Edit tour

Windows Analysis Report
9818t9ks1s

Overview

General Information

Sample Name:	9818t9ks1s (renamed file extension from none to dll)
Analysis ID:	669370
MD5:	83418a9af56db91ff2c78c4b2b9d62f8
SHA1:	0ea68aab3721e509ce0b1bff7e574eda037798be
SHA256:	4a688f571024b08f9793559427d8692471f5aa715882899c631c3052eac7c6a1
Tags:	32dllexetrojan
Infos:

Detection

Emotet

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Antivirus / Scanner detection for submitted sample

Yara detected Emotet

System process connects to network (likely due to code injection or exploit)

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Snort IDS alert for network traffic

Machine Learning detection for sample

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Contains functionality to query locales information (e.g. system language)

Deletes files inside the Windows folder

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Creates files inside the system directory

Internet Provider seen in connection with other malware

Detected potential crypto function

Found potential string decryption / allocating functions

Found evasive API chain (may stop execution after checking a module file name)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to dynamically determine API calls

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Program does not show much activity (idle)

IP address seen in connection with other malware

PE file contains strange resources

Tries to load missing DLLs

Drops PE files to the windows directory (C:\Windows)

Detected TCP or UDP traffic on non-standard ports

Checks if the current process is being debugged

Connects to several IPs in different countries

Potential key logger detected (key state polling based)

Registers a DLL

Queries disk information (often used to detect virtual machines)

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 6888 cmdline: loaddll32.exe "C:\Users\user\Desktop\9818t9ks1s.dll" MD5: 7DEB5DB86C0AC789123DEC286286B938)

cmd.exe (PID: 6896 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\9818t9ks1s.dll",#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

rundll32.exe (PID: 6924 cmdline: rundll32.exe "C:\Users\user\Desktop\9818t9ks1s.dll",#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

regsvr32.exe (PID: 6912 cmdline: regsvr32.exe /s C:\Users\user\Desktop\9818t9ks1s.dll MD5: 426E7499F6A7346F0410DEAD0805586B)

regsvr32.exe (PID: 7020 cmdline: C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Bvqee\qeggfkimakwygr.che" MD5: 426E7499F6A7346F0410DEAD0805586B)

rundll32.exe (PID: 6932 cmdline: rundll32.exe C:\Users\user\Desktop\9818t9ks1s.dll,DllRegisterServer MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 7040 cmdline: rundll32.exe C:\Users\user\Desktop\9818t9ks1s.dll,DllUnregisterServerr MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

svchost.exe (PID: 5084 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6324 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6576 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 3952 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 7028 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 5748 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

cleanup

Malware Configuration

Threatname: Emotet

{"C2 list": ["51.91.7.5:8080", "197.242.150.244:8080", "1.234.2.232:8080", "173.212.193.249:8080", "51.91.76.89:8080", "151.106.112.196:8080", "107.182.225.142:8080", "103.43.46.182:443", "195.201.151.129:8080", "51.254.140.238:7080", "153.126.146.25:7080", "176.56.128.118:443", "188.44.20.25:443", "119.193.124.41:7080", "70.36.102.35:443", "45.142.114.231:8080", "46.55.222.11:443", "82.165.152.127:8080", "212.237.17.99:8080", "92.240.254.110:8080", "217.182.25.250:8080", "189.126.111.200:7080", "212.24.98.99:8080", "45.176.232.124:443", "192.99.251.50:443", "216.158.226.206:443", "206.188.212.92:8080", "176.104.106.96:8080", "159.65.88.10:8080", "138.185.72.26:8080", "203.114.109.124:443", "103.75.201.2:443", "1.234.21.73:7080", "209.126.98.206:8080", "50.30.40.196:8080", "209.250.246.206:443", "178.79.147.66:8080", "50.116.54.215:443", "185.8.212.130:7080", "31.24.158.56:8080", "146.59.226.45:443", "72.15.201.15:8080", "110.232.117.186:8080", "5.9.116.246:8080", "185.157.82.211:8080", "129.232.188.93:443", "158.69.222.101:443", "164.68.99.3:8080", "45.118.135.203:7080", "101.50.0.91:8080", "195.154.133.20:443", "196.218.30.83:443", "45.118.115.99:8080", "167.99.115.35:8080", "79.172.212.216:8080", "159.8.59.82:8080"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.440856153.00000000049E1000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000002.00000002.440856153.00000000049E1000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000003.00000002.438019180.00000000049F1000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000003.00000002.438019180.00000000049F1000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000002.00000002.440822056.00000000049B0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000002.00000002.440822056.00000000049B0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000004.00000002.438281451.0000000004290000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000004.00000002.438281451.0000000004290000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000005.00000002.954167693.0000000004C70000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000005.00000002.954167693.0000000004C70000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000004.00000002.438313364.00000000042C1000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000004.00000002.438313364.00000000042C1000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000005.00000002.954213063.0000000004D71000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000005.00000002.954213063.0000000004D71000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000003.00000002.437810837.0000000003110000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000003.00000002.437810837.0000000003110000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
Click to see the 11 entries

Unpacked PEs

Source	Rule	Description	Author
2.2.regsvr32.exe.49b0000.0.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
2.2.regsvr32.exe.49b0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.rundll32.exe.4290000.0.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
4.2.rundll32.exe.4290000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
5.2.regsvr32.exe.4c70000.0.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
5.2.regsvr32.exe.4c70000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
5.2.regsvr32.exe.4c70000.0.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
5.2.regsvr32.exe.4c70000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
3.2.rundll32.exe.3110000.0.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
3.2.rundll32.exe.3110000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.rundll32.exe.42c0000.1.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
4.2.rundll32.exe.42c0000.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
3.2.rundll32.exe.3110000.0.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
3.2.rundll32.exe.3110000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
2.2.regsvr32.exe.49e0000.1.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
2.2.regsvr32.exe.49e0000.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
2.2.regsvr32.exe.49b0000.0.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
2.2.regsvr32.exe.49b0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
5.2.regsvr32.exe.4d70000.1.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
5.2.regsvr32.exe.4d70000.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
3.2.rundll32.exe.49f0000.1.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
3.2.rundll32.exe.49f0000.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.rundll32.exe.4290000.0.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
4.2.rundll32.exe.4290000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
Click to see the 19 entries

Snort Signatures

ET CNC Feodo Tracker Reported CnC Server TCP group 3 - Source IP: 192.168.2.5 - Destination IP: 119.193.124.41

Timestamp:	192.168.2.5119.193.124.414982270802404304 07/20/22-01:07:10.809694
SID:	2404304
Source Port:	49822
Destination Port:	7080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET CNC Feodo Tracker Reported CnC Server TCP group 20 - Source IP: 192.168.2.5 - Destination IP: 51.91.76.89

Timestamp:	192.168.2.551.91.76.894981180802404338 07/20/22-01:07:08.508000
SID:	2404338
Source Port:	49811
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 9818t9ks1s.dll

Virustotal: Detection: 69%

Perma Link

Antivirus / Scanner detection for submitted sample

Source: 9818t9ks1s.dll

Avira: detected

Antivirus detection for URL or domain

Source: https://70.36.102.35/v	Avira URL Cloud: Label: malware
Source: https://70.36.102.35/gVsYreJaRCTZGAqrRgMzhhpqBeNQdF	Avira URL Cloud: Label: malware
Source: https://70.36.102.35/	Avira URL Cloud: Label: malware
Source: https://70.36.102.35/gVsYreJaRCTZGAqrRgMzhhpqBeNQdT	Avira URL Cloud: Label: malware
Source: https://70.36.102.35/gVsYreJaRCTZGAqrRgMzhhpqBeNQd	Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Source: https://70.36.102.35/

Virustotal: Detection: 13%

Perma Link

Machine Learning detection for sample

Source: 9818t9ks1s.dll

Joe Sandbox ML: detected

Source: 00000005.00000002.953841049.00000000032E6000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: Emotet {"C2 list": ["51.91.7.5:8080", "197.242.150.244:8080", "1.234.2.232:8080", "173.212.193.249:8080", "51.91.76.89:8080", "151.106.112.196:8080", "107.182.225.142:8080", "103.43.46.182:443", "195.201.151.129:8080", "51.254.140.238:7080", "153.126.146.25:7080", "176.56.128.118:443", "188.44.20.25:443", "119.193.124.41:7080", "70.36.102.35:443", "45.142.114.231:8080", "46.55.222.11:443", "82.165.152.127:8080", "212.237.17.99:8080", "92.240.254.110:8080", "217.182.25.250:8080", "189.126.111.200:7080", "212.24.98.99:8080", "45.176.232.124:443", "192.99.251.50:443", "216.158.226.206:443", "206.188.212.92:8080", "176.104.106.96:8080", "159.65.88.10:8080", "138.185.72.26:8080", "203.114.109.124:443", "103.75.201.2:443", "1.234.21.73:7080", "209.126.98.206:8080", "50.30.40.196:8080", "209.250.246.206:443", "178.79.147.66:8080", "50.116.54.215:443", "185.8.212.130:7080", "31.24.158.56:8080", "146.59.226.45:443", "72.15.201.15:8080", "110.232.117.186:8080", "5.9.116.246:8080", "185.157.82.211:8080", "129.232.188.93:443", "158.69.222.101:443", "164.68.99.3:8080", "45.118.135.203:7080", "101.50.0.91:8080", "195.154.133.20:443", "196.218.30.83:443", "45.118.115.99:8080", "167.99.115.35:8080", "79.172.212.216:8080", "159.8.59.82:8080"]}

Source: 9818t9ks1s.dll

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_1002592C __EH_prolog,GetFullPathNameA,lstrcpynA,PathIsUNCA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrlenA,lstrcpyA,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1002592C __EH_prolog,GetFullPathNameA,lstrcpynA,PathIsUNCA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrlenA,lstrcpyA,

