,	4_2_10027958
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10027958 GetKeyState,GetKeyState,GetKeyState,GetKeyState,SendMessageA,	5_2_10027958

E-Banking Fraud:

Yara detected Emotet

Source: Yara match	File source: 5.2.rundll32.exe.4d20000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.5d80000.18.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.4d80000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.5aa0000.14.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.4ee0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.4c40000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.4f60000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.4c70000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.5bb0000.17.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.loaddll32.exe.2980000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.4ee0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.rundll32.exe.4480000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.5680000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.56b0000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.4580000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.2980000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.rundll32.exe.2d20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.52b0000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.2d20000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.56b0000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.5aa0000.14.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.4f40000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.51f0000.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.4580000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.5d80000.18.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.2e20000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.5320000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.27a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.5990000.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.5b80000.16.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.2eb0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.3280000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.54f0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.5320000.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.5db0000.19.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.59c0000.13.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.4c40000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.5410000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.4f70000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.6000000.20.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.5410000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.52e0000.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.6000000.20.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.4c40000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.loaddll32.exe.27a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.5350000.13.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.4f00000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.4f40000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.rundll32.exe.2d20000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.5ad0000.15.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.3280000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.4d50000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.loaddll32.exe.27a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.46c0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.4d20000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.regsvr32.exe.dd0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.4c50000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.51c0000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.4c80000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.4f90000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.4d80000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.regsvr32.exe.dd0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.52b0000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.4700000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.4c70000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.4c50000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.2d20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.5650000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.6030000.21.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.4c40000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.4f10000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.4f00000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.4f30000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.27a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.51c0000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.2eb0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.4f60000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.4db0000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.5650000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.54f0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.regsvr32.exe.4930000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.5b80000.16.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.5440000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.loaddll32.exe.27a0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.56e0000.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.32b0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.loaddll32.exe.2980000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.loaddll32.exe.27a0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.5520000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.5990000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.692416013.00000000054F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.318376552.0000000004F91000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.322328065.0000000002D20000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.692912261.0000000005AA0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.693049451.0000000005B80000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.692792483.0000000005990000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.319220718.0000000004C50000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.340184392.0000000002981000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.313088625.00000000027A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.692538587.0000000005681000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.692564390.00000000056B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.304136320.0000000004931000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.318188927.0000000004C71000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.692047710.0000000004C71000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.313923443.00000000027A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.319469836.0000000004F11000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.692594246.00000000056E1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.318296344.0000000004F00000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.322840736.0000000004481000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.693077342.0000000005BB1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.340127468.00000000027A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.318566617.0000000005320000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.313015794.0000000002D20000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.318521400.00000000051F1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.317820038.0000000002EB0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.693386084.0000000006031000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.318320563.0000000004F31000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.692022013.0000000004C40000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.693354364.0000000006000000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.319637287.00000000052B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.318160754.0000000004C40000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.318877954.0000000004580000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.313073617.0000000002E21000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.692503192.0000000005650000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.318025809.0000000004701000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.303858298.0000000000DD0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.691678754.00000000032B1000.00000020.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.318347085.0000000004F60000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.692337885.0000000005410000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.319268493.0000000004C81000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.318598439.0000000005351000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.693231899.0000000005D80000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.319350113.0000000004DB1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.319315094.0000000004D80000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.692973628.0000000005AD1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.319560099.0000000004F71000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.314281816.0000000002981000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.692836661.00000000059C1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.691624077.0000000003280000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.318240143.0000000004D51000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.692363013.0000000005441000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.693267062.0000000005DB1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.319417804.0000000004EE0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.318218247.0000000004D20000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.313185864.0000000002981000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.318476243.00000000051C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.319512030.0000000004F40000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.319678344.00000000052E1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.319057129.00000000046C1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.692450211.0000000005521000.00000020.00000001.sdmp, type: MEMORY

System Summary:

