Edit tour

Windows Analysis Report
5CUFfVMSaQ

Overview

General Information

Sample Name:	5CUFfVMSaQ (renamed file extension from none to dll)
Analysis ID:	671666
MD5:	5d4728494832d03bbfb75367836fef4e
SHA1:	abcbd283801a05390995862f59dcb5310f3d3d88
SHA256:	caa60b9025dfba07efac6cae5438a8e20d9b7c210a721a4cf1f9d7b6df4d7d90
Tags:	exeOpenCTIBRSandboxed
Infos:

Detection

Emotet

Score:	96
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected Emotet

System process connects to network (likely due to code injection or exploit)

Snort IDS alert for network traffic

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Queries the volume information (name, serial number etc) of a device

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Deletes files inside the Windows folder

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Creates files inside the system directory

PE file contains sections with non-standard names

Internet Provider seen in connection with other malware

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

JA3 SSL client fingerprint seen in connection with other malware

HTTP GET or POST without a user agent

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Program does not show much activity (idle)

IP address seen in connection with other malware

Tries to load missing DLLs

Drops PE files to the windows directory (C:\Windows)

Checks if the current process is being debugged

Connects to several IPs in different countries

Registers a DLL

PE file contains more sections than normal

Queries disk information (often used to detect virtual machines)

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

loaddll64.exe (PID: 7016 cmdline: loaddll64.exe "C:\Users\user\Desktop\5CUFfVMSaQ.dll" MD5: 4E8A40CAD6CCC047914E3A7830A2D8AA)

cmd.exe (PID: 7024 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\5CUFfVMSaQ.dll",#1 MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

rundll32.exe (PID: 7044 cmdline: rundll32.exe "C:\Users\user\Desktop\5CUFfVMSaQ.dll",#1 MD5: 73C519F050C20580F8A62C849D49215A)

regsvr32.exe (PID: 7032 cmdline: regsvr32.exe /s C:\Users\user\Desktop\5CUFfVMSaQ.dll MD5: D78B75FC68247E8A63ACBA846182740E)

regsvr32.exe (PID: 7132 cmdline: C:\Windows\system32\regsvr32.exe "C:\Windows\system32\NCybOKcMqaEIN\jnEWIdoCfnPf.dll" MD5: D78B75FC68247E8A63ACBA846182740E)

rundll32.exe (PID: 7052 cmdline: rundll32.exe C:\Users\user\Desktop\5CUFfVMSaQ.dll,ABeFtrnwmgAedx MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 7108 cmdline: rundll32.exe C:\Users\user\Desktop\5CUFfVMSaQ.dll,AEjATaIExpQg MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 6160 cmdline: rundll32.exe C:\Users\user\Desktop\5CUFfVMSaQ.dll,AbfBlUFQKbpevAFdaCpElBdscB MD5: 73C519F050C20580F8A62C849D49215A)

svchost.exe (PID: 6476 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6448 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 4520 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 5216 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 5092 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

cleanup

Malware Configuration

Threatname: Emotet

{"C2 list": ["108.194.0.0:443", "40.4.0.0:1", "4.4.0.0:1", "8.4.0.0:1", "24.4.0.0:1", "232.3.0.0:1", "20.4.0.0:1", "236.3.0.0:1", "36.4.0.0:1", "139.247.2.0:2096", "160.153.244.0:1", "21.115.0.0:4", "133.247.2.0:4048", "4.1.0.0:92", "224.146.244.0:1", "120.247.2.0:4048", "121.247.2.0:5104", "160.154.244.0:1", "141.247.2.0:5104", "160.147.244.0:1", "143.247.2.0:4544", "160.156.244.0:1", "145.247.2.0:2912", "224.150.244.0:1", "153.247.2.0:1324"]}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
5CUFfVMSaQ.dll	JoeSecurity_Emotet_2	Yara detected Emotet	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.452456296.0000000002841000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000004.00000002.449537237.00000237550F0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000003.00000002.448904188.0000025326DA1000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000002.00000002.452429989.0000000002810000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000006.00000002.964376372.0000000000F3B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Emotet_3		Joe Security
00000006.00000002.964724556.0000000001130000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000004.00000002.449599584.0000023755221000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000003.00000002.448824975.0000025325750000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000006.00000002.965051526.0000000180001000.00000020.00000001.01000000.00000006.sdmp	JoeSecurity_Emotet_2	Yara detected Emotet	Joe Security
00000002.00000002.452552735.0000000180001000.00000020.00000001.01000000.00000006.sdmp	JoeSecurity_Emotet_2	Yara detected Emotet	Joe Security
00000006.00000002.964860380.0000000002911000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author
3.2.rundll32.exe.25325750000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.2.regsvr32.exe.1130000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.rundll32.exe.237550f0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.2.regsvr32.exe.1130000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
2.2.regsvr32.exe.2810000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
3.2.rundll32.exe.25325750000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
2.2.regsvr32.exe.2810000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.rundll32.exe.237550f0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
2.2.regsvr32.exe.180000000.1.unpack	JoeSecurity_Emotet_2	Yara detected Emotet	Joe Security
6.2.regsvr32.exe.180000000.1.unpack	JoeSecurity_Emotet_2	Yara detected Emotet	Joe Security
Click to see the 5 entries

Snort Signatures

ET CNC Feodo Tracker Reported CnC Server TCP group 11 - Source IP: 192.168.2.5 - Destination IP: 188.165.79.151

Timestamp:	192.168.2.5188.165.79.151497724432404320 07/22/22-13:16:45.923727
SID:	2404320
Source Port:	49772
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 5CUFfVMSaQ.dll	Virustotal: Detection: 21%	Perma Link
Source: 5CUFfVMSaQ.dll	Metadefender: Detection: 45%	Perma Link
Source: 5CUFfVMSaQ.dll	ReversingLabs: Detection: 80%

Source: 00000006.00000002.964477134.0000000000F7E000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: Emotet {"C2 list": ["108.194.0.0:443", "40.4.0.0:1", "4.4.0.0:1", "8.4.0.0:1", "24.4.0.0:1", "232.3.0.0:1", "20.4.0.0:1", "236.3.0.0:1", "36.4.0.0:1", "139.247.2.0:2096", "160.153.244.0:1", "21.115.0.0:4", "133.247.2.0:4048", "4.1.0.0:92", "224.146.244.0:1", "120.247.2.0:4048", "121.247.2.0:5104", "160.154.244.0:1", "141.247.2.0:5104", "160.147.244.0:1", "143.247.2.0:4544", "160.156.244.0:1", "145.247.2.0:2912", "224.150.244.0:1", "153.247.2.0:1324"]}

Source: unknown	HTTPS traffic detected: 188.165.79.151:443 -> 192.168.2.5:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.165.79.151:443 -> 192.168.2.5:49772 version: TLS 1.2

Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_00000001800426C8 _invalid_parameter_noinfo,_invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_00000001800436B4 FindFirstFileExW,
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018004383C FindFirstFileExW,FindNextFileW,FindClose,FindClose,
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180043DBC FindFirstFileExW,FindNextFileW,FindClose,FindClose,
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02930A20 FindFirstFileW,FindNextFileW,

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\regsvr32.exe

Network Connect: 188.165.79.151 443

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2404320 ET CNC Feodo Tracker Reported CnC Server TCP group 11 192.168.2.5:49772 -> 188.165.79.151:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	IPs: 108.194.0.0:443
Source: Malware configuration extractor	IPs: 40.4.0.0:1
Source: Malware configuration extractor	IPs: 4.4.0.0:1
Source: Malware configuration extractor	IPs: 8.4.0.0:1
Source: Malware configuration extractor	IPs: 24.4.0.0:1
Source: Malware configuration extractor	IPs: 232.3.0.0:1
Source: Malware configuration extractor	IPs: 20.4.0.0:1
Source: Malware configuration extractor	IPs: 236.3.0.0:1
Source: Malware configuration extractor	IPs: 36.4.0.0:1
Source: Malware configuration extractor	IPs: 139.247.2.0:2096
Source: Malware configuration extractor	IPs: 160.153.244.0:1
Source: Malware configuration extractor	IPs: 21.115.0.0:4
Source: Malware configuration extractor	IPs: 133.247.2.0:4048
Source: Malware configuration extractor	IPs: 4.1.0.0:92
Source: Malware configuration extractor	IPs: 224.146.244.0:1
Source: Malware configuration extractor	IPs: 120.247.2.0:4048
Source: Malware configuration extractor	IPs: 121.247.2.0:5104
Source: Malware configuration extractor	IPs: 160.154.244.0:1
Source: Malware configuration extractor	IPs: 141.247.2.0:5104
Source: Malware configuration extractor	IPs: 160.147.244.0:1
Source: Malware configuration extractor	IPs: 143.247.2.0:4544
Source: Malware configuration extractor	IPs: 160.156.244.0:1
Source: Malware configuration extractor	IPs: 145.247.2.0:2912
Source: Malware configuration extractor	IPs: 224.150.244.0:1
Source: Malware configuration extractor	IPs: 153.247.2.0:1324