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\regsvr32.exe	Network Connect: 217.182.25.250 8080
Source: C:\Windows\SysWOW64\regsvr32.exe	Network Connect: 70.36.102.35 443
Source: C:\Windows\SysWOW64\regsvr32.exe	Network Connect: 51.91.76.89 8080
Source: C:\Windows\SysWOW64\regsvr32.exe	Network Connect: 119.193.124.41 7080
Source: C:\Windows\SysWOW64\regsvr32.exe	Network Connect: 92.240.254.110 8080

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2404338 ET CNC Feodo Tracker Reported CnC Server TCP group 20 192.168.2.5:49811 -> 51.91.76.89:8080
Source: Traffic	Snort IDS: 2404304 ET CNC Feodo Tracker Reported CnC Server TCP group 3 192.168.2.5:49822 -> 119.193.124.41:7080

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	IPs: 51.91.7.5:8080
Source: Malware configuration extractor	IPs: 197.242.150.244:8080
Source: Malware configuration extractor	IPs: 1.234.2.232:8080
Source: Malware configuration extractor	IPs: 173.212.193.249:8080
Source: Malware configuration extractor	IPs: 51.91.76.89:8080
Source: Malware configuration extractor	IPs: 151.106.112.196:8080
Source: Malware configuration extractor	IPs: 107.182.225.142:8080
Source: Malware configuration extractor	IPs: 103.43.46.182:443
Source: Malware configuration extractor	IPs: 195.201.151.129:8080
Source: Malware configuration extractor	IPs: 51.254.140.238:7080
Source: Malware configuration extractor	IPs: 153.126.146.25:7080
Source: Malware configuration extractor	IPs: 176.56.128.118:443
Source: Malware configuration extractor	IPs: 188.44.20.25:443
Source: Malware configuration extractor	IPs: 119.193.124.41:7080
Source: Malware configuration extractor	IPs: 70.36.102.35:443
Source: Malware configuration extractor	IPs: 45.142.114.231:8080
Source: Malware configuration extractor	IPs: 46.55.222.11:443
Source: Malware configuration extractor	IPs: 82.165.152.127:8080
Source: Malware configuration extractor	IPs: 212.237.17.99:8080
Source: Malware configuration extractor	IPs: 92.240.254.110:8080
Source: Malware configuration extractor	IPs: 217.182.25.250:8080
Source: Malware configuration extractor	IPs: 189.126.111.200:7080
Source: Malware configuration extractor	IPs: 212.24.98.99:8080
Source: Malware configuration extractor	IPs: 45.176.232.124:443
Source: Malware configuration extractor	IPs: 192.99.251.50:443
Source: Malware configuration extractor	IPs: 216.158.226.206:443
Source: Malware configuration extractor	IPs: 206.188.212.92:8080
Source: Malware configuration extractor	IPs: 176.104.106.96:8080
Source: Malware configuration extractor	IPs: 159.65.88.10:8080
Source: Malware configuration extractor	IPs: 138.185.72.26:8080
Source: Malware configuration extractor	IPs: 203.114.109.124:443
Source: Malware configuration extractor	IPs: 103.75.201.2:443
Source: Malware configuration extractor	IPs: 1.234.21.73:7080
Source: Malware configuration extractor	IPs: 209.126.98.206:8080
Source: Malware configuration extractor	IPs: 50.30.40.196:8080
Source: Malware configuration extractor	IPs: 209.250.246.206:443
Source: Malware configuration extractor	IPs: 178.79.147.66:8080
Source: Malware configuration extractor	IPs: 50.116.54.215:443
Source: Malware configuration extractor	IPs: 185.8.212.130:7080
Source: Malware configuration extractor	IPs: 31.24.158.56:8080
Source: Malware configuration extractor	IPs: 146.59.226.45:443
Source: Malware configuration extractor	IPs: 72.15.201.15:8080
Source: Malware configuration extractor	IPs: 110.232.117.186:8080
Source: Malware configuration extractor	IPs: 5.9.116.246:8080
Source: Malware configuration extractor	IPs: 185.157.82.211:8080
Source: Malware configuration extractor	IPs: 129.232.188.93:443
Source: Malware configuration extractor	IPs: 158.69.222.101:443
Source: Malware configuration extractor	IPs: 164.68.99.3:8080
Source: Malware configuration extractor	IPs: 45.118.135.203:7080
Source: Malware configuration extractor	IPs: 101.50.0.91:8080
Source: Malware configuration extractor	IPs: 195.154.133.20:443
Source: Malware configuration extractor	IPs: 196.218.30.83:443
Source: Malware configuration extractor	IPs: 45.118.115.99:8080
Source: Malware configuration extractor	IPs: 167.99.115.35:8080
Source: Malware configuration extractor	IPs: 79.172.212.216:8080
Source: Malware configuration extractor	IPs: 159.8.59.82:8080

Source: Joe Sandbox View	ASN Name: OVHFR OVHFR
Source: Joe Sandbox View	ASN Name: PLUSSERVER-ASN1DE PLUSSERVER-ASN1DE

Source: Joe Sandbox View

IP Address: 217.182.25.250 217.182.25.250

Source: global traffic	TCP traffic: 192.168.2.5:49770 -> 92.240.254.110:8080
Source: global traffic	TCP traffic: 192.168.2.5:49811 -> 51.91.76.89:8080
Source: global traffic	TCP traffic: 192.168.2.5:49817 -> 217.182.25.250:8080
Source: global traffic	TCP traffic: 192.168.2.5:49822 -> 119.193.124.41:7080

Source: unknown

Network traffic detected: IP country count 28

Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767

Source: unknown	TCP traffic detected without corresponding DNS query: 70.36.102.35
Source: unknown	TCP traffic detected without corresponding DNS query: 70.36.102.35
Source: unknown	TCP traffic detected without corresponding DNS query: 70.36.102.35
Source: unknown	TCP traffic detected without corresponding DNS query: 70.36.102.35
Source: unknown	TCP traffic detected without corresponding DNS query: 70.36.102.35
Source: unknown	TCP traffic detected without corresponding DNS query: 70.36.102.35
Source: unknown	TCP traffic detected without corresponding DNS query: 70.36.102.35
Source: unknown	TCP traffic detected without corresponding DNS query: 70.36.102.35
Source: unknown	TCP traffic detected without corresponding DNS query: 70.36.102.35
Source: unknown	TCP traffic detected without corresponding DNS query: 70.36.102.35
Source: unknown	TCP traffic detected without corresponding DNS query: 92.240.254.110
Source: unknown	TCP traffic detected without corresponding DNS query: 92.240.254.110
Source: unknown	TCP traffic detected without corresponding DNS query: 92.240.254.110
Source: unknown	TCP traffic detected without corresponding DNS query: 51.91.76.89
Source: unknown	TCP traffic detected without corresponding DNS query: 51.91.76.89
Source: unknown	TCP traffic detected without corresponding DNS query: 51.91.76.89
Source: unknown	TCP traffic detected without corresponding DNS query: 217.182.25.250
Source: unknown	TCP traffic detected without corresponding DNS query: 217.182.25.250
Source: unknown	TCP traffic detected without corresponding DNS query: 217.182.25.250
Source: unknown	TCP traffic detected without corresponding DNS query: 119.193.124.41
Source: unknown	TCP traffic detected without corresponding DNS query: 119.193.124.41
Source: unknown	TCP traffic detected without corresponding DNS query: 119.193.124.41
Source: unknown	TCP traffic detected without corresponding DNS query: 119.193.124.41
Source: unknown	TCP traffic detected without corresponding DNS query: 119.193.124.41
Source: unknown	TCP traffic detected without corresponding DNS query: 119.193.124.41
Source: unknown	TCP traffic detected without corresponding DNS query: 119.193.124.41
Source: unknown	TCP traffic detected without corresponding DNS query: 119.193.124.41
Source: unknown	TCP traffic detected without corresponding DNS query: 119.193.124.41
Source: unknown	TCP traffic detected without corresponding DNS query: 119.193.124.41
Source: unknown	TCP traffic detected without corresponding DNS query: 119.193.124.41

Source: svchost.exe, 00000018.00000003.636242685.000002554B96E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.636284410.000002554B96E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.636264427.000002554B96E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.636298329.000002554B96E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.636333190.000002554B96E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.636344572.000002554B96E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.636370804.000002554B96E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.636357149.000002554B96E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.636166889.000002554B96E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.636188041.000002554B96E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.636224370.000002554B96E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.636314319.000002554B96E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG", equals www.facebook.com (Facebook)
Source: svchost.exe, 00000018.00000003.636242685.000002554B96E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.636284410.000002554B96E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.636264427.000002554B96E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.636298329.000002554B96E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.636333190.000002554B96E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.636344572.000002554B96E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.636370804.000002554B96E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.636357149.000002554B96E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.636166889.000002554B96E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.636188041.000002554B96E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.636224370.000002554B96E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.636314319.000002554B96E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG", equals www.twitter.com (Twitter)
Source: svchost.exe, 00000018.00000003.636242685.000002554B96E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.636284410.000002554B96E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.636264427.000002554B96E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.636298329.000002554B96E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.636333190.000002554B96E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.636344572.000002554B96E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.636370804.000002554B96E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.636357149.000002554B96E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.636166889.000002554B96E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.636188041.000002554B96E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.637100433.000002554B971000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.636016846.000002554B981000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.636224370.000002554B96E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.636314319.000002554B96E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2022-07-11T16:37:37.4991749Z\|\|.\|\|58dfb4d5-be7e-424e-8739-cac99224843f\|\|1152921505695035586\|\|Null\|\|fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailab
Source: svchost.exe, 00000018.00000003.636242685.000002554B96E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.636284410.000002554B96E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.636264427.000002554B96E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.636298329.000002554B96E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.636333190.000002554B96E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.636344572.000002554B96E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.636370804.000002554B96E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.636357149.000002554B96E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.636166889.000002554B96E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.636188041.000002554B96E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.637100433.000002554B971000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.636016846.000002554B981000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.636224370.000002554B96E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.636314319.000002554B96E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2022-07-11T16:37:37.4991749Z\|\|.\|\|58dfb4d5-be7e-424e-8739-cac99224843f\|\|1152921505695035586\|\|Null\|\|fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailab

Source: regsvr32.exe, 00000005.00000003.538445333.0000000003352000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000005.00000002.954006400.0000000003352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.836929466.0000019586090000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000002.684487522.000002554B900000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: svchost.exe, 0000000D.00000002.836929466.0000019586090000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000002.684378033.000002554AEEB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: regsvr32.exe, 00000005.00000003.538445333.0000000003352000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000005.00000002.954006400.0000000003352000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabQ
Source: regsvr32.exe, 00000005.00000003.538445333.0000000003352000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000005.00000002.954006400.0000000003352000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en6
Source: svchost.exe, 00000018.00000003.654122875.000002554B9B3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.654040928.000002554B991000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.654068801.000002554B9A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://help.disneyplus.com.
Source: svchost.exe, 0000000D.00000002.836571481.00000195808AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.dmtf.o
Source: svchost.exe, 0000000D.00000002.836571481.00000195808AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/
Source: svchost.exe, 0000000D.00000002.836571481.00000195808AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/enumeratio
Source: regsvr32.exe, 00000005.00000003.526452741.000000000331E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://70.36.102.35/
Source: regsvr32.exe, 00000005.00000003.481253554.000000000331E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://70.36.102.35/gVsYreJaRCTZGAqrRgMzhhpqBeNQd
Source: regsvr32.exe, 00000005.00000003.481253554.000000000331E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000005.00000003.526452741.000000000331E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://70.36.102.35/gVsYreJaRCTZGAqrRgMzhhpqBeNQdF
Source: regsvr32.exe, 00000005.00000003.481253554.000000000331E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000005.00000003.526452741.000000000331E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://70.36.102.35/gVsYreJaRCTZGAqrRgMzhhpqBeNQdT
Source: regsvr32.exe, 00000005.00000003.481253554.000000000331E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000005.00000003.526452741.000000000331E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://70.36.102.35/v
Source: regsvr32.exe, 00000005.00000003.526452741.000000000331E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://92.240.254.110/
Source: regsvr32.exe, 00000005.00000003.526452741.000000000331E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://92.240.254.110/6.102.35/gVsYreJaRCTZGAqrRgMzhhpqBeNQd
Source: regsvr32.exe, 00000005.00000002.953979215.0000000003347000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000005.00000003.538622366.0000000003347000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://92.240.254.110:8080/gECMlLDhVoiKFtzKjjRUPjlZHZhhxfpHLqiKeXIlMdFcRqaPxeg
Source: svchost.exe, 00000018.00000003.654122875.000002554B9B3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.654040928.000002554B991000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.654068801.000002554B9A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://disneyplus.com/legal.
Source: svchost.exe, 00000018.00000003.650938728.000002554BE1A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.650909580.000002554B9B1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.651038741.000002554B98F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.650818268.000002554B98F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.650841411.000002554B9A0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.651011860.000002554BE02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.650968671.000002554BE1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.hotspotshield.com/
Source: svchost.exe, 00000018.00000003.654122875.000002554B9B3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.654040928.000002554B991000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.654068801.000002554B9A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.disneyplus.com/legal/privacy-policy
Source: svchost.exe, 00000018.00000003.654122875.000002554B9B3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.654040928.000002554B991000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.654068801.000002554B9A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.disneyplus.com/legal/your-california-privacy-rights
Source: svchost.exe, 00000018.00000003.650938728.000002554BE1A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.650909580.000002554B9B1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.651038741.000002554B98F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.650818268.000002554B98F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.650841411.000002554B9A0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.651011860.000002554BE02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.650968671.000002554BE1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.hotspotshield.com/terms/
Source: svchost.exe, 00000018.00000003.650938728.000002554BE1A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.650909580.000002554B9B1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.651038741.000002554B98F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.650818268.000002554B98F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.650841411.000002554B9A0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.651011860.000002554BE02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.650968671.000002554BE1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.pango.co/privacy
Source: svchost.exe, 00000018.00000003.659846928.000002554B991000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.659413155.000002554BE18000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.659476166.000002554B9A6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.659437692.000002554BE02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.659235634.000002554B9A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.tiktok.com/legal/report/feedback

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_10032A2D GetKeyState,GetKeyState,GetKeyState,GetFocus,GetDesktopWindow,SendMessageA,SendMessageA,GetParent,
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_1003437E GetKeyState,GetKeyState,GetKeyState,
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_1002FE1B ScreenToClient,GetKeyState,GetKeyState,GetKeyState,KillTimer,IsWindow,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1003437E GetKeyState,GetKeyState,GetKeyState,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1001D99B __EH_prolog,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetParent,SendMessageA,ScreenToClient,GetCursorPos,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SetWindowPos,SendMessageA,SendMessageA,GetParent,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10032A2D GetKeyState,GetKeyState,GetKeyState,GetFocus,GetDesktopWindow,SendMessageA,SendMessageA,GetParent,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1002FE1B ScreenToClient,GetKeyState,GetKeyState,GetKeyState,KillTimer,IsWindow,

E-Banking Fraud

Yara detected Emotet

Source: Yara match	File source: 2.2.regsvr32.exe.49b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.4290000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.regsvr32.exe.4c70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.regsvr32.exe.4c70000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.3110000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.42c0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.3110000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.regsvr32.exe.49e0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.regsvr32.exe.49b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.regsvr32.exe.4d70000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.49f0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.4290000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.440856153.00000000049E1000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.438019180.00000000049F1000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.440822056.00000000049B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.438281451.0000000004290000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.954167693.0000000004C70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.438313364.00000000042C1000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.954213063.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.437810837.0000000003110000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: 9818t9ks1s.dll

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL

Source: C:\Windows\SysWOW64\regsvr32.exe

File deleted: C:\Windows\SysWOW64\Bvqee\qeggfkimakwygr.che:Zone.Identifier

Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe

File created: C:\Windows\SysWOW64\Bvqee\

Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_1001409B
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_10023973
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_1000DB7F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1001409B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10023973
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10010A0C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1000DB7F

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: String function: 10011BF0 appears 53 times
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: String function: 10012514 appears 39 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 10011BF0 appears 118 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 10012514 appears 47 times

Source: 9818t9ks1s.dll	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 9818t9ks1s.dll	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 9818t9ks1s.dll	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 9818t9ks1s.dll	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll

Source: 9818t9ks1s.dll

Virustotal: Detection: 69%

Source: 9818t9ks1s.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\9818t9ks1s.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\9818t9ks1s.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\9818t9ks1s.dll
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\9818t9ks1s.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\9818t9ks1s.dll,DllRegisterServer
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Bvqee\qeggfkimakwygr.che"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\9818t9ks1s.dll,DllUnregisterServerr
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\9818t9ks1s.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\9818t9ks1s.dll
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\9818t9ks1s.dll,DllRegisterServer
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\9818t9ks1s.dll,DllUnregisterServerr
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\9818t9ks1s.dll",#1
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Bvqee\qeggfkimakwygr.che"

Source: C:\Windows\SysWOW64\regsvr32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D105A4D4-344C-48EB-9866-EE378D90658B}\InProcServer32

Source: classification engine

Classification label: mal100.troj.evad.winDLL@19/5@0/58

Source: C:\Windows\SysWOW64\regsvr32.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\9818t9ks1s.dll",#1

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 2_2_10006120 FindResourceW,LoadResource,SizeofResource,VirtualAllocExNuma,VirtualAlloc,memcpy,malloc,??3@YAXPAX@Z,

Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: 9818t9ks1s.dll	Static PE information: section name: RT_CURSOR
Source: 9818t9ks1s.dll	Static PE information: section name: RT_BITMAP
Source: 9818t9ks1s.dll	Static PE information: section name: RT_ICON
Source: 9818t9ks1s.dll	Static PE information: section name: RT_MENU
Source: 9818t9ks1s.dll	Static PE information: section name: RT_DIALOG
Source: 9818t9ks1s.dll	Static PE information: section name: RT_STRING
Source: 9818t9ks1s.dll	Static PE information: section name: RT_ACCELERATOR
Source: 9818t9ks1s.dll	Static PE information: section name: RT_GROUP_ICON

Source: 9818t9ks1s.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 9818t9ks1s.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 9818t9ks1s.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 9818t9ks1s.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 9818t9ks1s.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_10010B20 push eax; ret
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_10010B20 push eax; ret
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_10011BF0 push eax; ret
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_1001254F push ecx; ret
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1001254F push ecx; ret
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10010B20 push eax; ret
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10010B20 push eax; ret
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10011BF0 push eax; ret

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 2_2_10025CEC __EH_prolog,LoadLibraryA,GetProcAddress,

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\9818t9ks1s.dll

Source: C:\Windows\SysWOW64\regsvr32.exe

PE file moved: C:\Windows\SysWOW64\Bvqee\qeggfkimakwygr.che

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\SysWOW64\regsvr32.exe	File opened: C:\Windows\SysWOW64\Bvqee\qeggfkimakwygr.che:Zone.Identifier read attributes \| delete
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Windows\SysWOW64\Urxuhfwuvdoqo\fwicd.dee:Zone.Identifier read attributes \| delete
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Windows\SysWOW64\Fwtalcmqgixd\btngtvbvsro.wfo:Zone.Identifier read attributes \| delete

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_10007AE5 IsIconic,GetWindowPlacement,GetWindowRect,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10007AE5 IsIconic,GetWindowPlacement,GetWindowRect,