Uses 32bit PE files

Source: nIQCsrVbbw.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

One or more processes crash

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 7120 -ip 7120

Deletes files inside the Windows folder

Source: C:\Windows\SysWOW64\rundll32.exe

File deleted: C:\Windows\SysWOW64\Gwwrzypqggddo\faunqcxbnkzdy.fxb:Zone.Identifier

Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0299EFDD	1_2_0299EFDD
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0298C6B8	1_2_0298C6B8
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_02990ABA	1_2_02990ABA
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_02990EBC	1_2_02990EBC
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_029A46BD	1_2_029A46BD
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_029A36AA	1_2_029A36AA
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0298BAA9	1_2_0298BAA9
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_02993EAA	1_2_02993EAA
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_02981CA1	1_2_02981CA1
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0299A2A5	1_2_0299A2A5
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0299CCD9	1_2_0299CCD9
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0299D8DB	1_2_0299D8DB
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0299CAD5	1_2_0299CAD5
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_029880C0	1_2_029880C0
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0299BEFD	1_2_0299BEFD
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0298F0E9	1_2_0298F0E9
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_029A3EE9	1_2_029A3EE9
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_029A00EF	1_2_029A00EF
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0299E4E5	1_2_0299E4E5
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_029A2009	1_2_029A2009
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_02997A0F	1_2_02997A0F
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_02999A01	1_2_02999A01
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_02998806	1_2_02998806
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_02983431	1_2_02983431
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_02988636	1_2_02988636
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0298B820	1_2_0298B820
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_02992E5D	1_2_02992E5D
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0299B257	1_2_0299B257
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0298E640	1_2_0298E640
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0299F840	1_2_0299F840
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_02987442	1_2_02987442
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0298A445	1_2_0298A445
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_02994244	1_2_02994244
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_02987078	1_2_02987078
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_02987E79	1_2_02987E79
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0299567B	1_2_0299567B
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0299DC71	1_2_0299DC71
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0298A871	1_2_0298A871
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0298DE74	1_2_0298DE74
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0299A474	1_2_0299A474
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_029A3263	1_2_029A3263
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_029A0A64	1_2_029A0A64
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_02994A66	1_2_02994A66
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_02982194	1_2_02982194
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0298238C	1_2_0298238C
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0298FB8E	1_2_0298FB8E
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_02993D85	1_2_02993D85
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_02996187	1_2_02996187
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_02990F86	1_2_02990F86
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_029857B8	1_2_029857B8
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0299D1BC	1_2_0299D1BC
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0298BFBE	1_2_0298BFBE
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_029A17BD	1_2_029A17BD
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_029A07AA	1_2_029A07AA
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_02998FAE	1_2_02998FAE
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_029877A3	1_2_029877A3
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0298C5D8	1_2_0298C5D8
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0298E7DE	1_2_0298E7DE
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0299FBDE	1_2_0299FBDE
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0299C5D5	1_2_0299C5D5
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0299E1F8	1_2_0299E1F8
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_02984BFC	1_2_02984BFC
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_029985FF	1_2_029985FF
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_029855FF	1_2_029855FF
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_02999DF5	1_2_02999DF5
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_029967E6	1_2_029967E6
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_02995515	1_2_02995515
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0299AD08	1_2_0299AD08
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_029A2B09	1_2_029A2B09
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0298670B	1_2_0298670B
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0298EF0C	1_2_0298EF0C
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_02981F38	1_2_02981F38
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_02998D3D	1_2_02998D3D
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_02995333	1_2_02995333
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0299FF58	1_2_0299FF58
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_02997D5B	1_2_02997D5B
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_029A2D53	1_2_029A2D53
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0299E955	1_2_0299E955
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0299654A	1_2_0299654A
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0298D14C	1_2_0298D14C
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_02992142	1_2_02992142
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_02995779	1_2_02995779
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_02986B7A	1_2_02986B7A
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0299017B	1_2_0299017B
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_02994F74	1_2_02994F74
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_02999774	1_2_02999774
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0298F369	1_2_0298F369
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_100291F6	3_2_100291F6
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_1002F378	3_2_1002F378
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_100403D7	3_2_100403D7
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_1004250B	3_2_1004250B
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_10041557	3_2_10041557
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_100395A1	3_2_100395A1
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_1002F784	3_2_1002F784
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_1004091B	3_2_1004091B
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_1002EACF	3_2_1002EACF
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_1002FBA4	3_2_1002FBA4
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_10035D96	3_2_10035D96
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_10040E5F	3_2_10040E5F
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_1002EFA4	3_2_1002EFA4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_100291F6	4_2_100291F6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1002F378	4_2_1002F378
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_100403D7	4_2_100403D7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1004250B	4_2_1004250B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10041557	4_2_10041557
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_100395A1	4_2_100395A1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1002F784	4_2_1002F784
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1004091B	4_2_1004091B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1002EACF	4_2_1002EACF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1002FBA4	4_2_1002FBA4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10035D96	4_2_10035D96
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10040E5F	4_2_10040E5F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1002EFA4	4_2_1002EFA4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_100291F6	5_2_100291F6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1002F378	5_2_1002F378
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_100403D7	5_2_100403D7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1004250B	5_2_1004250B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10041557	5_2_10041557
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_100395A1	5_2_100395A1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1002F784	5_2_1002F784
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1004091B	5_2_1004091B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1002EACF	5_2_1002EACF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1002FBA4	5_2_1002FBA4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10035D96	5_2_10035D96
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10040E5F	5_2_10040E5F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1002EFA4	5_2_1002EFA4