Source: Joe Sandbox View	ASN Name: TCISLTataCommunicationsIN TCISLTataCommunicationsIN
Source: Joe Sandbox View	ASN Name: OVHFR OVHFR

Source: Joe Sandbox View

JA3 fingerprint: 51c64c77e60f3980eea90869b68c58a8

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Cookie: kJZtvOKXxX=hTloIDqhoyWpurUw3AxwGwlasyWlepnQrzPzxDdUOeOLyYl1IS66LGJ7p3GRml0qSCniQY8iO9vwBvYi0s9GFTLntOUX1Zv/Yct+Xz8D8ChWhoNEM9sP7kk/vQZZ5Ril8i53FqG17zNu5+qxXeF44TrT5h9rSAkz2z7kX0nZnwYiZveRpVLi2JYEMWQdksTrTzltZQZOrQPQdu4BaI2PwYAAsLHNp24r2uk3knZ1f90JTxLZKGsWTLdTxREVM9QYo5C/g/WNCeWU7ydkurXqgqGDaOFhx/8wopk+lxr0GYWs4XyAPwQ23Q==Host: 188.165.79.151Connection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View

IP Address: 188.165.79.151 188.165.79.151

Source: unknown

Network traffic detected: IP country count 10

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 188.165.79.151
Source: unknown	TCP traffic detected without corresponding DNS query: 188.165.79.151
Source: unknown	TCP traffic detected without corresponding DNS query: 188.165.79.151
Source: unknown	TCP traffic detected without corresponding DNS query: 188.165.79.151
Source: unknown	TCP traffic detected without corresponding DNS query: 188.165.79.151
Source: unknown	TCP traffic detected without corresponding DNS query: 188.165.79.151
Source: unknown	TCP traffic detected without corresponding DNS query: 188.165.79.151
Source: unknown	TCP traffic detected without corresponding DNS query: 188.165.79.151
Source: unknown	TCP traffic detected without corresponding DNS query: 188.165.79.151
Source: unknown	TCP traffic detected without corresponding DNS query: 188.165.79.151

Source: svchost.exe, 00000014.00000003.624845071.0000024E7156E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2022-07-22T07:55:01.8237416Z\|\|.\|\|b7e2ac48-308b-4ab0-ad70-c01dd95863e0\|\|1152921505695074449\|\|Null\|\|fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailab
Source: svchost.exe, 00000014.00000003.624845071.0000024E7156E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2022-07-22T07:55:01.8237416Z\|\|.\|\|b7e2ac48-308b-4ab0-ad70-c01dd95863e0\|\|1152921505695074449\|\|Null\|\|fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailab

Source: regsvr32.exe, 00000006.00000003.502653267.0000000000FB1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.964551145.0000000000FB1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.837320264.000001FFA508B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.668398256.0000024E71500000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.624494400.0000024E71506000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: svchost.exe, 0000000C.00000002.837320264.000001FFA508B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.668398256.0000024E71500000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.624494400.0000024E71506000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000014.00000003.641209465.0000024E715B8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.641248614.0000024E71595000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.641270170.0000024E715A6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.641297731.0000024E715C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://help.disneyplus.com.
Source: regsvr32.exe, 00000006.00000002.964477134.0000000000F7E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.502763451.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.502855478.0000000000F7E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.964412082.0000000000F52000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.502695787.0000000000F52000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.964376372.0000000000F3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://188.165.79.151/
Source: regsvr32.exe, 00000006.00000002.964412082.0000000000F52000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.502695787.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://188.165.79.151/oA~
Source: svchost.exe, 00000014.00000003.641209465.0000024E715B8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.641248614.0000024E71595000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.641270170.0000024E715A6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.641297731.0000024E715C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://disneyplus.com/legal.
Source: svchost.exe, 00000014.00000003.637666200.0000024E71595000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.637519972.0000024E71A02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.637725354.0000024E71A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.637589847.0000024E71A03000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.637475233.0000024E715A7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.637701522.0000024E715B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.637485712.0000024E715B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.hotspotshield.com/
Source: svchost.exe, 00000014.00000003.641297731.0000024E715C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.disneyplus.com/legal/privacy-policy
Source: svchost.exe, 00000014.00000003.641209465.0000024E715B8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.641248614.0000024E71595000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.641270170.0000024E715A6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.641297731.0000024E715C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.disneyplus.com/legal/your-california-privacy-rights
Source: svchost.exe, 00000014.00000003.637666200.0000024E71595000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.637519972.0000024E71A02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.637725354.0000024E71A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.637589847.0000024E71A03000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.637475233.0000024E715A7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.637701522.0000024E715B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.637485712.0000024E715B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.hotspotshield.com/terms/
Source: svchost.exe, 00000014.00000003.637666200.0000024E71595000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.637519972.0000024E71A02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.637725354.0000024E71A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.637589847.0000024E71A03000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.637475233.0000024E715A7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.637701522.0000024E715B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.637485712.0000024E715B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.pango.co/privacy
Source: svchost.exe, 00000014.00000003.647804814.0000024E7158E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.646539654.0000024E71A02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.646486184.0000024E71A18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.tiktok.com/legal/report/feedback

Source: C:\Windows\System32\regsvr32.exe

Code function: 6_2_0292C324 InternetReadFile,

Source: global traffic

Source: unknown	HTTPS traffic detected: 188.165.79.151:443 -> 192.168.2.5:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.165.79.151:443 -> 192.168.2.5:49772 version: TLS 1.2

E-Banking Fraud

Source: Yara match

File source: 00000006.00000002.964376372.0000000000F3B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Yara detected Emotet

Source: Yara match	File source: 3.2.rundll32.exe.25325750000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.regsvr32.exe.1130000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.237550f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.regsvr32.exe.1130000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.regsvr32.exe.2810000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.25325750000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.regsvr32.exe.2810000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.237550f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.452456296.0000000002841000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.449537237.00000237550F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.448904188.0000025326DA1000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.452429989.0000000002810000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.964724556.0000000001130000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.449599584.0000023755221000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.448824975.0000025325750000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.964860380.0000000002911000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 5CUFfVMSaQ.dll, type: SAMPLE
Source: Yara match	File source: 2.2.regsvr32.exe.180000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.regsvr32.exe.180000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.965051526.0000000180001000.00000020.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.452552735.0000000180001000.00000020.00000001.01000000.00000006.sdmp, type: MEMORY