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\svchost.exe TID: 6164	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 6524	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 6228	Thread sleep time: -120000s >= -30000s

Source: C:\Windows\SysWOW64\regsvr32.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Windows\SysWOW64\regsvr32.exe	API coverage: 2.8 %
Source: C:\Windows\SysWOW64\rundll32.exe	API coverage: 2.6 %

Source: C:\Windows\SysWOW64\regsvr32.exe

Process information queried: ProcessInformation

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 2_2_10010839 VirtualQuery,GetSystemInfo,VirtualQuery,VirtualAlloc,VirtualProtect,

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_1002592C __EH_prolog,GetFullPathNameA,lstrcpynA,PathIsUNCA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrlenA,lstrcpyA,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1002592C __EH_prolog,GetFullPathNameA,lstrcpynA,PathIsUNCA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrlenA,lstrcpyA,

Source: C:\Windows\SysWOW64\regsvr32.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node

Source: C:\Windows\SysWOW64\regsvr32.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	File Volume queried: C:\ FullSizeInformation

Source: svchost.exe, 00000018.00000002.684176363.000002554AE70000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: regsvr32.exe, 00000005.00000003.526469173.0000000003338000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000005.00000003.481292465.0000000003338000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000005.00000003.538611722.0000000003338000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000005.00000002.953956932.0000000003338000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.836818432.000001958604C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.836852130.0000019586062000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000002.684378033.000002554AEEB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 0000000D.00000002.836363112.000001958082A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@P
Source: svchost.exe, 0000000E.00000002.953778088.000002243AA02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcDsSvcfhsvcWPDBusEnumsvsvcwlansvcEmbeddedModeirmonSensorServicevmicvssNgcSvcsysmainDevQueryBrokerStorSvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionNcbServiceNetmanDeviceAssociationServiceTabletInputServicePcaSvcIPxlatCfgSvcCscServiceUmRdpService
Source: svchost.exe, 0000000E.00000002.953865417.000002243AA28000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: regsvr32.exe, 00000005.00000003.526469173.0000000003338000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000005.00000003.481292465.0000000003338000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000005.00000003.538611722.0000000003338000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000005.00000002.953956932.0000000003338000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWd

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 2_2_10025CEC __EH_prolog,LoadLibraryA,GetProcAddress,

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 2_2_10005260 GetNativeSystemInfo,GetProcessHeap,HeapAlloc,memcpy,

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\System32\loaddll32.exe

Process queried: DebugPort

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10016DD6 SetUnhandledExceptionFilter,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10016DEA SetUnhandledExceptionFilter,

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\regsvr32.exe	Network Connect: 217.182.25.250 8080
Source: C:\Windows\SysWOW64\regsvr32.exe	Network Connect: 70.36.102.35 443
Source: C:\Windows\SysWOW64\regsvr32.exe	Network Connect: 51.91.76.89 8080
Source: C:\Windows\SysWOW64\regsvr32.exe	Network Connect: 119.193.124.41 7080
Source: C:\Windows\SysWOW64\regsvr32.exe	Network Connect: 92.240.254.110 8080

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\9818t9ks1s.dll",#1

Source: C:\Windows\SysWOW64\regsvr32.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\regsvr32.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: GetThreadLocale,GetLocaleInfoA,GetACP,
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: lstrcpyA,LoadLibraryA,GetLocaleInfoA,
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: GetLocaleInfoA,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetThreadLocale,GetLocaleInfoA,GetACP,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoA,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: lstrcpyA,LoadLibraryA,GetLocaleInfoA,

Source: C:\Windows\SysWOW64\regsvr32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 2_2_10011075 GetSystemTimeAsFileTime,__aulldiv,

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 2_2_10018E14 __lock,_strlen,_strncpy,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,_strncpy,

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 2_2_10001100 GetVersionExA,InterlockedExchange,

Stealing of Sensitive Information

Yara detected Emotet

Source: Yara match	File source: 2.2.regsvr32.exe.49b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.4290000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.regsvr32.exe.4c70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.regsvr32.exe.4c70000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.3110000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.42c0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.3110000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.regsvr32.exe.49e0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.regsvr32.exe.49b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.regsvr32.exe.4d70000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.49f0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.4290000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.440856153.00000000049E1000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.438019180.00000000049F1000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.440822056.00000000049B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.438281451.0000000004290000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.954167693.0000000004C70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.438313364.00000000042C1000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.954213063.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.437810837.0000000003110000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	2 Native API	1 DLL Side-Loading	111 Process Injection	2 Masquerading	1 Input Capture	2 System Time Discovery	Remote Services	1 Input Capture	Exfiltration Over Other Network Medium	12 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	3 Virtualization/Sandbox Evasion	LSASS Memory	31 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	111 Process Injection	Security Account Manager	3 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	11 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Deobfuscate/Decode Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Hidden Files and Directories	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	2 Obfuscated Files or Information	Cached Domain Credentials	1 Remote System Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Regsvr32	DCSync	2 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 Rundll32	Proc Filesystem	36 System Information Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	1 DLL Side-Loading	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	1 File Deletion	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
9818t9ks1s.dll	70%	Virustotal		Browse
9818t9ks1s.dll	100%	Avira	TR/AD.Nekark.bnwrm
9818t9ks1s.dll	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
2.2.regsvr32.exe.49b0000.0.unpack	100%	Avira	HEUR/AGEN.1215461	Download File
4.2.rundll32.exe.4290000.0.unpack	100%	Avira	HEUR/AGEN.1215461	Download File
5.2.regsvr32.exe.4c70000.0.unpack	100%	Avira	HEUR/AGEN.1215461	Download File
5.2.regsvr32.exe.4d70000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
2.2.regsvr32.exe.49e0000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
4.2.rundll32.exe.42c0000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
3.2.rundll32.exe.49f0000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
3.2.rundll32.exe.3110000.0.unpack	100%	Avira	HEUR/AGEN.1215461	Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
https://www.disneyplus.com/legal/your-california-privacy-rights	0%	URL Reputation	safe
https://70.36.102.35/v	100%	Avira URL Cloud	malware
https://www.disneyplus.com/legal/privacy-policy	0%	URL Reputation	safe
https://70.36.102.35/gVsYreJaRCTZGAqrRgMzhhpqBeNQdF	100%	Avira URL Cloud	malware
https://70.36.102.35/	14%	Virustotal		Browse
https://70.36.102.35/	100%	Avira URL Cloud	malware
https://www.pango.co/privacy	0%	URL Reputation	safe
https://disneyplus.com/legal.	0%	URL Reputation	safe
http://crl.ver)	0%	Avira URL Cloud	safe
https://www.tiktok.com/legal/report/feedback	0%	URL Reputation	safe
https://70.36.102.35/gVsYreJaRCTZGAqrRgMzhhpqBeNQdT	100%	Avira URL Cloud	malware
http://schemas.dmtf.o	0%	Avira URL Cloud	safe
https://92.240.254.110:8080/gECMlLDhVoiKFtzKjjRUPjlZHZhhxfpHLqiKeXIlMdFcRqaPxeg	0%	Avira URL Cloud	safe
https://92.240.254.110/6.102.35/gVsYreJaRCTZGAqrRgMzhhpqBeNQd	0%	Avira URL Cloud	safe
https://92.240.254.110/	0%	Avira URL Cloud	safe
http://help.disneyplus.com.	0%	URL Reputation	safe
https://70.36.102.35/gVsYreJaRCTZGAqrRgMzhhpqBeNQd	100%	Avira URL Cloud	malware