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: String function: 10030E38 appears 58 times
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: String function: 10030535 appears 87 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 10030E38 appears 116 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 1003578B appears 46 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 10030535 appears 174 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 10030568 appears 32 times

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\nIQCsrVbbw.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\nIQCsrVbbw.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\nIQCsrVbbw.dll
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nIQCsrVbbw.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\nIQCsrVbbw.dll,DllRegisterServer
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\nIQCsrVbbw.dll",DllRegisterServer
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\nIQCsrVbbw.dll",DllRegisterServer
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 7120 -ip 7120
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Gwwrzypqggddo\faunqcxbnkzdy.fxb",DpwIzoKqIHOYx
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Gwwrzypqggddo\faunqcxbnkzdy.fxb",DllRegisterServer
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7120 -s 512
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\nIQCsrVbbw.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\nIQCsrVbbw.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\nIQCsrVbbw.dll,DllRegisterServer	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nIQCsrVbbw.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\nIQCsrVbbw.dll",DllRegisterServer	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\nIQCsrVbbw.dll",DllRegisterServer	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Gwwrzypqggddo\faunqcxbnkzdy.fxb",DpwIzoKqIHOYx	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 7120 -ip 7120	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7120 -s 512	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Gwwrzypqggddo\faunqcxbnkzdy.fxb",DllRegisterServer	Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7120
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:4664:64:WilError_01

Source: C:\Windows\SysWOW64\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: nIQCsrVbbw.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: nIQCsrVbbw.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: nIQCsrVbbw.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: nIQCsrVbbw.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: nIQCsrVbbw.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_029908E0 push esp; iretd	1_2_029908E3
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_02981195 push cs; iretd	1_2_02981197
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_1003060D push ecx; ret	3_2_10030620
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_10030E7D push ecx; ret	3_2_10030E90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1003060D push ecx; ret	4_2_10030620
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10030E7D push ecx; ret	4_2_10030E90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1003060D push ecx; ret	5_2_10030620
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10030E7D push ecx; ret	5_2_10030E90

Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Windows\SysWOW64\Gwwrzypqggddo\faunqcxbnkzdy.fxb:Zone.Identifier read attributes \| delete			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Windows\SysWOW64\Fdefiewemfg\uqkg.jkn:Zone.Identifier read attributes \| delete			Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_100250A3 IsIconic,GetWindowPlacement,GetWindowRect,	3_2_100250A3
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_1001DFC0 IsIconic,SendMessageA,GetSystemMetrics,GetSystemMetrics,GetClientRect,DrawIcon,	3_2_1001DFC0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_100250A3 IsIconic,GetWindowPlacement,GetWindowRect,	4_2_100250A3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1001DFC0 IsIconic,SendMessageA,GetSystemMetrics,GetSystemMetrics,GetClientRect,DrawIcon,	4_2_1001DFC0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_100250A3 IsIconic,GetWindowPlacement,GetWindowRect,	5_2_100250A3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001DFC0 IsIconic,SendMessageA,GetSystemMetrics,GetSystemMetrics,GetClientRect,DrawIcon,	5_2_1001DFC0

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep
Source: C:\Windows\SysWOW64\rundll32.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep

Source: C:\Windows\SysWOW64\regsvr32.exe	API coverage: 4.6 %
Source: C:\Windows\SysWOW64\rundll32.exe	API coverage: 5.0 %
Source: C:\Windows\SysWOW64\rundll32.exe	API coverage: 5.1 %

Source: C:\Windows\SysWOW64\regsvr32.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node

Source: C:\Windows\SysWOW64\rundll32.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior

Source: Amcache.hve.12.dr	Binary or memory string: VMware
Source: Amcache.hve.12.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000
Source: Amcache.hve.12.dr	Binary or memory string: @scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.12.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.12.dr	Binary or memory string: VMware, Inc.
Source: svchost.exe, 00000016.00000002.448270189.000001641C4E4000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAWdisplaycatalogmp.microsoft.com
Source: Amcache.hve.12.dr	Binary or memory string: VMware Virtual disk SCSI Disk Devicehbin
Source: Amcache.hve.12.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.12.dr	Binary or memory string: VMware7,1
Source: Amcache.hve.12.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.12.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.12.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW71.00V.13989454.B64.1906190538,BiosReleaseDate:06/19/2019,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware7,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: rundll32.exe, 0000000B.00000002.691823696.00000000033D6000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.357685602.00000000033D6000.00000004.00000001.sdmp, svchost.exe, 00000016.00000002.448280014.000001641C4EF000.00000004.00000001.sdmp, svchost.exe, 00000016.00000002.448190130.000001641C484000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.12.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.12.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.12.dr	Binary or memory string: VMware, Inc.me
Source: Amcache.hve.12.dr	Binary or memory string: VMware-42 35 d8 20 48 cb c7 ff-aa 5e d0 37 a0 49 53 d7
Source: Amcache.hve.12.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: rundll32.exe, 0000000B.00000002.691823696.00000000033D6000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.357685602.00000000033D6000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW@
Source: Amcache.hve.12.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000

Source: C:\Windows\System32\loaddll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_1003A8D4 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_1003A8D4
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_1002DB0D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_1002DB0D
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_10032CB9 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_10032CB9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1003A8D4 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_1003A8D4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1002DB0D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_1002DB0D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10032CB9 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_10032CB9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1003A8D4 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_1003A8D4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1002DB0D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_1002DB0D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10032CB9 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_10032CB9