Source: C:\Windows\System32\regsvr32.exe

File deleted: C:\Windows\System32\NCybOKcMqaEIN\jnEWIdoCfnPf.dll:Zone.Identifier

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

File created: C:\Windows\system32\NCybOKcMqaEIN\

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001C00C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001E038
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001E224
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001C23C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001A248
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001A390
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_00000001800143D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001E424
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001C46C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001A4D8
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180056540
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001C574
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180018598
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001A5E4
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001E60C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001C67C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_00000001800126AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_00000001800426C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_00000001800086C4
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001A6EC
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018000A734
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001C784
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_00000001800227D0
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001E7F4
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180016828
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001C88C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_00000001800228DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001A918
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180024934
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018004E9B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_00000001800229E4
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001E9F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180024A40
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180008A50
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001CAB8
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180022AF0
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001EB0C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001AB44
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180024B48
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018000EB58
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180022BF8
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001EC14
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180024C54
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001CCE4
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180022D00
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001ED54
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180024D5C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001AD70
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180022E08
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180044E04
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001EE60
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180024E64
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001AE78
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180022F10
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001CF10
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001EF68
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180024F6C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018000EF80
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001AFA8
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180020FCC
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018004AFD0
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018004CFEC
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001D018
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180013044
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180009070
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180025074
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001B0C4
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001D120
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018002713C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001D23C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018003D290
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001B2B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180027328
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018004B380
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018000D3A0
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001D428
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001B49C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001F4C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_00000001800234CC
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180027514
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180011540
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018002557C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_00000001800235D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018000B5D8
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018003F5E4
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018000F608
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001D614
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018002964C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018003D650
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180025684
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_00000001800436B4
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_00000001800236DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001B6DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180027714
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018002578C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_00000001800237E4
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018004383C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018005784C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001D854
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180025894
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001B8C4
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_00000001800238EC
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_00000001800498EC
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_00000001800278FC
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018004B940
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018000B96C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018002599C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_00000001800199DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_00000001800239F4
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180059A0C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001DA3C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180025AA4
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001BAAC
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018003DAC0
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180027AE4
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180019AE4
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180023AF8
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180031B10
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180045B80
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180025BA8
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180023C00
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001DC24
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180025CB0
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001BCD4
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180019D14
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180015D9C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180043DBC
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001BDDC
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018004BE14
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001DE4C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018001FE64
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180019F44
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018000BF8C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02800000
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_028583D8
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02860358
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02852008
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0285606C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0285061C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02841A84
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0285BA54
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02850B94
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_028629A0
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02844FEC
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02859DE4
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0285A2DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_028492E8
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_028572F8
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02841228
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0285223C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02859270
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0285327C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_028443A0
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0284E3B4
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_028653DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0285C324
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0285F320
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02861320
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02851350
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02845360
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02859084
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_028430B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_028660C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_028650D0
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_028540E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0285D0E8
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02841000
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0285101C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02853044
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02842050
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0285C078
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02864184
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0285C18C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0284B1E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_028551F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_028571F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0284D148
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02858154
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02861150
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0285115C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0284E6B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_028526C4
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_028436D0
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02863604
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02866644
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0285E668
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02857780
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_028597B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0285B7C4
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0285373C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0284175C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0285D484
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02854490
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_028484B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0284A4C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_028614EC
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02856444
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02857468
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_028435B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_028485EC
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0285051C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02862528
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0284E534
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0284F54C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02866A84
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02852AB4
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02863AE8
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02856A00
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02851A08
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02854A38
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0284CA68
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0285ABBC
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02852BF0
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02849BF8
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02842B04
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0284AB08
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02853B28
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02847B30
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02865898
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02843800
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02849814
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0285C810
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0284881C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0285F854
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0286386C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02864980
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_028619AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0285D93C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02849938
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02842EA8
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0285BE10
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0285EE18
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02863E4C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02848E6C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02846F8C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02845FBC
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02863FD8
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02853F18
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02859F24
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02865F48
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0284AF54
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02861F54
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0284CF5C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02856F5C
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02841CAC
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02865C18
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02861C50
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02847C64
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02844D84
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0284DD20
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02854D40
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02856D48
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_02849D50
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000025325740000
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000237550E0000
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_01120000
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02911A84
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0291A4C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02933AE8
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0292061C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02930A20
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0292F854
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0292BA54
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0292606C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02916F8C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02915FBC
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_029283D8
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_029251F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02929DE4
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02914FEC
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0292AD10
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0292C324
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02930358
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02924490
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02935898
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0292D484
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02929084
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02936A84
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02922AB4
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_029130B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_029184B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0291E6B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02912EA8
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02911CAC
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_029136D0
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_029350D0
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0292A2DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_029226C4
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_029360C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_029272F8
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_029240E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_029192E8
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0292D0E8
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_029314EC
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0292C810
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0292BE10
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02919814
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0292EE18
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02935C18
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0291881C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0292101C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02913800
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02911000
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02926A00
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02933604
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02921A08
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02922008
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02924A38
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0292223C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02911228
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02912050
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02931C50
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02923044
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02926444
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02936644
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02933E4C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02929270
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0292C078
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0292327C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02917C64
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0291CA68
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0292E668
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02927468
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02918E6C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0293386C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02920B94
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02927780
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02934980
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02914D84
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02934184
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0292C18C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_029297B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0291E3B4
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_029135B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0292ABBC
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_029143A0
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_029329A0
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_029319AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02933FD8
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_029353DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0292B7C4
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02922BF0
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_029271F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02919BF8
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0291B1E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_029185EC
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02923F18
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0292051C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02912B04
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0291AB08
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02917B30
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0291E534
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02919938
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0292D93C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0292373C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0291DD20
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0292F320
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02931320
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02929F24
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02923B28
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02932528
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02919D50
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02921350
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02931150
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0291AF54
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02928154
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02931F54
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0291175C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0291CF5C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02926F5C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0292115C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02924D40
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0291D148
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02926D48
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02935F48
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0291F54C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02915360

Source: C:\Windows\System32\regsvr32.exe

Code function: String function: 0000000180037D34 appears 44 times

Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll

Source: 5CUFfVMSaQ.dll

Static PE information: Number of sections : 12 > 10

Source: 5CUFfVMSaQ.dll	Virustotal: Detection: 21%
Source: 5CUFfVMSaQ.dll	Metadefender: Detection: 45%
Source: 5CUFfVMSaQ.dll	ReversingLabs: Detection: 80%

Source: 5CUFfVMSaQ.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\5CUFfVMSaQ.dll"
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\5CUFfVMSaQ.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\5CUFfVMSaQ.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\5CUFfVMSaQ.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\5CUFfVMSaQ.dll,ABeFtrnwmgAedx
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\5CUFfVMSaQ.dll,AEjATaIExpQg
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\NCybOKcMqaEIN\jnEWIdoCfnPf.dll"
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\5CUFfVMSaQ.dll,AbfBlUFQKbpevAFdaCpElBdscB
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\5CUFfVMSaQ.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\5CUFfVMSaQ.dll
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\5CUFfVMSaQ.dll,ABeFtrnwmgAedx
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\5CUFfVMSaQ.dll,AEjATaIExpQg
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\5CUFfVMSaQ.dll,AbfBlUFQKbpevAFdaCpElBdscB
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\5CUFfVMSaQ.dll",#1
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\NCybOKcMqaEIN\jnEWIdoCfnPf.dll"

Source: C:\Windows\System32\regsvr32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D105A4D4-344C-48EB-9866-EE378D90658B}\InProcServer32

Source: classification engine

Classification label: mal96.troj.evad.winDLL@20/5@0/27

Source: C:\Windows\System32\regsvr32.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

Code function: 2_2_0285BA54 Process32NextW,CreateToolhelp32Snapshot,Process32FirstW,FindCloseChangeNotification,

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\5CUFfVMSaQ.dll",#1

Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: C:\Windows\System32\rundll32.exe	Automated click: OK
Source: C:\Windows\System32\rundll32.exe	Automated click: OK

Source: 5CUFfVMSaQ.dll

Static PE information: More than 133 > 100 exports found

Source: 5CUFfVMSaQ.dll

Static PE information: Image base 0x180000000 > 0x60000000

Source: 5CUFfVMSaQ.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 5CUFfVMSaQ.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 5CUFfVMSaQ.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 5CUFfVMSaQ.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 5CUFfVMSaQ.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018007CB0E push rsp; retf
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018007CEE0 push rsp; retf
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018007D180 push rsp; retf
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018002D2C9 push rdi; ret
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018007D420 push rsp; retf
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018007D7C0 push rsp; retf
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018002D8FD push rdi; ret
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0285B61A push ebp; retf
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0285B540 push esi; iretd
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0285AE42 push ebp; iretd
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0291236C push esp; retf

Source: 5CUFfVMSaQ.dll	Static PE information: section name: .00cfg
Source: 5CUFfVMSaQ.dll	Static PE information: section name: .gehcont
Source: 5CUFfVMSaQ.dll	Static PE information: section name: .gxfg
Source: 5CUFfVMSaQ.dll	Static PE information: section name: .retplne
Source: 5CUFfVMSaQ.dll	Static PE information: section name: .voltbl
Source: 5CUFfVMSaQ.dll	Static PE information: section name: _RDATA