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/ws/2004/	svchost.exe, 0000000D.00000002.836571481.00000195808AF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.disneyplus.com/legal/your-california-privacy-rights	svchost.exe, 00000018.00000003.654122875.000002554B9B3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.654040928.000002554B991000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.654068801.000002554B9A2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://70.36.102.35/v	regsvr32.exe, 00000005.00000003.481253554.000000000331E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000005.00000003.526452741.000000000331E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://www.disneyplus.com/legal/privacy-policy	svchost.exe, 00000018.00000003.654122875.000002554B9B3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.654040928.000002554B991000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.654068801.000002554B9A2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://70.36.102.35/gVsYreJaRCTZGAqrRgMzhhpqBeNQdF	regsvr32.exe, 00000005.00000003.481253554.000000000331E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000005.00000003.526452741.000000000331E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://70.36.102.35/	regsvr32.exe, 00000005.00000003.526452741.000000000331E000.00000004.00000020.00020000.00000000.sdmp	true	14%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://www.hotspotshield.com/terms/	svchost.exe, 00000018.00000003.650938728.000002554BE1A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.650909580.000002554B9B1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.651038741.000002554B98F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.650818268.000002554B98F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.650841411.000002554B9A0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.651011860.000002554BE02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.650968671.000002554BE1A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.pango.co/privacy	svchost.exe, 00000018.00000003.650938728.000002554BE1A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.650909580.000002554B9B1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.651038741.000002554B98F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.650818268.000002554B98F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.650841411.000002554B9A0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.651011860.000002554BE02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.650968671.000002554BE1A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://disneyplus.com/legal.	svchost.exe, 00000018.00000003.654122875.000002554B9B3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.654040928.000002554B991000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.654068801.000002554B9A2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.ver)	svchost.exe, 0000000D.00000002.836929466.0000019586090000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000002.684378033.000002554AEEB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://www.tiktok.com/legal/report/feedback	svchost.exe, 00000018.00000003.659846928.000002554B991000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.659413155.000002554BE18000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.659476166.000002554B9A6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.659437692.000002554BE02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.659235634.000002554B9A6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://70.36.102.35/gVsYreJaRCTZGAqrRgMzhhpqBeNQdT	regsvr32.exe, 00000005.00000003.481253554.000000000331E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000005.00000003.526452741.000000000331E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://schemas.dmtf.o	svchost.exe, 0000000D.00000002.836571481.00000195808AF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://92.240.254.110:8080/gECMlLDhVoiKFtzKjjRUPjlZHZhhxfpHLqiKeXIlMdFcRqaPxeg	regsvr32.exe, 00000005.00000002.953979215.0000000003347000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000005.00000003.538622366.0000000003347000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://92.240.254.110/6.102.35/gVsYreJaRCTZGAqrRgMzhhpqBeNQd	regsvr32.exe, 00000005.00000003.526452741.000000000331E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://92.240.254.110/	regsvr32.exe, 00000005.00000003.526452741.000000000331E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://help.disneyplus.com.	svchost.exe, 00000018.00000003.654122875.000002554B9B3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.654040928.000002554B991000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.654068801.000002554B9A2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/09/enumeratio	svchost.exe, 0000000D.00000002.836571481.00000195808AF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.hotspotshield.com/	svchost.exe, 00000018.00000003.650938728.000002554BE1A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.650909580.000002554B9B1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.651038741.000002554B98F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.650818268.000002554B98F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.650841411.000002554B9A0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.651011860.000002554BE02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.650968671.000002554BE1A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://70.36.102.35/gVsYreJaRCTZGAqrRgMzhhpqBeNQd	regsvr32.exe, 00000005.00000003.481253554.000000000331E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
217.182.25.250	unknown	France	16276	OVHFR	true
151.106.112.196	unknown	Germany	61157	PLUSSERVER-ASN1DE	true
79.172.212.216	unknown	Hungary	61998	SZERVERPLEXHU	true
110.232.117.186	unknown	Australia	56038	RACKCORP-APRackCorpAU	true
51.254.140.238	unknown	France	16276	OVHFR	true
195.201.151.129	unknown	Germany	24940	HETZNER-ASDE	true
206.188.212.92	unknown	United States	55002	DEFENSE-NETUS	true
45.118.115.99	unknown	Indonesia	131717	IDNIC-CIFO-AS-IDPTCitraJelajahInformatikaID	true
209.126.98.206	unknown	United States	30083	AS-30083-GO-DADDY-COM-LLCUS	true
1.234.21.73	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	true
176.56.128.118	unknown	Switzerland	12637	SEEWEBWebhostingcolocationandcloudservicesIT	true
45.118.135.203	unknown	Japan	63949	LINODE-APLinodeLLCUS	true
167.99.115.35	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
185.8.212.130	unknown	Uzbekistan	48979	UZINFOCOMUZ	true
197.242.150.244	unknown	South Africa	37611	AfrihostZA	true
51.91.76.89	unknown	France	16276	OVHFR	true
45.176.232.124	unknown	Colombia	267869	CABLEYTELECOMUNICACIONESDECOLOMBIASASCABLETELCOC	true
178.79.147.66	unknown	United Kingdom	63949	LINODE-APLinodeLLCUS	true
31.24.158.56	unknown	Spain	50926	INFORTELECOM-ASES	true
50.30.40.196	unknown	United States	30083	AS-30083-GO-DADDY-COM-LLCUS	true
164.68.99.3	unknown	Germany	51167	CONTABODE	true
189.126.111.200	unknown	Brazil	27715	LocawebServicosdeInternetSABR	true
146.59.226.45	unknown	Norway	16276	OVHFR	true
158.69.222.101	unknown	Canada	16276	OVHFR	true
196.218.30.83	unknown	Egypt	8452	TE-ASTE-ASEG	true
159.65.88.10	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
101.50.0.91	unknown	Indonesia	55688	BEON-AS-IDPTBeonIntermediaID	true
195.154.133.20	unknown	France	12876	OnlineSASFR	true
185.157.82.211	unknown	Poland	42927	S-NET-ASPL	true
70.36.102.35	unknown	United States	22439	PERFECT-INTERNATIONALUS	true
103.43.46.182	unknown	Indonesia	58397	INFINYS-AS-IDPTInfinysSystemIndonesiaID	true
212.237.17.99	unknown	Italy	31034	ARUBA-ASNIT	true
212.24.98.99	unknown	Lithuania	62282	RACKRAYUABRakrejusLT	true
138.185.72.26	unknown	Brazil	264343	EmpasoftLtdaMeBR	true
216.158.226.206	unknown	United States	19318	IS-AS-1US	true
103.75.201.2	unknown	Thailand	133496	CDNPLUSCOLTD-AS-APCDNPLUSCOLTDTH	true
51.91.7.5	unknown	France	16276	OVHFR	true
5.9.116.246	unknown	Germany	24940	HETZNER-ASDE	true
188.44.20.25	unknown	Macedonia	57374	GIV-ASMK	true
153.126.146.25	unknown	Japan	7684	SAKURA-ASAKURAInternetIncJP	true
72.15.201.15	unknown	United States	13649	ASN-VINSUS	true
209.250.246.206	unknown	European Union	20473	AS-CHOOPAUS	true
82.165.152.127	unknown	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	true
107.182.225.142	unknown	United States	32780	HOSTINGSERVICES-INCUS	true
50.116.54.215	unknown	United States	63949	LINODE-APLinodeLLCUS	true
46.55.222.11	unknown	Bulgaria	34841	BALCHIKNETBG	true
173.212.193.249	unknown	Germany	51167	CONTABODE	true
176.104.106.96	unknown	Serbia	198371	NINETRS	true
192.99.251.50	unknown	Canada	16276	OVHFR	true
45.142.114.231	unknown	Germany	44066	DE-FIRSTCOLOwwwfirst-colonetDE	true
1.234.2.232	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	true
203.114.109.124	unknown	Thailand	131293	TOT-LLI-AS-APTOTPublicCompanyLimitedTH	true
119.193.124.41	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	true
129.232.188.93	unknown	South Africa	37153	xneeloZA	true
159.8.59.82	unknown	United States	36351	SOFTLAYERUS	true
92.240.254.110	unknown	Slovakia (SLOVAK Republic)	42005	LIGHTSTORM-COMMUNICATIONS-SRO-SK-ASPeeringsSK	true

Private

IP
192.168.2.1
127.0.0.1

General Information

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	669370
Start date and time: 20/07/202201:05:10	2022-07-20 01:05:10 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 12m 23s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	9818t9ks1s (renamed file extension from none to dll)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winDLL@19/5@0/58
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 99.8% (good quality ratio 97.2%) Quality average: 84.5% Quality standard deviation: 23.7%
HCA Information:	Successful, ratio: 94% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI Override analysis time to 240s for rundll32

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, wuapihost.exe
Excluded IPs from analysis (whitelisted): 20.106.86.13, 23.205.181.161, 13.71.55.58, 23.211.4.86, 20.223.24.244
Excluded domains from analysis (whitelisted): fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, e11290.dspg.akamaiedge.net, go.microsoft.com, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, login.live.com, settings-prod-cin-2.centralindia.cloudapp.azure.com, sls.update.microsoft.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, www.bing.com, client.wns.windows.com, fs.microsoft.com, settings-prod-wus3-1.westus3.cloudapp.azure.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ctldl.windowsupdate.com, settings-win.data.microsoft.com, e1723.g.akamaiedge.net, atm-settingsfe-prod-weighted.trafficmanager.net, ris.api.iris.microsoft.com, licensing.mp.microsoft.com, store-images.s-microsoft.com, go.microsoft.com.edgekey.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
01:06:51	API Interceptor	11x Sleep call for process: svchost.exe modified

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.3593198815979092
Encrypted:	false
SSDEEP:	12:SnaaD0JcaaD0JwQQU2naaD0JcaaD0JwQQU:4tgJctgJw/tgJctgJw
MD5:	BF1DC7D5D8DAD7478F426DF8B3F8BAA6
SHA1:	C6B0BDE788F553F865D65F773D8F6A3546887E42
SHA-256:	BE47C764C38CA7A90A345BE183F5261E89B98743B5E35989E9A8BE0DA498C0F2
SHA-512:	00F2412AA04E09EA19A8315D80BE66D2727C713FC0F5AE6A9334BABA539817F568A98CA3A45B2673282BDD325B8B0E2840A393A4DCFADCB16473F5EAF2AF3180
Malicious:	false
Preview:	.......................3...w..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@...................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	MPEG-4 LOAS
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.24943716309551126
Encrypted:	false
SSDEEP:	1536:BJiRdfVzkZm3lyf49uyc0ga04PdHS9LrM/oVMUdSRU49:BJiRdwfu2SRU49
MD5:	00654427E58616B58C62FC50C2B52CAE
SHA1:	FAE33CDA4A87AE87F8C54F629D947A73C0F3D752
SHA-256:	03367E7F1FBA65E7384C510DBEF162E503A7499F98E712C23D2A4990677EBACD
SHA-512:	50B9C51F0154E0AC12BFE61392E0295E5B70A93338AE526C115E018FE46A93596226C4B2A0BD74C2B254883E93F1CC2A7BFF900D505722DC7CB765E1B5EF9A2D
Malicious:	false
Preview:	V.d.........@..@.3...w...........................3...w..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.........................................d#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x31ef495f, page size 16384, Windows version 10.0
Category:	dropped
Size (bytes):	786432
Entropy (8bit):	0.25054036977537886
Encrypted:	false
SSDEEP:	384:7jM+W0StseCJ48EApW0StseCJ48E2rTSjlK/ebmLerYSRSY1J2:7jTSB2nSB2RSjlK/+mLesOj1J2
MD5:	F449C6D8DF10E7E1F61BDD97A6494F87
SHA1:	CE664D962FF28C7AD92580FEAB4E450998815495
SHA-256:	5928D3F1531BDD70D74FF76EEF2344721E7398CC22D3F203F09CBEDD149DE78A
SHA-512:	5B77117B0644DAB36AC90631921320E6B5978D08E4D7B852E212F6E89335E7021068E8570BF8E777941328E3B4E1511AF61F99DD07D633BB8195149C484955B9
Malicious:	false
Preview:	1.I_... ................e.f.3...w........................)..........z..3....z9.h.(..........z....)..............3...w...........................................................................................................B...........@...................................................................................................... ....................................................................................................................................................................................................................................................(.0.....z...........................z..........................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07303587911152667
Encrypted:	false
SSDEEP:	3:R4HR7vWMoximlll/tksjibD1tHlllall3Vkttlmlnl:grW/iWMwibD1tfA3
MD5:	F2E666170C5999D5002A645DC8634D6E
SHA1:	20FFA1FAF1479110694542B7972C3F5155A9BED6
SHA-256:	57FB4BC8D3FFC4201342D81B07349EA6BC5728AFB0C4213E52AC91FB781D2E1E
SHA-512:	331576024162E4BBD3517803D81CEC60A8A12D1DED59E31B50FCA8DCC2D0721EE075955591EF0116383F3188729105F45E65CE4F376610963ECDA11978181B6B
Malicious:	false
Preview:	=........................................3...w..3....z9......z...............z.......z..yM.I.....z}i.........................z..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.352826845434315
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 98.32% Windows Screen Saver (13104/52) 1.29% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	9818t9ks1s.dll
File size:	655360
MD5:	83418a9af56db91ff2c78c4b2b9d62f8
SHA1:	0ea68aab3721e509ce0b1bff7e574eda037798be
SHA256:	4a688f571024b08f9793559427d8692471f5aa715882899c631c3052eac7c6a1
SHA512:	dadfeea6c52deda79860158036b60c54e907483b3f317e270d44e5949db169f4a26e748956654d914a3c9dda52c264e2c79bc0073254d9e58c62d9b5e69205a2
SSDEEP:	6144:/6ZMFXzqfoSHr/mvcQYbi2HN8C8BgifO7y7TcuVqrWLWN7Ypsi6Ih9vH0/oUHahE:/8MFX47ivcQMNsrD4KJjO69cI
TLSH:	06D47C0EFFD1C1B2D36B123019D5C64823ADBF2CEAA1C5B777A8BE1D69326C14512B16
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......)..0m..cm..cm..c...cg..c...ck..c~..co..c...c\|..cm..c@..ch..cq..ch..c...cF..cd..ch..c...ch..cl..c...cl..ch..cl..cRichm..c.......