Source: loaddll32.exe, 00000001.00000000.312986839.0000000001250000.00000002.00020000.sdmp, loaddll32.exe, 00000001.00000000.313854287.0000000001250000.00000002.00020000.sdmp, rundll32.exe, 0000000B.00000002.691985354.0000000003830000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: loaddll32.exe, 00000001.00000000.312986839.0000000001250000.00000002.00020000.sdmp, loaddll32.exe, 00000001.00000000.313854287.0000000001250000.00000002.00020000.sdmp, rundll32.exe, 0000000B.00000002.691985354.0000000003830000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: loaddll32.exe, 00000001.00000000.312986839.0000000001250000.00000002.00020000.sdmp, loaddll32.exe, 00000001.00000000.313854287.0000000001250000.00000002.00020000.sdmp, rundll32.exe, 0000000B.00000002.691985354.0000000003830000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: loaddll32.exe, 00000001.00000000.312986839.0000000001250000.00000002.00020000.sdmp, loaddll32.exe, 00000001.00000000.313854287.0000000001250000.00000002.00020000.sdmp, rundll32.exe, 0000000B.00000002.691985354.0000000003830000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: GetLocaleInfoA,	3_2_1003E000
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,InterlockedDecrement,InterlockedDecrement,	3_2_1003D098
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: _strcpy_s,GetLocaleInfoA,__snwprintf_s,LoadLibraryA,	3_2_1002129B
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,InterlockedDecrement,InterlockedDecrement,	3_2_1003D35E
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,__invoke_watson,___crtGetLocaleInfoW,	3_2_1003850E
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: GetLocaleInfoA,GetLocaleInfoA,GetACP,	3_2_1003D7AE
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	3_2_1003C7D2
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	3_2_1003D8C5
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: GetLocaleInfoA,_LcidFromHexString,_GetPrimaryLen,_strlen,	3_2_1003D95D
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	3_2_1003D9D1
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: GetLocaleInfoA,GetLocaleInfoA,_LocaleUpdate::_LocaleUpdate,___ascii_strnicmp,__tolower_l,__tolower_l,	3_2_1003F9F4
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: _LocaleUpdate::_LocaleUpdate,GetLocaleInfoW,	3_2_1003EA86
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLastError,GetLocaleInfoW,__alloca_probe_16,_malloc,GetLocaleInfoW,WideCharToMultiByte,__freea,GetLocaleInfoA,	3_2_1003EABA
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	3_2_1003DBA3
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	3_2_1003EBF9
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	3_2_1003DC64
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	3_2_1003DCCB
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,_ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itoa_s,	3_2_1003DD07
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement,	3_2_1003CE40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoA,	4_2_1003E000
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,InterlockedDecrement,InterlockedDecrement,	4_2_1003D098
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _strcpy_s,GetLocaleInfoA,__snwprintf_s,LoadLibraryA,	4_2_1002129B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,InterlockedDecrement,InterlockedDecrement,	4_2_1003D35E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,__invoke_watson,___crtGetLocaleInfoW,	4_2_1003850E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoA,GetLocaleInfoA,GetACP,	4_2_1003D7AE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	4_2_1003C7D2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	4_2_1003D8C5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoA,_LcidFromHexString,_GetPrimaryLen,_strlen,	4_2_1003D95D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	4_2_1003D9D1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoA,GetLocaleInfoA,_LocaleUpdate::_LocaleUpdate,___ascii_strnicmp,__tolower_l,__tolower_l,	4_2_1003F9F4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _LocaleUpdate::_LocaleUpdate,GetLocaleInfoW,	4_2_1003EA86
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLastError,GetLocaleInfoW,__alloca_probe_16,_malloc,GetLocaleInfoW,WideCharToMultiByte,__freea,GetLocaleInfoA,	4_2_1003EABA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	4_2_1003DBA3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	4_2_1003EBF9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	4_2_1003DC64
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	4_2_1003DCCB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,_ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itoa_s,	4_2_1003DD07
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement,	4_2_1003CE40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoA,	5_2_1003E000
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,InterlockedDecrement,InterlockedDecrement,	5_2_1003D098
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _strcpy_s,GetLocaleInfoA,__snwprintf_s,LoadLibraryA,	5_2_1002129B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,InterlockedDecrement,InterlockedDecrement,	5_2_1003D35E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,__invoke_watson,___crtGetLocaleInfoW,	5_2_1003850E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoA,GetLocaleInfoA,GetACP,	5_2_1003D7AE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	5_2_1003C7D2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	5_2_1003D8C5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoA,_LcidFromHexString,_GetPrimaryLen,_strlen,	5_2_1003D95D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	5_2_1003D9D1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoA,GetLocaleInfoA,_LocaleUpdate::_LocaleUpdate,___ascii_strnicmp,__tolower_l,__tolower_l,	5_2_1003F9F4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _LocaleUpdate::_LocaleUpdate,GetLocaleInfoW,	5_2_1003EA86
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLastError,GetLocaleInfoW,__alloca_probe_16,_malloc,GetLocaleInfoW,WideCharToMultiByte,__freea,GetLocaleInfoA,	5_2_1003EABA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	5_2_1003DBA3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	5_2_1003EBF9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	5_2_1003DC64
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	5_2_1003DCCB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,_ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itoa_s,	5_2_1003DD07
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement,	5_2_1003CE40