Source: C:\Windows\System32\loaddll64.exe

Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\5CUFfVMSaQ.dll

Source: C:\Windows\System32\regsvr32.exe

PE file moved: C:\Windows\System32\NCybOKcMqaEIN\jnEWIdoCfnPf.dll

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\System32\regsvr32.exe

File opened: C:\Windows\system32\NCybOKcMqaEIN\jnEWIdoCfnPf.dll:Zone.Identifier read attributes | delete

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\svchost.exe TID: 4224	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 6220	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 4140	Thread sleep time: -150000s >= -30000s

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Windows\System32\regsvr32.exe

API coverage: 4.4 %

Source: C:\Windows\System32\regsvr32.exe

Process information queried: ProcessInformation

Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_00000001800426C8 _invalid_parameter_noinfo,_invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_00000001800436B4 FindFirstFileExW,
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018004383C FindFirstFileExW,FindNextFileW,FindClose,FindClose,
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180043DBC FindFirstFileExW,FindNextFileW,FindClose,FindClose,
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02930A20 FindFirstFileW,FindNextFileW,

Source: C:\Windows\System32\regsvr32.exe

File Volume queried: C:\ FullSizeInformation

Source: svchost.exe, 0000000C.00000002.837269152.000001FFA505E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: $@Hyper-V RAW
Source: regsvr32.exe, 00000006.00000002.964477134.0000000000F7E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.502763451.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.502855478.0000000000F7E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.964412082.0000000000F52000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.502695787.0000000000F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.837250042.000001FFA504C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.668175675.0000024E70AF3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.667732408.0000024E70A70000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 0000000E.00000002.964372851.0000027146A02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcDsSvcfhsvcWPDBusEnumsvsvcwlansvcEmbeddedModeirmonSensorServicevmicvssNgcSvcsysmainDevQueryBrokerStorSvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionNcbServiceNetmanDeviceAssociationServiceTabletInputServicePcaSvcIPxlatCfgSvcCscServiceUmRdpService
Source: svchost.exe, 0000000C.00000002.836872058.000001FF9F829000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: svchost.exe, 0000000E.00000002.964447614.0000027146A29000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\regsvr32.exe

Code function: 2_2_000000018003A8BC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

Source: C:\Windows\System32\regsvr32.exe

Code function: 2_2_00000001800385E0 GetProcessHeap,

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\System32\loaddll64.exe

Process queried: DebugPort

Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_000000018003A8BC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180003794 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180003A24 SetUnhandledExceptionFilter,
Source: C:\Windows\System32\regsvr32.exe	Code function: 2_2_0000000180003A34 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\regsvr32.exe

Network Connect: 188.165.79.151 443

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\5CUFfVMSaQ.dll",#1

Source: C:\Windows\System32\regsvr32.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\regsvr32.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation

Source: C:\Windows\System32\regsvr32.exe	Code function: EnumSystemLocalesW,
Source: C:\Windows\System32\regsvr32.exe	Code function: EnumSystemLocalesW,
Source: C:\Windows\System32\regsvr32.exe	Code function: EnumSystemLocalesW,
Source: C:\Windows\System32\regsvr32.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,
Source: C:\Windows\System32\regsvr32.exe	Code function: GetLocaleInfoW,
Source: C:\Windows\System32\regsvr32.exe	Code function: EnumSystemLocalesW,
Source: C:\Windows\System32\regsvr32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,
Source: C:\Windows\System32\regsvr32.exe	Code function: EnumSystemLocalesW,
Source: C:\Windows\System32\regsvr32.exe	Code function: GetLocaleInfoW,
Source: C:\Windows\System32\regsvr32.exe	Code function: EnumSystemLocalesW,
Source: C:\Windows\System32\regsvr32.exe	Code function: GetLocaleInfoW,
Source: C:\Windows\System32\regsvr32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,
Source: C:\Windows\System32\regsvr32.exe	Code function: GetLocaleInfoW,

Source: C:\Windows\System32\regsvr32.exe

Code function: 2_2_0000000180045B10 cpuid

Source: C:\Windows\System32\regsvr32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: C:\Windows\System32\regsvr32.exe

Code function: 2_2_0000000180004050 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

Stealing of Sensitive Information

Source: Yara match

File source: 00000006.00000002.964376372.0000000000F3B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Yara detected Emotet

Source: Yara match	File source: 3.2.rundll32.exe.25325750000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.regsvr32.exe.1130000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.237550f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.regsvr32.exe.1130000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.regsvr32.exe.2810000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.25325750000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.regsvr32.exe.2810000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.237550f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.452456296.0000000002841000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.449537237.00000237550F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.448904188.0000025326DA1000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.452429989.0000000002810000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.964724556.0000000001130000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.449599584.0000023755221000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.448824975.0000025325750000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.964860380.0000000002911000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 5CUFfVMSaQ.dll, type: SAMPLE
Source: Yara match	File source: 2.2.regsvr32.exe.180000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.regsvr32.exe.180000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.965051526.0000000180001000.00000020.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.452552735.0000000180001000.00000020.00000001.01000000.00000006.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	111 Process Injection	2 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	11 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	3 Virtualization/Sandbox Evasion	LSASS Memory	41 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	2 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	111 Process Injection	Security Account Manager	3 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Deobfuscate/Decode Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	12 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Hidden Files and Directories	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	2 Obfuscated Files or Information	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Regsvr32	DCSync	44 System Information Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 Rundll32	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	1 DLL Side-Loading	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	1 File Deletion	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
5CUFfVMSaQ.dll	21%	Virustotal		Browse
5CUFfVMSaQ.dll	46%	Metadefender		Browse
5CUFfVMSaQ.dll	81%	ReversingLabs	Win64.Trojan.Emotet

Source	Detection	Scanner	Label
https://www.disneyplus.com/legal/your-california-privacy-rights	0%	URL Reputation	safe
http://crl.ver)	0%	Avira URL Cloud	safe
https://www.disneyplus.com/legal/privacy-policy	0%	URL Reputation	safe
https://www.tiktok.com/legal/report/feedback	0%	URL Reputation	safe
https://188.165.79.151/	0%	URL Reputation	safe
https://188.165.79.151/oA~	0%	Avira URL Cloud	safe
http://help.disneyplus.com.	0%	URL Reputation	safe
https://www.pango.co/privacy	0%	URL Reputation	safe
https://disneyplus.com/legal.	0%	URL Reputation	safe