File Icon


Icon Hash:	c0cc4c687ccccc78

Static PE Info

General

Entrypoint:	0x1001131c
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL
DLL Characteristics:
Time Stamp:	0x623CFB7E [Thu Mar 24 23:15:10 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	d63ab94f4bb6b5d2f0f6092bf07e00ac

Entrypoint Preview

Instruction
push 0000000Ch
push 10041D40h
call 00007FB05074AA61h
xor eax, eax
inc eax
mov dword ptr [ebp-1Ch], eax
mov esi, dword ptr [ebp+0Ch]
xor edi, edi
cmp esi, edi
jne 00007FB05074987Eh
cmp dword ptr [1004F3C8h], edi
je 00007FB050749929h
mov dword ptr [ebp-04h], edi
cmp esi, eax
je 00007FB050749877h
cmp esi, 02h
jne 00007FB0507498A3h
mov eax, dword ptr [10050CB4h]
cmp eax, edi
je 00007FB05074987Eh
push dword ptr [ebp+10h]
push esi
push dword ptr [ebp+08h]
call eax
mov dword ptr [ebp-1Ch], eax
cmp dword ptr [ebp-1Ch], edi
je 00007FB0507498FBh
push dword ptr [ebp+10h]
push esi
push dword ptr [ebp+08h]
call 00007FB050749697h
mov dword ptr [ebp-1Ch], eax
cmp eax, edi
je 00007FB0507498E4h
mov ebx, dword ptr [ebp+10h]
push ebx
push esi
push dword ptr [ebp+08h]
call 00007FB05073E608h
mov dword ptr [ebp-1Ch], eax
cmp esi, 01h
jne 00007FB050749880h
cmp eax, edi
jne 00007FB05074987Ch
push ebx
push edi
push dword ptr [ebp+08h]
call 00007FB05074966Dh
cmp esi, edi
je 00007FB050749877h
cmp esi, 03h
jne 00007FB05074989Bh
push ebx
push esi
push dword ptr [ebp+08h]
call 00007FB05074965Ah
test eax, eax
jne 00007FB050749875h
mov dword ptr [ebp-1Ch], edi
cmp dword ptr [ebp-1Ch], edi
je 00007FB050749885h
mov eax, dword ptr [10050CB4h]
cmp eax, edi
je 00007FB05074987Ch
push ebx
push esi
push dword ptr [ebp+08h]
call eax
mov dword ptr [ebp-1Ch], eax
or dword ptr [ebp-04h], FFFFFFFFh
mov eax, dword ptr [ebp-1Ch]
jmp 00007FB05074988Ch
mov eax, dword ptr [ebp-14h]
mov ecx, dword ptr [eax]

Rich Headers

Programming Language:

[ASM] VS2003 (.NET) build 3077
[ C ] VS2003 (.NET) build 3077
[C++] VS2003 (.NET) build 3077
[EXP] VS2003 (.NET) build 3077
[RES] VS2003 (.NET) build 3077
[LNK] VS2003 (.NET) build 3077

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x4aa40	0x6e	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x48844	0x104	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x51000	0x480a0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x9a000	0x4e40	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x43830	0x48	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x3c000	0x668	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x487bc	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x3a49e	0x3b000	False	0.6009418034957628	data	6.6116392367886405	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x3c000	0xeaae	0xf000	False	0.32220052083333334	data	5.046533656475497	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x4b000	0x5cb8	0x3000	False	0.2513834635416667	data	3.8346109495878085	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x51000	0x480a0	0x49000	False	0.5524534460616438	data	6.0777904674160155	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x9a000	0x8810	0x9000	False	0.3506673177083333	data	4.48951519417909	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
	0x747c0	0x20800	data
RT_CURSOR	0x95028	0x134	data
RT_CURSOR	0x95160	0xb4	data
RT_CURSOR	0x95240	0x134	AmigaOS bitmap font
RT_CURSOR	0x95390	0x134	data
RT_CURSOR	0x954e0	0x134	data
RT_CURSOR	0x95630	0x134	data
RT_CURSOR	0x95780	0x134	data
RT_CURSOR	0x958d0	0x134	data
RT_CURSOR	0x95a20	0x134	data
RT_CURSOR	0x95b70	0x134	data
RT_CURSOR	0x95cc0	0x134	data
RT_CURSOR	0x95e10	0x134	data
RT_CURSOR	0x95f60	0x134	AmigaOS bitmap font
RT_CURSOR	0x960b0	0x134	data
RT_CURSOR	0x96200	0x134	data
RT_CURSOR	0x96350	0x134	data
RT_BITMAP	0x522e0	0x428	data
RT_BITMAP	0x520c0	0xe0	GLS_BINARY_LSB_FIRST	Spanish	Mexico
RT_BITMAP	0x965a0	0xb8	data
RT_BITMAP	0x96658	0x144	data
RT_ICON	0x52a98	0x10828	dBase III DBT, version number 0, next free block index 40
RT_ICON	0x632d8	0x10828	dBase III DBT, version number 0, next free block index 40
RT_ICON	0x73b18	0x2e8	data
RT_ICON	0x73e00	0x128	GLS_BINARY_LSB_FIRST
RT_ICON	0x73f50	0x2e8	data
RT_ICON	0x74238	0x128	GLS_BINARY_LSB_FIRST
RT_ICON	0x74388	0x2e8	data
RT_ICON	0x74670	0x128	GLS_BINARY_LSB_FIRST
RT_MENU	0x52728	0x23a	data
RT_MENU	0x521b0	0x46	data	Spanish	Mexico
RT_DIALOG	0x52968	0x12c	data
RT_DIALOG	0x521f8	0xe2	data	Spanish	Mexico
RT_DIALOG	0x964a0	0xfe	data
RT_STRING	0x96810	0x92	data
RT_STRING	0x967a0	0x6a	data	Spanish	Mexico
RT_STRING	0x968a8	0x48	data
RT_STRING	0x96938	0x19e	data
RT_STRING	0x96c08	0x280	data
RT_STRING	0x97010	0x39c	data
RT_STRING	0x96f90	0x7a	data
RT_STRING	0x96ad8	0x12e	data
RT_STRING	0x96e88	0x104	data
RT_STRING	0x968f0	0x46	data
RT_STRING	0x973b0	0x128	data
RT_STRING	0x974d8	0x240	data
RT_STRING	0x97718	0x9e	data
RT_STRING	0x977b8	0xb0	Hitachi SH big-endian COFF object file, not stripped, 16640 sections, symbol offset=0x69007200, 201344768 symbols, optional header size 29952
RT_STRING	0x97868	0x30	data
RT_STRING	0x97898	0x1d0	data
RT_STRING	0x97a68	0x5bc	data
RT_STRING	0x98418	0x31c	data
RT_STRING	0x98118	0x300	data
RT_STRING	0x98fa0	0xb0	data
RT_STRING	0x98028	0xee	data
RT_STRING	0x98e50	0x11e	data
RT_STRING	0x98738	0x4d0	data
RT_STRING	0x98c08	0x248	data
RT_STRING	0x98f70	0x2e	data
RT_STRING	0x99050	0x4c	data
RT_ACCELERATOR	0x94fc0	0x68	data
RT_GROUP_CURSOR	0x95218	0x22	Lotus unknown worksheet or configuration, revision 0x2
RT_GROUP_CURSOR	0x95a08	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0x95378	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0x958b8	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0x95768	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0x96098	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0x95618	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0x95ca8	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0x954c8	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0x95b58	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0x95df8	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0x95f48	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0x961e8	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0x96338	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0x96488	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_ICON	0x632c0	0x14	data
RT_GROUP_ICON	0x73f28	0x22	data
RT_GROUP_ICON	0x73b00	0x14	data
RT_GROUP_ICON	0x74360	0x22	data
RT_GROUP_ICON	0x74798	0x22	data
None	0x52708	0x1e	data
None	0x521a0	0xa	data	Spanish	Mexico