Source: Amcache.hve.12.dr, Amcache.hve.LOG1.12.dr	Binary or memory string: c:\users\user\desktop\procexp.exe
Source: Amcache.hve.12.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.12.dr, Amcache.hve.LOG1.12.dr	Binary or memory string: procexp.exe

Windows Analysis Report nIQCsrVbbw.dll

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection:

Compliance:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Remote Access Functionality:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_10001160 WSAStartup,_memset,htonl,htons,socket,bind,setsockopt,	3_2_10001160
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10001160 WSAStartup,_memset,htonl,htons,socket,bind,setsockopt,	4_2_10001160
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10001160 WSAStartup,_memset,htonl,htons,socket,bind,setsockopt,	5_2_10001160

IP	Domain	Country	ASN	ASN Name	Malicious
207.148.81.119	unknown	United States	20473	AS-CHOOPAUS	true
104.131.62.48	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
85.214.67.203	unknown	Germany	6724	STRATOSTRATOAGDE	true
191.252.103.16	unknown	Brazil	27715	LocawebServicosdeInternetSABR	true
168.197.250.14	unknown	Argentina	264776	OmarAnselmoRipollTDCNETAR	true
66.42.57.149	unknown	United States	20473	AS-CHOOPAUS	true
185.148.168.15	unknown	Germany	44780	EVERSCALE-ASDE	true
51.210.242.234	unknown	France	16276	OVHFR	true
217.182.143.207	unknown	France	16276	OVHFR	true
69.16.218.101	unknown	United States	32244	LIQUIDWEBUS	true
159.69.237.188	unknown	Germany	24940	HETZNER-ASDE	true
45.138.98.34	unknown	Germany	9009	M247GB	true
116.124.128.206	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	true
78.46.73.125	unknown	Germany	24940	HETZNER-ASDE	true
37.59.209.141	unknown	France	16276	OVHFR	true
210.57.209.142	unknown	Indonesia	38142	UNAIR-AS-IDUniversitasAirlanggaID	true
185.148.168.220	unknown	Germany	44780	EVERSCALE-ASDE	true
54.37.228.122	unknown	France	16276	OVHFR	true
190.90.233.66	unknown	Colombia	18678	INTERNEXASAESPCO	true
142.4.219.173	unknown	Canada	16276	OVHFR	true
54.38.242.185	unknown	France	16276	OVHFR	true
195.154.146.35	unknown	France	12876	OnlineSASFR	true
195.77.239.39	unknown	Spain	60493	FICOSA-ASES	true
78.47.204.80	unknown	Germany	24940	HETZNER-ASDE	true
37.44.244.177	unknown	Germany	47583	AS-HOSTINGERLT	true
62.171.178.147	unknown	United Kingdom	51167	CONTABODE	true
128.199.192.135	unknown	United Kingdom	14061	DIGITALOCEAN-ASNUS	true

ID:	553359
Product:	CloudBasic
Start time:	19:14:26
Start date:	14.01.2022
Sample:	nIQCsrVbbw.dll
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	06b75d254c6844f78c7d7eefa5b1243e
SHA1:	af4b4dccf317dbeeab97868a9514a7c9e496c8d3
SHA256:	b0e46325319e75a2490a73045a60030961851c07d266df73d7e048799e133ec7
Filetype:	Win32 Dynamic Link Library (generic) (1002004/3) 98.32%

Name	Type	MD5	SHA1	SHA256
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_loaddll32.exe_7d3365b34093db6d884642e334bbbe4e6283fce_7cac0383_14c0c43b\Report.wer	Little-endian UTF-16 Unicode text, with CRLF line terminators	47C2236FC7F7FD33768FF717485077EB	324F37B4BEEACEF393D3A17CE93CF532EC4ADC11	03DD114B8DD767BD30BCAEC649F2F1F9D3955C99237012C1500B926831CA5D3D
C:\ProgramData\Microsoft\Windows\WER\Temp\WERAAA8.tmp.dmp	Mini DuMP crash report, 15 streams, Sat Jan 15 03:15:40 2022, 0x1205a4 type	71B4C5580B40320A438CFD5FB6318F90	D36630F59F017522FAFA589E0E16E188CAD51E1B	18DD7914A802132AB3588CEB3B6D018D2E21C3A90B271C1CC59ED4051952A956
C:\ProgramData\Microsoft\Windows\WER\Temp\WERB279.tmp.WERInternalMetadata.xml	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators	90B5BE2F43F15777EB8F5679E2D1ED90	7B32AECF5B9A00734A6819DC3DC5C3642723B061	B9A979479D191E484C34A2F5DDFFEAFBA1F432ED358D6E1B31C5B68BEFAFEFC8
C:\ProgramData\Microsoft\Windows\WER\Temp\WERB856.tmp.xml	XML 1.0 document, ASCII text, with CRLF line terminators	604B8C9DCC9B9E290D1D0DF60E50775B	126AC935B694F4056DDE1FC149A0FF553E4A3EBA	02DFC7906EC712185A60370C253A67F706299AEAF3D8E249B6A77B2F6C248DE9
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF34C.tmp.csv	data	AC6216F35194ED9F55807A18231C72AD	67635A1B75DC59A28B32D6AB995952FBEBD7D505	984846E6359246613180B05172F4A3FC0C6CDBD7E6EDA1941EC4802E7D8A8E77
C:\ProgramData\Microsoft\Windows\WER\Temp\WERFCB3.tmp.txt	data	245D6B6A0941C49EF44FD9032DDC5A3E	12FF2B0A655C324810D4D0F33B231415F1530B00	0CDF58E4D753E0BC759A2C218AC292EE6B6C8D8F63A55B0AD20764CC6253B08B
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, 61414 bytes, 1 file	ACAEDA60C79C6BCAC925EEB3653F45E0	2AAAE490BCDACCC6172240FF1697753B37AC5578	6B0CECCF0103AFD89844761417C1D23ACC41F8AEBF3B7230765209B61EEE5658
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	C7310ED6A35F0A29E56D62EC65202D14	C0A8D240D5D0EC262CA4730912C319CCB2E50325	7D6E9CC48DB506283A5F874F529584E3B4797E838B42A8D0853B5DAE4AF058DE
C:\Windows\appcompat\Programs\Amcache.hve	MS Windows registry file, NT/2000 or above	3B45DA502DAB998978618A4F00F4AED7	0CAF7FCB6AF81676CB12AD9478C9A06DD5092907	AAD5608AD5C838E8F57507D8805B638DAA47B21E7FFE0798C202B9793631F9F2
C:\Windows\appcompat\Programs\Amcache.hve.LOG1	MS Windows registry file, NT/2000 or above	7EC880F71B2856F603D1F6E3003FF20E	84AE43885AF4178D7AAF9E04C923D048FEF8E86B	3A317BB8611AB523EA59949CF09F5266F0DA421312DEEBEE5D96EE1AF68571B1