Name	Malicious	Antivirus Detection	Reputation
https://188.165.79.151/	true	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.disneyplus.com/legal/your-california-privacy-rights	svchost.exe, 00000014.00000003.641209465.0000024E715B8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.641248614.0000024E71595000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.641270170.0000024E715A6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.641297731.0000024E715C2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.ver)	svchost.exe, 0000000C.00000002.837320264.000001FFA508B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.668398256.0000024E71500000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.624494400.0000024E71506000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://www.disneyplus.com/legal/privacy-policy	svchost.exe, 00000014.00000003.641297731.0000024E715C2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.tiktok.com/legal/report/feedback	svchost.exe, 00000014.00000003.647804814.0000024E7158E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.646539654.0000024E71A02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.646486184.0000024E71A18000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://188.165.79.151/oA~	regsvr32.exe, 00000006.00000002.964412082.0000000000F52000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.502695787.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://help.disneyplus.com.	svchost.exe, 00000014.00000003.641209465.0000024E715B8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.641248614.0000024E71595000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.641270170.0000024E715A6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.641297731.0000024E715C2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.hotspotshield.com/	svchost.exe, 00000014.00000003.637666200.0000024E71595000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.637519972.0000024E71A02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.637725354.0000024E71A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.637589847.0000024E71A03000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.637475233.0000024E715A7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.637701522.0000024E715B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.637485712.0000024E715B7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.hotspotshield.com/terms/	svchost.exe, 00000014.00000003.637666200.0000024E71595000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.637519972.0000024E71A02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.637725354.0000024E71A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.637589847.0000024E71A03000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.637475233.0000024E715A7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.637701522.0000024E715B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.637485712.0000024E715B7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.pango.co/privacy	svchost.exe, 00000014.00000003.637666200.0000024E71595000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.637519972.0000024E71A02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.637725354.0000024E71A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.637589847.0000024E71A03000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.637475233.0000024E715A7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.637701522.0000024E715B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.637485712.0000024E715B7000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://disneyplus.com/legal.	svchost.exe, 00000014.00000003.641209465.0000024E715B8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.641248614.0000024E71595000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.641270170.0000024E715A6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.641297731.0000024E715C2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
121.247.2.0	unknown	India	17908	TCISLTataCommunicationsIN	true
188.165.79.151	unknown	France	16276	OVHFR	true
120.247.2.0	unknown	China	56048	CMNET-BEIJING-APChinaMobileCommunicaitonsCorporationCN	true
4.4.0.0	unknown	United States	3356	LEVEL3US	true
8.4.0.0	unknown	United States	3356	LEVEL3US	true
232.3.0.0	unknown	Reserved	unknown	unknown	true
139.247.2.0	unknown	United States	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	true
133.247.2.0	unknown	Japan	131918	SCN-NETSHONANCABLENETWORKJP	true
224.146.244.0	unknown	Reserved	unknown	unknown	true
160.156.244.0	unknown	Tunisia	37492	ORANGE-TN	true
108.194.0.0	unknown	United States	7018	ATT-INTERNET4US	true
160.153.244.0	unknown	United States	21501	GODADDY-AMSDE	true
145.247.2.0	unknown	Finland	41701	CAP-FIN-ASFI	true
40.4.0.0	unknown	United States	4249	LILLY-ASUS	true
20.4.0.0	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	true
143.247.2.0	unknown	United States	600	OARNET-ASUS	true
160.154.244.0	unknown	Cote D'ivoire	29571	ORANGE-COTE-IVOIRECI	true
141.247.2.0	unknown	United States	40112	OPPD-ASUS	true
36.4.0.0	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	true
4.1.0.0	unknown	United States	3356	LEVEL3US	true
160.147.244.0	unknown	United States	1503	DNIC-AS-01503US	true
224.150.244.0	unknown	Reserved	unknown	unknown	true
236.3.0.0	unknown	Reserved	unknown	unknown	true
24.4.0.0	unknown	United States	7922	COMCAST-7922US	true
21.115.0.0	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	true
153.247.2.0	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	true

Private

IP
127.0.0.1

General Information

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	671666
Start date and time: 22/07/202213:14:59	2022-07-22 13:14:59 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 58s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	5CUFfVMSaQ (renamed file extension from none to dll)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal96.troj.evad.winDLL@20/5@0/27
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 88.8% (good quality ratio 83.1%) Quality average: 75.3% Quality standard deviation: 30.7%
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI Override analysis time to 240s for rundll32

Warnings

Exclude process from analysis (whitelisted): audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, wuapihost.exe
Excluded IPs from analysis (whitelisted): 23.35.236.56, 20.223.24.244
Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fs.microsoft.com, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ctldl.windowsupdate.com, e1723.g.akamaiedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, ris.api.iris.microsoft.com, licensing.mp.microsoft.com, rp-consumer-prod-displaycatalog-geomap.trafficmanager.net, store-images.s-microsoft.com, login.live.com, sls.update.microsoft.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
13:16:54	API Interceptor	11x Sleep call for process: svchost.exe modified

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.3593198815979092
Encrypted:	false
SSDEEP:	12:SnaaD0JcaaD0JwQQU2naaD0JcaaD0JwQQU:4tgJctgJw/tgJctgJw
MD5:	BF1DC7D5D8DAD7478F426DF8B3F8BAA6
SHA1:	C6B0BDE788F553F865D65F773D8F6A3546887E42
SHA-256:	BE47C764C38CA7A90A345BE183F5261E89B98743B5E35989E9A8BE0DA498C0F2
SHA-512:	00F2412AA04E09EA19A8315D80BE66D2727C713FC0F5AE6A9334BABA539817F568A98CA3A45B2673282BDD325B8B0E2840A393A4DCFADCB16473F5EAF2AF3180
Malicious:	false
Preview:	.......................3...w..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@...................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	MPEG-4 LOAS
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.24947955525151602
Encrypted:	false
SSDEEP:	1536:BJiRdfVzkZm3lyf49uyc0ga04PdHS9LrM/oVMUdSRU4i:BJiRdwfu2SRU4i
MD5:	1DF93142E07F403B10A2C717C0F36ACC
SHA1:	C60DFCA92DFCF85A34BBC3680B975D9E7783BC71
SHA-256:	547F0093516E49BA5ECF3E8A6861DD5A576C68B4778318EAEF931FA7E41464A2
SHA-512:	6EF5C5E65D3E71DBAF680C15512EA9E1A0FA17D969D3C05959284E95FFDEAA87CFE3843D6FDA29B12646AB2E9C5DD675BFB81D5357C94B39ED7E2286EAC794BC
Malicious:	false
Preview:	V.d.........@..@.3...w...........................3...w..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.........................................d#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x555eccf5, page size 16384, Windows version 10.0
Category:	dropped
Size (bytes):	786432
Entropy (8bit):	0.2505532827291524
Encrypted:	false
SSDEEP:	384:zPw+W0StseCJ48EApW0StseCJ48E2rTSjlK/ebmLerYSRSY1J2:zPvSB2nSB2RSjlK/+mLesOj1J2
MD5:	B108CC58B01CE88C345B14837CD712B0
SHA1:	30AA6A7615EC2B8D56B5CA49FA5E6FEF86FAF139
SHA-256:	F7999A41C300967BE907E519A2E5EFD39443BD0ACA3FAB73576820DD412CF11B
SHA-512:	B2B89BFB7B0702D70C6F63BDAB2D989382DA1E9648D9254ED172596ACFA5002448DF170EEB7B10C06DF0E673A95F744F27AD38A083567DC83368606075311F1C
Malicious:	false
Preview:	U^..... ................e.f.3...w........................)..........zM.6....z..h.(..........zM...)..............3...w...........................................................................................................B...........@...................................................................................................... ......................................................................................................................................................................................................................................................I.....zM....................w.....zM.........................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07330449171033379
Encrypted:	false
SSDEEP:	3:q//J7vTXnoAl/jo+c3wjtRnZl/all3Vkttlmlnl:qXJrUnHYRy3
MD5:	B5E3E9AA630E00B392934C7C69EF4E06
SHA1:	CE4A4F072F33A764CE095DC07EA5B1EC4BA59C36
SHA-256:	48FD84925729F7BF36AFFB9EBD1DEF5889CCC44C8CC9D59E77DA798E4C4A598A
SHA-512:	26709ED8D7400C8935CF6CC5D9914431FFD607E63348248D69D1B53C7E73DC358A60A0EB510D613B8DCE4518B5E5C052F00E5A7A4F51F88DEAE6D959CFEDCDF6
Malicious:	false
Preview:	?.)......................................3...w..6....z.......zM..............zM......zM.D2.......z.m...................w.....zM.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy (8bit):	6.931234965672042
TrID:	Win64 Dynamic Link Library (generic) (102004/3) 86.43% Win64 Executable (generic) (12005/4) 10.17% Generic Win/DOS Executable (2004/3) 1.70% DOS Executable Generic (2002/1) 1.70% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.01%
File name:	5CUFfVMSaQ.dll
File size:	691200
MD5:	5d4728494832d03bbfb75367836fef4e
SHA1:	abcbd283801a05390995862f59dcb5310f3d3d88
SHA256:	caa60b9025dfba07efac6cae5438a8e20d9b7c210a721a4cf1f9d7b6df4d7d90
SHA512:	89f38029d8cc4718af304e325a290294a000e68fea0d036fbe118cc04bd3ae5a676cab2dbc6ea4d1c53eeac804cd23756c01dce378a317cb683200365ad5079a
SSDEEP:	12288:pBBKShhc/bQisqkxf3CJS+HQ58B6loNJYlvw9zaaxRHdAsxuvt3a1gYao3ovJK6S:bBHlvw9GanHrot3hoW
TLSH:	45E4BE56ABE404B1E1B7D235C9128E81FAB3FC544724AB8B03E095B62F233AC557F716
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......b.........." ................d?.......................................0............ ........................................