Imports

DLL	Import
KERNEL32.dll	RtlUnwind, GetSystemTimeAsFileTime, GetCommandLineA, TerminateProcess, HeapReAlloc, HeapSize, HeapDestroy, HeapCreate, VirtualFree, IsBadWritePtr, SetHandleCount, GetStdHandle, GetFileType, GetStartupInfoA, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, VirtualQuery, QueryPerformanceCounter, GetCurrentProcessId, SetUnhandledExceptionFilter, LCMapStringA, LCMapStringW, GetStringTypeA, GetStringTypeW, GetTimeZoneInformation, IsBadReadPtr, IsBadCodePtr, SetStdHandle, SetEnvironmentVariableA, GetSystemInfo, VirtualAlloc, VirtualProtect, HeapFree, HeapAlloc, GetTickCount, SystemTimeToFileTime, LocalFileTimeToFileTime, FileTimeToLocalFileTime, FileTimeToSystemTime, GetOEMCP, GetCPInfo, GetShortPathNameA, CreateFileA, GetVolumeInformationA, FindFirstFileA, FindClose, GetCurrentProcess, DuplicateHandle, GetFileSize, SetEndOfFile, UnlockFile, LockFile, FlushFileBuffers, SetFilePointer, WriteFile, ReadFile, DeleteFileA, MoveFileA, GetCurrentDirectoryA, GlobalFlags, TlsFree, LocalReAlloc, TlsSetValue, TlsAlloc, TlsGetValue, EnterCriticalSection, GlobalHandle, GlobalReAlloc, LeaveCriticalSection, LocalAlloc, InterlockedIncrement, InterlockedDecrement, DeleteCriticalSection, InitializeCriticalSection, RaiseException, GetDiskFreeSpaceA, GetFullPathNameA, GetTempFileNameA, GetFileTime, SetFileTime, GetFileAttributesA, GlobalGetAtomNameA, GlobalFindAtomA, lstrcatA, lstrcmpW, GetPrivateProfileStringA, WritePrivateProfileStringA, GetPrivateProfileIntA, CloseHandle, GlobalAddAtomA, GetCurrentThread, GetCurrentThreadId, FreeLibrary, GlobalDeleteAtom, lstrcmpA, GetModuleFileNameA, GetModuleHandleA, GetProcAddress, ConvertDefaultLocale, EnumResourceLanguagesA, lstrcpyA, LoadLibraryA, FreeResource, SetLastError, GlobalFree, FindResourceA, LoadResource, LockResource, SizeofResource, MulDiv, GlobalAlloc, GlobalLock, GlobalUnlock, FormatMessageA, lstrcpynA, LocalFree, ExitProcess, GetStringTypeExA, CompareStringW, CompareStringA, lstrlenA, lstrcmpiA, GetVersion, GetLastError, WideCharToMultiByte, MultiByteToWideChar, GetVersionExA, GetThreadLocale, GetLocaleInfoA, GetACP, UnhandledExceptionFilter, InterlockedExchange
USER32.dll	KillTimer, WindowFromPoint, GetDCEx, LockWindowUpdate, RegisterClipboardFormatA, PostThreadMessageA, SetRect, CharNextA, DestroyIcon, EndPaint, BeginPaint, GetWindowDC, ClientToScreen, GrayStringA, DrawTextExA, DrawTextA, TabbedTextOutA, FillRect, LoadCursorA, GetSysColorBrush, SetParent, GetSystemMenu, DeleteMenu, IsRectEmpty, IsZoomed, GetDC, ReleaseDC, LoadMenuA, DestroyMenu, UnpackDDElParam, ReuseDDElParam, ReleaseCapture, LoadAcceleratorsA, InsertMenuItemA, CreatePopupMenu, SetRectEmpty, BringWindowToTop, SetMenu, TranslateAcceleratorA, InvalidateRect, RegisterWindowMessageA, WinHelpA, GetCapture, CreateWindowExA, GetClassLongA, GetClassNameA, SetPropA, GetPropA, RemovePropA, IsChild, GetForegroundWindow, BeginDeferWindowPos, EndDeferWindowPos, GetTopWindow, UnhookWindowsHookEx, GetMessageTime, GetMessagePos, LoadIconA, MapWindowPoints, TrackPopupMenu, SetForegroundWindow, SetTimer, GetClientRect, GetMenu, GetSysColor, AdjustWindowRectEx, ScreenToClient, EqualRect, DeferWindowPos, GetClassInfoA, RegisterClassA, UnregisterClassA, DefWindowProcA, CallWindowProcA, OffsetRect, IntersectRect, SystemParametersInfoA, IsIconic, GetWindowPlacement, GetWindowRect, CopyRect, PtInRect, GetWindow, SetWindowContextHelpId, MapDialogRect, wsprintfA, GetWindowTextLengthA, GetWindowTextA, SetWindowPos, CharUpperA, UpdateWindow, EnableWindow, SendMessageA, GetClassInfoExA, GetSubMenu, GetMenuItemCount, InsertMenuA, GetMenuItemID, AppendMenuA, SetFocus, ShowWindow, MoveWindow, SetWindowLongA, GetDlgCtrlID, SetWindowTextA, IsDialogMessageA, SendDlgItemMessageA, GetMenuItemInfoA, InflateRect, SetMenuItemBitmaps, GetFocus, ModifyMenuA, EnableMenuItem, CheckMenuItem, GetMenuCheckMarkDimensions, LoadBitmapA, SetWindowsHookExA, CallNextHookEx, GetMessageA, TranslateMessage, MessageBeep, GetNextDlgGroupItem, SetCapture, InvalidateRgn, CopyAcceleratorTableA, GetMenuStringA, GetMenuState, EndDialog, GetNextDlgTabItem, GetParent, IsWindowEnabled, GetDlgItem, GetWindowLongA, IsWindow, DestroyWindow, CreateDialogIndirectParamA, GetSystemMetrics, SetActiveWindow, GetActiveWindow, GetDesktopWindow, PostQuitMessage, PostMessageA, SetCursor, ShowOwnedPopups, GetLastActivePopup, MessageBoxA, ValidateRect, GetCursorPos, PeekMessageA, GetKeyState, IsWindowVisible, DispatchMessageA
GDI32.dll	CreateSolidBrush, CreateFontIndirectA, GetBkColor, GetTextColor, GetStockObject, GetRgnBox, PatBlt, SetRectRgn, CombineRgn, GetMapMode, CreatePatternBrush, ExtSelectClipRgn, ScaleWindowExtEx, SetWindowExtEx, ScaleViewportExtEx, SetViewportExtEx, OffsetViewportOrgEx, SetViewportOrgEx, Escape, ExtTextOutA, TextOutA, RectVisible, PtVisible, GetPixel, BitBlt, GetWindowExtEx, CreateRectRgnIndirect, GetDeviceCaps, CreateRectRgn, SelectClipRgn, IntersectClipRect, ExcludeClipRect, SetMapMode, SetBkMode, RestoreDC, SaveDC, GetTextExtentPoint32A, GetTextMetricsA, CreateFontA, GetCharWidthA, DeleteObject, SelectObject, StretchDIBits, DeleteDC, CreateCompatibleDC, CreateCompatibleBitmap, GetObjectA, SetBkColor, SetTextColor, GetClipBox, CreateBitmap, GetViewportExtEx
comdlg32.dll	GetSaveFileNameA, GetFileTitleA, GetOpenFileNameA
WINSPOOL.DRV	OpenPrinterA, DocumentPropertiesA, ClosePrinter
ADVAPI32.dll	GetFileSecurityA, RegSetValueA, RegOpenKeyA, RegQueryValueExA, RegOpenKeyExA, RegDeleteKeyA, RegEnumKeyA, RegQueryValueA, RegCreateKeyExA, RegSetValueExA, RegDeleteValueA, RegCreateKeyA, RegCloseKey, SetFileSecurityA
SHELL32.dll	DragQueryFileA, ExtractIconA, SHGetFileInfoA, DragFinish
COMCTL32.dll	ImageList_Draw, ImageList_GetImageInfo, ImageList_Destroy
SHLWAPI.dll	PathFindFileNameA, PathStripToRootA, PathFindExtensionA, PathIsUNCA
oledlg.dll
ole32.dll	CreateILockBytesOnHGlobal, StgCreateDocfileOnILockBytes, StgOpenStorageOnILockBytes, CoGetClassObject, CLSIDFromString, CLSIDFromProgID, CoTaskMemFree, OleUninitialize, CoFreeUnusedLibraries, CoRegisterMessageFilter, OleFlushClipboard, OleIsCurrentClipboard, CoRevokeClassObject, CoTaskMemAlloc, OleInitialize
OLEAUT32.dll	SysAllocStringLen, VariantClear, VariantChangeType, VariantInit, SysStringLen, SysAllocStringByteLen, OleCreateFontIndirect, SystemTimeToVariantTime, SafeArrayDestroy, SysAllocString, VariantCopy, SysFreeString

Exports

Name	Ordinal	Address
DllRegisterServer	1	0x10005090
DllUnregisterServerr	2	0x100050c0

Possible Origin

Language of compilation system	Country where language is spoken	Map
Spanish	Mexico

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.5119.193.124.414982270802404304 07/20/22-01:07:10.809694	TCP	2404304	ET CNC Feodo Tracker Reported CnC Server TCP group 3	49822	7080	192.168.2.5	119.193.124.41
192.168.2.551.91.76.894981180802404338 07/20/22-01:07:08.508000	TCP	2404338	ET CNC Feodo Tracker Reported CnC Server TCP group 20	49811	8080	192.168.2.5	51.91.76.89