File Icon


Icon Hash:	74f0e4ecccdce0e4

Static PE Info

General

Entrypoint:	0x180003f64
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x180000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, DLL
DLL Characteristics:	HIGH_ENTROPY_VA, NX_COMPAT
Time Stamp:	0x62BAE9E7 [Tue Jun 28 11:45:43 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	6cc0be0d01417a15b61c3b6a580e87ed

Entrypoint Preview

Instruction
dec eax
mov dword ptr [esp+08h], ebx
dec eax
mov dword ptr [esp+10h], esi
push edi
dec eax
sub esp, 20h
dec ecx
mov edi, eax
mov ebx, edx
dec eax
mov esi, ecx
cmp edx, 01h
jne 00007F4F7C9FE2F7h
call 00007F4F7C9FE314h
dec esp
mov eax, edi
mov edx, ebx
dec eax
mov ecx, esi
dec eax
mov ebx, dword ptr [esp+30h]
dec eax
mov esi, dword ptr [esp+38h]
dec eax
add esp, 20h
pop edi
jmp 00007F4F7C9FE184h
int3
int3
int3
dec eax
mov dword ptr [esp+20h], ebx
push ebp
dec eax
mov ebp, esp
dec eax
sub esp, 20h
dec eax
mov eax, dword ptr [0006E0C0h]
dec eax
mov ebx, 2DDFA232h
cdq
sub eax, dword ptr [eax]
add byte ptr [eax+3Bh], cl
ret
jne 00007F4F7C9FE366h
dec eax
and dword ptr [ebp+18h], 00000000h
dec eax
lea ecx, dword ptr [ebp+18h]
call dword ptr [0006741Ah]
dec eax
mov eax, dword ptr [ebp+18h]
dec eax
mov dword ptr [ebp+10h], eax
call dword ptr [0006738Ch]
mov eax, eax
dec eax
xor dword ptr [ebp+10h], eax
call dword ptr [00067370h]
mov eax, eax
dec eax
lea ecx, dword ptr [ebp+20h]
dec eax
xor dword ptr [ebp+10h], eax
call dword ptr [00067490h]
mov eax, dword ptr [ebp+20h]
dec eax
lea ecx, dword ptr [ebp+10h]
dec eax
shl eax, 20h
dec eax
xor eax, dword ptr [ebp+20h]
dec eax
xor eax, dword ptr [ebp+10h]
dec eax
xor eax, ecx
dec eax
mov ecx, FFFFFFFFh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x69f18	0xe9d	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6adb5	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x89000	0x28080	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x75000	0x4620	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xb2000	0x808	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x5ed80	0x138	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x6b1b8	0x3b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5c966	0x5ca00	False	0.4055093412618084	data	6.495336903226537	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x5e000	0x13174	0x13200	False	0.41204554738562094	data	5.399737438631881	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x72000	0x2894	0xe00	False	0.15625	data	2.3008281540935718	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x75000	0x4620	0x4800	False	0.4896918402777778	data	5.7263789636668765	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.00cfg	0x7a000	0x28	0x200	False	0.05859375	data	0.37171553503035126	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.gehcont	0x7b000	0x50	0x200	False	0.130859375	PGP\011Secret Sub-key -	0.5546627733147627	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.gxfg	0x7c000	0x9eb0	0xa000	False	0.336083984375	data	5.261757688277708	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.retplne	0x86000	0x5c	0x200	False	0.087890625	data	0.8458487823546629
.voltbl	0x87000	0x54	0x200	False	0.18359375	data	1.322754253639915
_RDATA	0x88000	0xf4	0x200	False	0.314453125	data	1.9917660782863578	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x89000	0x28080	0x28200	False	0.8353168808411215	data	7.725336511078031	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xb2000	0x808	0xa00	False	0.454296875	data	4.922299312910362	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_STRING	0xb1038	0x48	data	English	United States
RT_HTML	0x89238	0x27e00	data	English	United States
RT_MANIFEST	0x890f0	0x143	XML 1.0 document, ASCII text	English	United States

Imports

DLL	Import
GDI32.dll	CreatePen, DeleteObject, LineTo, MoveToEx, Polyline, SelectObject
USER32.dll	BeginPaint, CloseGestureInfoHandle, CreateWindowExW, DefWindowProcW, DestroyWindow, DispatchMessageW, EndPaint, GetGestureInfo, GetMessageW, InvalidateRect, LoadCursorW, LoadStringW, PostQuitMessage, RegisterClassExW, ScreenToClient, SetGestureConfig, ShowWindow, TranslateAcceleratorW, TranslateMessage, UpdateWindow
KERNEL32.dll	CloseHandle, CompareStringW, CreateFileW, DeleteCriticalSection, EncodePointer, EnterCriticalSection, EnumSystemLocalesW, ExitProcess, FindClose, FindFirstFileExW, FindNextFileW, FlsAlloc, FlsFree, FlsGetValue, FlsSetValue, FlushFileBuffers, FreeEnvironmentStringsW, FreeLibrary, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetConsoleMode, GetConsoleOutputCP, GetCurrentProcess, GetCurrentProcessId, GetCurrentThread, GetCurrentThreadId, GetDateFormatW, GetEnvironmentStringsW, GetFileSizeEx, GetFileType, GetLastError, GetLocaleInfoW, GetModuleFileNameW, GetModuleHandleExW, GetModuleHandleW, GetOEMCP, GetProcAddress, GetProcessHeap, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemTimeAsFileTime, GetTimeFormatW, GetUserDefaultLCID, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, InitializeCriticalSectionAndSpinCount, InitializeSListHead, InterlockedFlushSList, InterlockedPushEntrySList, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, IsValidLocale, LCMapStringW, LeaveCriticalSection, LoadLibraryExW, MultiByteToWideChar, OutputDebugStringW, QueryPerformanceCounter, RaiseException, ReadConsoleW, ReadFile, RtlCaptureContext, RtlLookupFunctionEntry, RtlPcToFileHeader, RtlUnwind, RtlUnwindEx, RtlVirtualUnwind, SetConsoleCtrlHandler, SetEnvironmentVariableW, SetFilePointerEx, SetLastError, SetStdHandle, SetUnhandledExceptionFilter, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, UnhandledExceptionFilter, VirtualAlloc, WideCharToMultiByte, WriteConsoleW, WriteFile

Exports

Name	Ordinal	Address
ABeFtrnwmgAedx	1	0x1800029d0
AEjATaIExpQg	2	0x180002890
AbfBlUFQKbpevAFdaCpElBdscB	3	0x180002200
AhCiOqhwyUiZbbsGncKmyLU	4	0x1800026f0
AppWcUGsNPSALiojxbzmIncLqw	5	0x1800028f0
BuDIuWLYHzeYLi	6	0x180002260
BzspXLkN	7	0x1800024f0
CAJbrnGzThPxKInHYeNbeiD	8	0x180002980
CAizYoExRRpdPoWVbPYKFDwgiU	9	0x180002800
DllRegisterServer	10	0x180002170
DsznQIJtSEfpoaC	11	0x1800022b0
DwKmpHIDu	12	0x180002930
ECDzEWMCYJeoRkryuQOsYJpmq	13	0x1800022e0
FAcdRHAWz	14	0x180002610
FFgOwmblMRuJiEZKeYTYiuzs	15	0x1800023f0
FGcNCKAIdduwyHBYG	16	0x180002860
FrsmtxAdhb	17	0x180002590
FycDPRFayBivcQtViJFBB	18	0x180002320
GGGPAvQKBPbfXZZaHVp	19	0x180002920
GKgyyDJNJDeNTLdDtczKsL	20	0x180002340
GMWWgDWCipXlIkjHwoUVUkcYR	21	0x1800026e0
GXJpVyiTrLHOne	22	0x1800023d0
HJTFoxcPliQgvLgH	23	0x180002820
HLCABIQMByMWBQl	24	0x180002720
HSSmJwdyKCypI	25	0x180002650
HuenqNYbiVIeAyMGFYkiYBPFpc	26	0x180002770
IxremlDMjrvkDxgZfhGQZrk	27	0x180002700
IxvOJTyBGbJYNRuYaPxjyAUmf	28	0x180002380
JQPbXc	29	0x180002270
JcMTbvPHZlumePpXUBhRJWcp	30	0x180002350
JnZLIBBbkn	31	0x1800025e0
JohOupoqASpLhYFLsyWn	32	0x180002950
JwPmjlqZQXgHaQjgtKwKH	33	0x180002940
LsCgTlMZDLwMutNSvzYIEdEhwL	34	0x180002330
MPWJOPLDpgeYBymjBqgQIjmNoZ	35	0x180002360
MXztYxhtX	36	0x1800021f0
McniJoPJlmcEHlRCsaUz	37	0x180002550
MhvpJKCzeAS	38	0x180002620
MmBOoLzloNcLojEtz	39	0x1800027a0
MoxtcCOHATssMTmiLf	40	0x1800029e0
MpzzLNccslEpsqsI	41	0x180002540
NqTxbmWhjf	42	0x1800027e0
NsnrjJneCojFavepwQt	43	0x180002430
OFTAEmNeIKkEpTykdZkNKIzp	44	0x180002520
OguNFmV	45	0x1800025f0
PXDdTdN	46	0x1800026d0
PvWkibWuSiAacbZGzrkJUt	47	0x1800021b0
QFGNloHdiwsP	48	0x180002450
QOFKcQtiQXM	49	0x180002830
QmukeRFviFO	50	0x1800021a0
QupOoHScTGifO	51	0x1800026a0
QyvetqDJywCLrVJLzofDOegxwP	52	0x180002710
RmPpiUfGU	53	0x180002750
SIkquaNCflVmESatNcndpdTlpe	54	0x1800028d0
SfIHxYaArvTuFNrMVIbyX	55	0x180002470
UWpelES	56	0x180002880
UkLettFcomFXma	57	0x180002990
VLdhIHLdMhyW	58	0x1800025b0
VcULfipZVLXGKZRfrueex	59	0x180002500
VqpcWzxeRjlVhQwQzv	60	0x180002410
WBpPkPKcWeqGwAzzvNIH	61	0x180002790
WEDyKrcivTPPlSwCwT	62	0x180002370
WoptoKqfVNqOqwssFKVZfo	63	0x180002670
XnGdCqyiMLdhVnMShSkq	64	0x180002630
YMyyyHvdBObwWJjXdFk	65	0x180002250
YihCWA	66	0x180002530
YweLMeZukpQkvnZnYHkhCM	67	0x180002780
ZLVzkIypQXUkzx	68	0x180002900
ZSoNGzxKLdyqDghj	69	0x180002640
ZkiQhRLkrjLkJNX	70	0x180002730
ZmqtKkySX	71	0x180002210
aPfqQAbMTzuJNp	72	0x180002390
aehnZNNrhIsF	73	0x1800029a0
amxdxgjfMZcXaFUifsfcvLXi	74	0x1800022a0
bPfPnNT	75	0x1800023a0
bubLuYEWIvIWsBNJTUOnl	76	0x1800023e0
cTcqyCZyBDJvEFnsvQYDCOLAoT	77	0x1800022f0
cYubuRW	78	0x1800027f0
clFUgmrVuPSljrxXorVz	79	0x180002230
dbMiEkrHbNnvlIaysX	80	0x180002600
dgAUOlElUrm	81	0x1800021d0
dxEatgtTYroSUkMiQaL	82	0x180002220
eCkbiLnmCybWxEn	83	0x180002440
efVluiugFvmsD	84	0x1800029b0
exoEcLTZltlKDhXcTPLBLvM	85	0x1800026b0
fAgLiyKNqrsT	86	0x180002660
fEeZsQFKbuLaABrhuAbOhNj	87	0x180002420
gYiNJrEBUixiSygWCLlsEf	88	0x180002680
gpObsYCSb	89	0x1800023c0
gtbMrIHBEjSZnmBWPb	90	0x180002840
hCcvyzzlUZCYlRNZCTK	91	0x1800027b0
hPDZNFuvABEgQeoD	92	0x180002850
hsEYnjr	93	0x180002460
iLEOjsJklFUGkNI	94	0x1800025c0
iLjGFeOafkDi	95	0x1800024d0
jcCPKYwgGqRpySHQKBnfIdayWD	96	0x1800022c0
jjTWNPlegZljgiNVCWFLUDkFH	97	0x180002280
kffHAP	98	0x180002560
lUlTXKofnHgBxwxJLPdDPpCz	99	0x1800028c0
lYaeKiHDZBLcjXyoPcEOBUc	100	0x1800024c0
lpGoEIn	101	0x1800023b0
mAtENYctTeMWWmtQ	102	0x180002760
mEiZkvnenxFVSgbXocseslt	103	0x1800028a0
mSkIHCWnxYjPAvLhkizRM	104	0x180002480
nciUfwCE	105	0x1800025a0
nfBvdBN	106	0x180002310
ngwzyo	107	0x180002960
njQxmJYMOWniVIJCxlqYaGwyco	108	0x180002290
pikxaDuNdKkEyUKlBLtRo	109	0x1800024b0
qYcNCgPzHhoixH	110	0x180002400
qbLCbNjvgZccfXANyoilYHLz	111	0x1800024a0
rIgvWBvLm	112	0x180002810
rMHLHjIymAUoTHNFdsfNPiQH	113	0x1800028b0
riiAnEEXhiFVUIdp	114	0x180002870
sCXUQoygEhYAvHSLAtQPOlI	115	0x180002910
sNgDDxTXeDBSWJVL	116	0x1800021c0
sjmfaFHjAYLiTOs	117	0x180002970
uFvBoQlDuBHPbcggfbqTz	118	0x180002240
uKxBgklrkubs	119	0x180002300
ueGFocoIB	120	0x180002690
ueINzYdzNpuGfNAPnf	121	0x1800029c0
vAVSflnhL	122	0x1800022d0
vJROvhiSqVeOiIsH	123	0x1800021e0
vfDcFWpsvSWqEKgMwpzmloZ	124	0x1800027c0
vzyObHl	125	0x1800027d0
wAavZUBVHJ	126	0x180002740
wCHWOvC	127	0x1800026c0
wQlVOK	128	0x1800028e0
wZFewnVovChWmNJWJDqUTvJm	129	0x180002580
wkraMphf	130	0x1800025d0
xkQCLrMtQvyCjJhPSdk	131	0x1800024e0
yYodwLnmm	132	0x180002510
ysdKIUzdVU	133	0x180002570
zFCiVYrpvmmXdRHTSKMcojyZb	134	0x180002490

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.5188.165.79.151497724432404320 07/22/22-13:16:45.923727	TCP	2404320	ET CNC Feodo Tracker Reported CnC Server TCP group 11	49772	443	192.168.2.5	188.165.79.151

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 22, 2022 13:16:45.396075964 CEST	49772	443	192.168.2.5	188.165.79.151
Jul 22, 2022 13:16:45.396126986 CEST	443	49772	188.165.79.151	192.168.2.5
Jul 22, 2022 13:16:45.396208048 CEST	49772	443	192.168.2.5	188.165.79.151
Jul 22, 2022 13:16:45.415882111 CEST	49772	443	192.168.2.5	188.165.79.151
Jul 22, 2022 13:16:45.415935040 CEST	443	49772	188.165.79.151	192.168.2.5
Jul 22, 2022 13:16:45.538677931 CEST	443	49772	188.165.79.151	192.168.2.5
Jul 22, 2022 13:16:45.538773060 CEST	49772	443	192.168.2.5	188.165.79.151
Jul 22, 2022 13:16:45.919445038 CEST	49772	443	192.168.2.5	188.165.79.151
Jul 22, 2022 13:16:45.919504881 CEST	443	49772	188.165.79.151	192.168.2.5
Jul 22, 2022 13:16:45.920139074 CEST	443	49772	188.165.79.151	192.168.2.5
Jul 22, 2022 13:16:45.920217991 CEST	49772	443	192.168.2.5	188.165.79.151
Jul 22, 2022 13:16:45.923537970 CEST	49772	443	192.168.2.5	188.165.79.151
Jul 22, 2022 13:16:45.964503050 CEST	443	49772	188.165.79.151	192.168.2.5
Jul 22, 2022 13:16:46.333272934 CEST	443	49772	188.165.79.151	192.168.2.5
Jul 22, 2022 13:16:46.333344936 CEST	443	49772	188.165.79.151	192.168.2.5
Jul 22, 2022 13:16:46.333456993 CEST	49772	443	192.168.2.5	188.165.79.151
Jul 22, 2022 13:16:46.334310055 CEST	49772	443	192.168.2.5	188.165.79.151
Jul 22, 2022 13:16:46.336334944 CEST	49772	443	192.168.2.5	188.165.79.151
Jul 22, 2022 13:16:46.336368084 CEST	443	49772	188.165.79.151	192.168.2.5

HTTP Request Dependency Graph

188.165.79.151

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.5	49772	188.165.79.151	443	C:\Windows\System32\regsvr32.exe

Timestamp	Direction	Data
2022-07-22 11:16:45 UTC	OUT	GET / HTTP/1.1 Cookie: kJZtvOKXxX=hTloIDqhoyWpurUw3AxwGwlasyWlepnQrzPzxDdUOeOLyYl1IS66LGJ7p3GRml0qSCniQY8iO9vwBvYi0s9GFTLntOUX1Zv/Yct+Xz8D8ChWhoNEM9sP7kk/vQZZ5Ril8i53FqG17zNu5+qxXeF44TrT5h9rSAkz2z7kX0nZnwYiZveRpVLi2JYEMWQdksTrTzltZQZOrQPQdu4BaI2PwYAAsLHNp24r2uk3knZ1f90JTxLZKGsWTLdTxREVM9QYo5C/g/WNCeWU7ydkurXqgqGDaOFhx/8wopk+lxr0GYWs4XyAPwQ23Q== Host: 188.165.79.151 Connection: Keep-Alive Cache-Control: no-cache
2022-07-22 11:16:46 UTC	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 22 Jul 2022 11:16:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2022-07-22 11:16:46 UTC	IN	Data Raw: 34 31 33 0d 0a 4f c9 a8 f9 d3 3a 1d d9 50 db be bb 14 90 45 c8 79 2a ea 93 97 fb b7 48 bf 22 da 80 a6 5a 66 b9 11 75 fe ae d6 76 5f e3 ae 83 2f df 3d 44 1e 64 f0 85 d7 3d 13 07 bd c8 b0 b0 f1 49 fc 12 6f 15 8c b4 32 88 a7 b2 99 23 62 bc 10 ba ca 3c 93 78 a8 69 ea ef f4 67 44 96 4f f8 70 a2 94 59 f2 74 66 44 2a aa 00 84 b3 52 ac 4d d5 ce fb aa 8a 4a 95 8a 2b 3c 53 d5 9a 26 e1 9a c3 92 f2 a2 b8 1b 0f 07 53 4f 69 17 2d 0a d6 6d 02 d0 d0 6b 04 fd a4 94 ed a4 61 58 a6 c5 f2 93 38 bf 05 9a 68 be f9 92 0c 8f 59 7a 45 59 15 0e 29 7e c0 06 4e 6a 38 43 aa 5b ea ff 37 1b 20 a6 1b 4b 31 4c 4f 4c ba 76 3d f9 fd fe 2e 0f 70 7e 3a ee 5c ad e9 f3 4b f9 d9 70 18 08 ba 6c 62 68 05 c4 95 97 70 25 f5 74 f2 9a d4 09 cf 07 ca 89 36 f4 fc 90 c9 fb db 48 85 2e 74 c2 8c 06 f9 e6 Data Ascii: 413O:PEyH"Zfuv_/=Dd=Io2#b<xigDOpYtfDRMJ+<S&SOi-mkaX8hYzEY)~Nj8C[7 K1LOLv=.p~:\Kplbhp%t6H.t

Target ID:	0
Start time:	13:16:30
Start date:	22/07/2022
Path:	C:\Windows\System32\loaddll64.exe
Wow64 process (32bit):	false
Commandline:	loaddll64.exe "C:\Users\user\Desktop\5CUFfVMSaQ.dll"
Imagebase:	0x7ff61ce00000
File size:	140288 bytes
MD5 hash:	4E8A40CAD6CCC047914E3A7830A2D8AA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: cmd.exePID: 7024, Parent PID: 7016

General

Target ID:	1
Start time:	13:16:30
Start date:	22/07/2022
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\5CUFfVMSaQ.dll",#1
Imagebase:	0x7ff602050000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: regsvr32.exePID: 7032, Parent PID: 7016

General

Target ID:	2
Start time:	13:16:30
Start date:	22/07/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	regsvr32.exe /s C:\Users\user\Desktop\5CUFfVMSaQ.dll
Imagebase:	0x7ff6727f0000
File size:	24064 bytes
MD5 hash:	D78B75FC68247E8A63ACBA846182740E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000002.00000002.452456296.0000000002841000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000002.00000002.452429989.0000000002810000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_2, Description: Yara detected Emotet, Source: 00000002.00000002.452552735.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Author: Joe Security
Reputation:	high

Analysis Process: rundll32.exePID: 7044, Parent PID: 7024

General

Target ID:	3
Start time:	13:16:31
Start date:	22/07/2022
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\5CUFfVMSaQ.dll",#1
Imagebase:	0x7ff644760000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000003.00000002.448904188.0000025326DA1000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000003.00000002.448824975.0000025325750000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Analysis Process: rundll32.exePID: 7052, Parent PID: 7016

General

Target ID:	4
Start time:	13:16:31
Start date:	22/07/2022
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\5CUFfVMSaQ.dll,ABeFtrnwmgAedx
Imagebase:	0x7ff644760000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.449537237.00000237550F0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.449599584.0000023755221000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Analysis Process: rundll32.exePID: 7108, Parent PID: 7016

General

Target ID:	5
Start time:	13:16:34
Start date:	22/07/2022
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\5CUFfVMSaQ.dll,AEjATaIExpQg
Imagebase:	0x7ff644760000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: regsvr32.exePID: 7132, Parent PID: 7032

General

Target ID:	6
Start time:	13:16:35
Start date:	22/07/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\regsvr32.exe "C:\Windows\system32\NCybOKcMqaEIN\jnEWIdoCfnPf.dll"
Imagebase:	0x7ff6727f0000
File size:	24064 bytes
MD5 hash:	D78B75FC68247E8A63ACBA846182740E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_3, Description: , Source: 00000006.00000002.964376372.0000000000F3B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000006.00000002.964724556.0000000001130000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_2, Description: Yara detected Emotet, Source: 00000006.00000002.965051526.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000006.00000002.964860380.0000000002911000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Analysis Process: rundll32.exePID: 6160, Parent PID: 7016

General

Target ID:	7
Start time:	13:16:38
Start date:	22/07/2022
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\5CUFfVMSaQ.dll,AbfBlUFQKbpevAFdaCpElBdscB
Imagebase:	0x7ff644760000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: svchost.exePID: 6476, Parent PID: 580

General

Target ID:	11
Start time:	13:16:53
Start date:	22/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff78ca80000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: svchost.exePID: 6448, Parent PID: 580

General

Target ID:	12
Start time:	13:16:54
Start date:	22/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff78ca80000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: svchost.exePID: 4520, Parent PID: 580

General

Target ID:	14
Start time:	13:17:10
Start date:	22/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Imagebase:	0x7ff78ca80000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: svchost.exePID: 5216, Parent PID: 580

General

Target ID:	18
Start time:	13:17:31
Start date:	22/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff78ca80000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: svchost.exePID: 5092, Parent PID: 580

General

Target ID:	20
Start time:	13:17:49
Start date:	22/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff78ca80000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Disassembly

⊘No disassembly

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. Regsvr32.exe is also a Microsoft signed binary.
Tactics:	Defense Evasion
Data Sources:	Loaded DLLs, Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 5CUFfVMSaQ

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Emotet

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.chk

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Windows Analysis Report
5CUFfVMSaQ