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 20, 2022 01:06:46.936866999 CEST	49767	443	192.168.2.5	70.36.102.35
Jul 20, 2022 01:06:46.936918020 CEST	443	49767	70.36.102.35	192.168.2.5
Jul 20, 2022 01:06:46.937026024 CEST	49767	443	192.168.2.5	70.36.102.35
Jul 20, 2022 01:06:46.988656998 CEST	49767	443	192.168.2.5	70.36.102.35
Jul 20, 2022 01:06:46.988699913 CEST	443	49767	70.36.102.35	192.168.2.5
Jul 20, 2022 01:06:47.166369915 CEST	443	49767	70.36.102.35	192.168.2.5
Jul 20, 2022 01:06:47.175667048 CEST	49768	443	192.168.2.5	70.36.102.35
Jul 20, 2022 01:06:47.175726891 CEST	443	49768	70.36.102.35	192.168.2.5
Jul 20, 2022 01:06:47.175817966 CEST	49768	443	192.168.2.5	70.36.102.35
Jul 20, 2022 01:06:47.176795959 CEST	49768	443	192.168.2.5	70.36.102.35
Jul 20, 2022 01:06:47.176825047 CEST	443	49768	70.36.102.35	192.168.2.5
Jul 20, 2022 01:06:47.348900080 CEST	443	49768	70.36.102.35	192.168.2.5
Jul 20, 2022 01:06:47.356182098 CEST	49769	443	192.168.2.5	70.36.102.35
Jul 20, 2022 01:06:47.356241941 CEST	443	49769	70.36.102.35	192.168.2.5
Jul 20, 2022 01:06:47.356360912 CEST	49769	443	192.168.2.5	70.36.102.35
Jul 20, 2022 01:06:47.356899023 CEST	49769	443	192.168.2.5	70.36.102.35
Jul 20, 2022 01:06:47.356967926 CEST	443	49769	70.36.102.35	192.168.2.5
Jul 20, 2022 01:06:47.357043982 CEST	49769	443	192.168.2.5	70.36.102.35
Jul 20, 2022 01:06:47.450864077 CEST	49770	8080	192.168.2.5	92.240.254.110
Jul 20, 2022 01:06:50.456844091 CEST	49770	8080	192.168.2.5	92.240.254.110
Jul 20, 2022 01:06:56.457360983 CEST	49770	8080	192.168.2.5	92.240.254.110
Jul 20, 2022 01:07:08.507999897 CEST	49811	8080	192.168.2.5	51.91.76.89
Jul 20, 2022 01:07:08.528073072 CEST	8080	49811	51.91.76.89	192.168.2.5
Jul 20, 2022 01:07:09.036581039 CEST	49811	8080	192.168.2.5	51.91.76.89
Jul 20, 2022 01:07:09.056623936 CEST	8080	49811	51.91.76.89	192.168.2.5
Jul 20, 2022 01:07:09.567893982 CEST	49811	8080	192.168.2.5	51.91.76.89
Jul 20, 2022 01:07:09.589181900 CEST	8080	49811	51.91.76.89	192.168.2.5
Jul 20, 2022 01:07:09.615654945 CEST	49817	8080	192.168.2.5	217.182.25.250
Jul 20, 2022 01:07:09.643641949 CEST	8080	49817	217.182.25.250	192.168.2.5
Jul 20, 2022 01:07:10.146051884 CEST	49817	8080	192.168.2.5	217.182.25.250
Jul 20, 2022 01:07:10.174648046 CEST	8080	49817	217.182.25.250	192.168.2.5
Jul 20, 2022 01:07:10.771107912 CEST	49817	8080	192.168.2.5	217.182.25.250
Jul 20, 2022 01:07:10.799603939 CEST	8080	49817	217.182.25.250	192.168.2.5
Jul 20, 2022 01:07:10.809694052 CEST	49822	7080	192.168.2.5	119.193.124.41
Jul 20, 2022 01:07:11.079042912 CEST	7080	49822	119.193.124.41	192.168.2.5
Jul 20, 2022 01:07:11.079195976 CEST	49822	7080	192.168.2.5	119.193.124.41
Jul 20, 2022 01:07:11.082602024 CEST	49822	7080	192.168.2.5	119.193.124.41
Jul 20, 2022 01:07:11.353307962 CEST	7080	49822	119.193.124.41	192.168.2.5
Jul 20, 2022 01:07:11.369446039 CEST	7080	49822	119.193.124.41	192.168.2.5
Jul 20, 2022 01:07:11.369509935 CEST	7080	49822	119.193.124.41	192.168.2.5
Jul 20, 2022 01:07:11.369604111 CEST	49822	7080	192.168.2.5	119.193.124.41
Jul 20, 2022 01:07:12.626746893 CEST	49822	7080	192.168.2.5	119.193.124.41
Jul 20, 2022 01:07:12.898112059 CEST	7080	49822	119.193.124.41	192.168.2.5
Jul 20, 2022 01:07:12.898277998 CEST	49822	7080	192.168.2.5	119.193.124.41
Jul 20, 2022 01:07:12.903048992 CEST	49822	7080	192.168.2.5	119.193.124.41
Jul 20, 2022 01:07:13.218106985 CEST	7080	49822	119.193.124.41	192.168.2.5
Jul 20, 2022 01:07:14.065052986 CEST	7080	49822	119.193.124.41	192.168.2.5
Jul 20, 2022 01:07:14.065643072 CEST	49822	7080	192.168.2.5	119.193.124.41
Jul 20, 2022 01:07:17.064517021 CEST	7080	49822	119.193.124.41	192.168.2.5
Jul 20, 2022 01:07:17.064565897 CEST	7080	49822	119.193.124.41	192.168.2.5
Jul 20, 2022 01:07:17.064661980 CEST	49822	7080	192.168.2.5	119.193.124.41
Jul 20, 2022 01:08:36.268321991 CEST	49822	7080	192.168.2.5	119.193.124.41
Jul 20, 2022 01:08:36.268376112 CEST	49822	7080	192.168.2.5	119.193.124.41

Target ID:	0
Start time:	01:06:21
Start date:	20/07/2022
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\9818t9ks1s.dll"
Imagebase:	0xff0000
File size:	116736 bytes
MD5 hash:	7DEB5DB86C0AC789123DEC286286B938
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: cmd.exePID: 6896, Parent PID: 6888

General

Target ID:	1
Start time:	01:06:22
Start date:	20/07/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\9818t9ks1s.dll",#1
Imagebase:	0x1100000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: regsvr32.exePID: 6912, Parent PID: 6888

General

Target ID:	2
Start time:	01:06:22
Start date:	20/07/2022
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	regsvr32.exe /s C:\Users\user\Desktop\9818t9ks1s.dll
Imagebase:	0x8f0000
File size:	20992 bytes
MD5 hash:	426E7499F6A7346F0410DEAD0805586B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000002.00000002.440856153.00000000049E1000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000002.00000002.440856153.00000000049E1000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000002.00000002.440822056.00000000049B0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000002.00000002.440822056.00000000049B0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Analysis Process: rundll32.exePID: 6924, Parent PID: 6896

General

Target ID:	3
Start time:	01:06:22
Start date:	20/07/2022
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\9818t9ks1s.dll",#1
Imagebase:	0xc60000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000003.00000002.438019180.00000000049F1000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000003.00000002.438019180.00000000049F1000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000003.00000002.437810837.0000000003110000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000003.00000002.437810837.0000000003110000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Analysis Process: rundll32.exePID: 6932, Parent PID: 6888

General

Target ID:	4
Start time:	01:06:23
Start date:	20/07/2022
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\9818t9ks1s.dll,DllRegisterServer
Imagebase:	0xc60000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000004.00000002.438281451.0000000004290000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.438281451.0000000004290000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000004.00000002.438313364.00000000042C1000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.438313364.00000000042C1000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Analysis Process: regsvr32.exePID: 7020, Parent PID: 6912

General

Target ID:	5
Start time:	01:06:26
Start date:	20/07/2022
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Bvqee\qeggfkimakwygr.che"
Imagebase:	0x8f0000
File size:	20992 bytes
MD5 hash:	426E7499F6A7346F0410DEAD0805586B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000005.00000002.954167693.0000000004C70000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000005.00000002.954167693.0000000004C70000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000005.00000002.954213063.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000005.00000002.954213063.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Analysis Process: rundll32.exePID: 7040, Parent PID: 6888

General

Target ID:	6
Start time:	01:06:27
Start date:	20/07/2022
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\9818t9ks1s.dll,DllUnregisterServerr
Imagebase:	0xc60000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: svchost.exePID: 5084, Parent PID: 580

General

Target ID:	12
Start time:	01:06:47
Start date:	20/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff78ca80000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: svchost.exePID: 6324, Parent PID: 580

General

Target ID:	13
Start time:	01:06:51
Start date:	20/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff78ca80000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: svchost.exePID: 6576, Parent PID: 580

General

Target ID:	14
Start time:	01:07:04
Start date:	20/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Imagebase:	0x7ff78ca80000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: svchost.exePID: 3952, Parent PID: 580

General

Target ID:	16
Start time:	01:07:10
Start date:	20/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff78ca80000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: svchost.exePID: 7028, Parent PID: 580

General

Target ID:	22
Start time:	01:07:41
Start date:	20/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff78ca80000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: svchost.exePID: 5748, Parent PID: 580

General

Target ID:	24
Start time:	01:07:51
Start date:	20/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff78ca80000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Disassembly

⊘No disassembly

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. Regsvr32.exe is also a Microsoft signed binary.
Tactics:	Defense Evasion
Data Sources:	Loaded DLLs, Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 9818t9ks1s

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Emotet

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.chk

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Windows Analysis Report
9818t9ks1s

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre