Edit tour

Windows Analysis Report
f_00321b.dll

Overview

General Information

Sample Name:	f_00321b.dll (renamed file extension from none to dll, renamed because original name is a hash value)
Original Sample Name:	f_00321b
Analysis ID:	829552
MD5:	bfc060937dc90b273eccb6825145f298
SHA1:	c156c00c7e918f0cb7363614fb1f177c90d8108a
SHA256:	2f39c2879989ddd7f9ecf52b6232598e5595f8bf367846ff188c9dfbf1251253
Infos:

Detection

Emotet

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Early bird code injection technique detected

Multi AV Scanner detection for submitted file

Yara detected Emotet

System process connects to network (likely due to code injection or exploit)

Antivirus detection for URL or domain

Snort IDS alert for network traffic

Queues an APC in another process (thread injection)

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Queries the volume information (name, serial number etc) of a device

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Deletes files inside the Windows folder

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Creates files inside the system directory

PE file contains sections with non-standard names

Internet Provider seen in connection with other malware

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Sample execution stops while process was sleeping (likely an evasion)

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to call native functions

HTTP GET or POST without a user agent

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

Tries to load missing DLLs

Drops PE files to the windows directory (C:\Windows)

Detected TCP or UDP traffic on non-standard ports

Checks if the current process is being debugged

Connects to several IPs in different countries

Registers a DLL

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

loaddll64.exe (PID: 4224 cmdline: loaddll64.exe "C:\Users\user\Desktop\f_00321b.dll" MD5: C676FC0263EDD17D4CE7D644B8F3FCD6)

conhost.exe (PID: 2516 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 3216 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\f_00321b.dll",#1 MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

rundll32.exe (PID: 1264 cmdline: rundll32.exe "C:\Users\user\Desktop\f_00321b.dll",#1 MD5: 73C519F050C20580F8A62C849D49215A)

regsvr32.exe (PID: 5968 cmdline: C:\Windows\system32\regsvr32.exe "C:\Windows\system32\RymKYMmySRfU\EAqrfXJOpHznppsf.dll" MD5: D78B75FC68247E8A63ACBA846182740E)

regsvr32.exe (PID: 4888 cmdline: regsvr32.exe /s C:\Users\user\Desktop\f_00321b.dll MD5: D78B75FC68247E8A63ACBA846182740E)

regsvr32.exe (PID: 1312 cmdline: C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ZbmMPnDvLqwXll\QyzgcRWJYZS.dll" MD5: D78B75FC68247E8A63ACBA846182740E)

rundll32.exe (PID: 1240 cmdline: rundll32.exe C:\Users\user\Desktop\f_00321b.dll,DllRegisterServer MD5: 73C519F050C20580F8A62C849D49215A)

regsvr32.exe (PID: 4768 cmdline: C:\Windows\system32\regsvr32.exe "C:\Windows\system32\IzuSuDitBV\QmEREbzuu.dll" MD5: D78B75FC68247E8A63ACBA846182740E)

conhost.exe (PID: 5432 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Emotet	While Emotet historically was a banking malware organized in a botnet, nowadays Emotet is mostly seen as infrastructure as a service for content delivery. For example, since mid 2018 it is used by Trickbot for installs, which may also lead to ransomware attacks using Ryuk, a combination observed several times against high-profile targets.It is always stealing information from victims but what the criminal gang behind it did, was to open up another business channel by selling their infrastructure delivering additional malicious software. From malware analysts it has been classified into epochs depending on command and control, payloads, and delivery solutions which change over time.Emotet had been taken down by authorities in January 2021, though it appears to have sprung back to life in November 2021.	GOLD CABIN MUMMY SPIDER Mealybug	http://blog.fortinet.com/2017/05/03/deep-analysis-of-new-emotet-variant-part-1 http://blog.trendmicro.com/trendlabs-security-intelligence/emotet-returns-starts-spreading-via-spam-botnet/ http://ropgadget.com/posts/defensive_pcres.html https://adalogics.com/blog/the-state-of-advanced-code-injections https://asec.ahnlab.com/en/33600/	https://malpedia.caad.fkie.fraunhofer.de/details/win.emotet

Malware Configuration

Threatname: Emotet

{"C2 list": ["91.121.146.47:8080", "66.228.32.31:7080", "182.162.143.56:443", "187.63.160.88:80", "167.172.199.165:8080", "164.90.222.65:443", "104.168.155.143:8080", "163.44.196.120:8080", "160.16.142.56:8080", "159.89.202.34:443", "159.65.88.10:8080", "186.194.240.217:443", "149.56.131.28:8080", "72.15.201.15:8080", "1.234.2.232:8080", "82.223.21.224:8080", "206.189.28.199:8080", "169.57.156.166:8080", "107.170.39.149:8080", "103.43.75.120:443", "91.207.28.33:8080", "213.239.212.5:443", "45.235.8.30:8080", "119.59.103.152:8080", "164.68.99.3:8080", "95.217.221.146:8080", "153.126.146.25:7080", "197.242.150.244:8080", "202.129.205.3:8080", "103.132.242.26:8080", "139.59.126.41:443", "110.232.117.186:8080", "183.111.227.137:8080", "5.135.159.50:443", "201.94.166.162:443", "103.75.201.2:443", "79.137.35.198:8080", "172.105.226.75:8080", "94.23.45.86:4143", "115.68.227.76:8080", "153.92.5.27:8080", "167.172.253.162:8080", "188.44.20.25:443", "147.139.166.154:8080", "129.232.188.93:443", "173.212.193.249:8080", "185.4.135.165:8080", "45.176.232.124:443"], "Public Key": ["RUNTMSAAAABAX3S2xNjcDD0fBno33Ln5t71eii+mofIPoXkNFOX1MeiwCh48iz97kB0mJjGGZXwardnDXKxI8GCHGNl0PFj50W/ClAAOAIo=", "RUNLMSAAAADzozW1Di4r9DVWzQpMKT588RDdy7BPILP6AiDOTLYMHkSWvrQO5slbmr1OvZ2Pz+AQWzRMggQmAtO6rPH7nyx2xW++lAAKAJA="]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.320583141.0000024067ED1000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000006.00000002.839406801.0000000002031000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000006.00000002.839010466.000000000072B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Emotet_3	Yara detected Emotet	Joe Security
00000006.00000002.839356776.0000000001FE0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000003.00000002.319426857.00000000022D0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000005.00000002.320938696.000001CAEF360000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000004.00000002.320487184.0000024067EA0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000005.00000002.320983303.000001CAEF391000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author
5.2.rundll32.exe.1caef360000.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.rundll32.exe.24067ea0000.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.rundll32.exe.24067ea0000.1.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
3.2.regsvr32.exe.22d0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
3.2.regsvr32.exe.22d0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
5.2.rundll32.exe.1caef360000.1.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.2.regsvr32.exe.1fe0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.2.regsvr32.exe.1fe0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
Click to see the 3 entries

Snort Signatures

ET CNC Feodo Tracker Reported CnC Server TCP group 11 - Source IP: 192.168.2.4 - Destination IP: 213.239.212.5

Timestamp:	192.168.2.4213.239.212.5497294432404320 03/18/23-16:00:53.457464
SID:	2404320
Source Port:	49729
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET CNC Feodo Tracker Reported CnC Server TCP group 2 - Source IP: 192.168.2.4 - Destination IP: 104.168.155.143

Timestamp:	192.168.2.4104.168.155.1434970580802404302 03/18/23-15:58:29.445426
SID:	2404302
Source Port:	49705
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET CNC Feodo Tracker Reported CnC Server TCP group 13 - Source IP: 192.168.2.4 - Destination IP: 45.235.8.30

Timestamp:	192.168.2.445.235.8.304973380802404324 03/18/23-16:00:58.958124
SID:	2404324
Source Port:	49733
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET CNC Feodo Tracker Reported CnC Server TCP group 6 - Source IP: 192.168.2.4 - Destination IP: 167.172.199.165

Timestamp:	192.168.2.4167.172.199.1654970380802404310 03/18/23-15:58:19.699415
SID:	2404310
Source Port:	49703
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET CNC Feodo Tracker Reported CnC Server TCP group 5 - Source IP: 192.168.2.4 - Destination IP: 164.90.222.65

Timestamp:	192.168.2.4164.90.222.65497044432404308 03/18/23-15:58:24.948314
SID:	2404308
Source Port:	49704
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET CNC Feodo Tracker Reported CnC Server TCP group 8 - Source IP: 192.168.2.4 - Destination IP: 187.63.160.88

Timestamp:	192.168.2.4187.63.160.8849702802404314 03/18/23-15:58:11.945439
SID:	2404314
Source Port:	49702
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET CNC Feodo Tracker Reported CnC Server TCP group 3 - Source IP: 192.168.2.4 - Destination IP: 1.234.2.232

Timestamp:	192.168.2.41.234.2.2324971980802404304 03/18/23-15:59:46.453351
SID:	2404304
Source Port:	49719
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET CNC Feodo Tracker Reported CnC Server TCP group 23 - Source IP: 192.168.2.4 - Destination IP: 91.121.146.47

Timestamp:	192.168.2.491.121.146.474969580802404344 03/18/23-15:57:43.982133
SID:	2404344
Source Port:	49695
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET CNC Feodo Tracker Reported CnC Server TCP group 10 - Source IP: 192.168.2.4 - Destination IP: 206.189.28.199

Timestamp:	192.168.2.4206.189.28.1994972180802404318 03/18/23-16:00:02.963968
SID:	2404318
Source Port:	49721
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET CNC Feodo Tracker Reported CnC Server TCP group 16 - Source IP: 192.168.2.4 - Destination IP: 66.228.32.31

Timestamp:	192.168.2.466.228.32.314969770802404330 03/18/23-15:57:49.653644
SID:	2404330
Source Port:	49697
Destination Port:	7080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET CNC Feodo Tracker Reported CnC Server TCP group 7 - Source IP: 192.168.2.4 - Destination IP: 182.162.143.56

Timestamp:	192.168.2.4182.162.143.56496984432404312 03/18/23-15:58:05.445458
SID:	2404312
Source Port:	49698
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: f_00321b.dll	Virustotal: Detection: 60%			Perma Link
Source: f_00321b.dll	ReversingLabs: Detection: 79%

Antivirus detection for URL or domain

Source: https://45.235.8.30:8080/nnukk/upfurpftd/ltwomnfleb/0u	Avira URL Cloud: Label: malware
Source: https://45.235.8.30:8080/nnukk/upfurpftd/ltwomnfleb//	Avira URL Cloud: Label: malware
Source: https://213.239.212.5/~	Avira URL Cloud: Label: malware
Source: https://45.235.8.30:8080/nnukk/upfurpftd/ltwomnfleb/	Avira URL Cloud: Label: malware
Source: https://213.239.212.5/nnukk/upfurpftd/ltwomnfleb/	Avira URL Cloud: Label: malware
Source: https://119.59.103.152:8080/nnukk/upfurpftd/ltwomnfleb/	Avira URL Cloud: Label: malware
Source: https://82.223.21.224:8080/nnukk/upfurpftd/ltwomnfleb/	Avira URL Cloud: Label: malware
Source: https://107.170.39.149:8080/	Avira URL Cloud: Label: malware
Source: https://167.172.199.165:8080/Y	Avira URL Cloud: Label: malware
Source: https://82.223.21.224:8080/	Avira URL Cloud: Label: malware
Source: https://91.207.28.33:8080/-	Avira URL Cloud: Label: malware
Source: https://159.65.88.10:8080/nnukk/upfurpftd/ltwomnfleb/	Avira URL Cloud: Label: malware
Source: https://104.168.155.143:8080/nnukk/upfurpftd/ltwomnfleb/	Avira URL Cloud: Label: malware
Source: https://119.59.103.152:8080/nnukk/upfurpftd/ltwomnfleb/?	Avira URL Cloud: Label: malware
Source: https://164.90.222.65/nnukk/upfurpftd/ltwomnfleb//K	Avira URL Cloud: Label: malware
Source: https://164.90.222.65:443/nnukk/upfurpftd/ltwomnfleb/b/X	Avira URL Cloud: Label: malware
Source: https://91.121.146.47:8080/nnukk/upfurpftd/ltwomnfleb/	Avira URL Cloud: Label: malware
Source: https://107.170.39.149:8080/nnukk/upfurpftd/ltwomnfleb/	Avira URL Cloud: Label: malware
Source: https://91.121.146.47:8080/	Avira URL Cloud: Label: malware
Source: https://119.59.103.152:8080/	Avira URL Cloud: Label: malware
Source: https://119.59.103.152:8080/l/z	Avira URL Cloud: Label: malware
Source: https://167.172.199.165:8080/nnukk/upfurpftd/ltwomnfleb/	Avira URL Cloud: Label: malware
Source: https://187.63.160.88:80/nnukk/upfurpftd/ltwomnfleb/	Avira URL Cloud: Label: malware
Source: https://45.235.8.30:8080/	Avira URL Cloud: Label: malware
Source: https://167.172.199.165:8080/o	Avira URL Cloud: Label: malware
Source: https://66.228.32.31:7080/	Avira URL Cloud: Label: malware
Source: https://167.172.199.165:8080/	Avira URL Cloud: Label: malware
Source: https://164.90.222.65/nnukk/upfurpftd/ltwomnfleb/w	Avira URL Cloud: Label: malware
Source: https://164.90.222.65/nnukk/upfurpftd/ltwomnfleb/	Avira URL Cloud: Label: malware
Source: https://119.59.103.152:8080/nnukk/upfurpftd/ltwomnfleb/%	Avira URL Cloud: Label: malware
Source: https://164.90.222.65/wn	Avira URL Cloud: Label: malware
Source: https://45.235.8.30:8080/nnukk/upfurpftd/ltwomnfleb/Y	Avira URL Cloud: Label: malware
Source: https://213.239.212.5:443/nnukk/upfurpftd/ltwomnfleb/N	Avira URL Cloud: Label: malware

Source: 00000006.00000002.839010466.000000000072B000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: Emotet {"C2 list": ["91.121.146.47:8080", "66.228.32.31:7080", "182.162.143.56:443", "187.63.160.88:80", "167.172.199.165:8080", "164.90.222.65:443", "104.168.155.143:8080", "163.44.196.120:8080", "160.16.142.56:8080", "159.89.202.34:443", "159.65.88.10:8080", "186.194.240.217:443", "149.56.131.28:8080", "72.15.201.15:8080", "1.234.2.232:8080", "82.223.21.224:8080", "206.189.28.199:8080", "169.57.156.166:8080", "107.170.39.149:8080", "103.43.75.120:443", "91.207.28.33:8080", "213.239.212.5:443", "45.235.8.30:8080", "119.59.103.152:8080", "164.68.99.3:8080", "95.217.221.146:8080", "153.126.146.25:7080", "197.242.150.244:8080", "202.129.205.3:8080", "103.132.242.26:8080", "139.59.126.41:443", "110.232.117.186:8080", "183.111.227.137:8080", "5.135.159.50:443", "201.94.166.162:443", "103.75.201.2:443", "79.137.35.198:8080", "172.105.226.75:8080", "94.23.45.86:4143", "115.68.227.76:8080", "153.92.5.27:8080", "167.172.253.162:8080", "188.44.20.25:443", "147.139.166.154:8080", "129.232.188.93:443", "173.212.193.249:8080", "185.4.135.165:8080", "45.176.232.124:443"], "Public Key": ["RUNTMSAAAABAX3S2xNjcDD0fBno33Ln5t71eii+mofIPoXkNFOX1MeiwCh48iz97kB0mJjGGZXwardnDXKxI8GCHGNl0PFj50W/ClAAOAIo=", "RUNLMSAAAADzozW1Di4r9DVWzQpMKT588RDdy7BPILP6AiDOTLYMHkSWvrQO5slbmr1OvZ2Pz+AQWzRMggQmAtO6rPH7nyx2xW++lAAKAJA="]}

Source: unknown

HTTPS traffic detected: 164.90.222.65:443 -> 192.168.2.4:49704 version: TLS 1.2

Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180008D28 FindFirstFileExW,
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180008D28 FindFirstFileExW,

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\regsvr32.exe	Network Connect: 159.65.88.10 8080
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 164.90.222.65 443
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 213.239.212.5 443
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 186.194.240.217 443
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 104.168.155.143 8080
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 119.59.103.152 8080
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 159.89.202.34 443
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 160.16.142.56 8080
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 91.121.146.47 8080
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 91.207.28.33 8080
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 103.43.75.120 443
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 45.235.8.30 8080
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 72.15.201.15 8080
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 163.44.196.120 8080
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 206.189.28.199 8080
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 107.170.39.149 8080
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 187.63.160.88 80
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 66.228.32.31 7080
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 82.223.21.224 8080
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 149.56.131.28 8080
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 169.57.156.166 8080
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 182.162.143.56 443
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 1.234.2.232 8080
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 167.172.199.165 8080

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2404308 ET CNC Feodo Tracker Reported CnC Server TCP group 5 192.168.2.4:49704 -> 164.90.222.65:443
Source: Traffic	Snort IDS: 2404344 ET CNC Feodo Tracker Reported CnC Server TCP group 23 192.168.2.4:49695 -> 91.121.146.47:8080
Source: Traffic	Snort IDS: 2404330 ET CNC Feodo Tracker Reported CnC Server TCP group 16 192.168.2.4:49697 -> 66.228.32.31:7080
Source: Traffic	Snort IDS: 2404312 ET CNC Feodo Tracker Reported CnC Server TCP group 7 192.168.2.4:49698 -> 182.162.143.56:443
Source: Traffic	Snort IDS: 2404314 ET CNC Feodo Tracker Reported CnC Server TCP group 8 192.168.2.4:49702 -> 187.63.160.88:80
Source: Traffic	Snort IDS: 2404310 ET CNC Feodo Tracker Reported CnC Server TCP group 6 192.168.2.4:49703 -> 167.172.199.165:8080
Source: Traffic	Snort IDS: 2404302 ET CNC Feodo Tracker Reported CnC Server TCP group 2 192.168.2.4:49705 -> 104.168.155.143:8080
Source: Traffic	Snort IDS: 2404304 ET CNC Feodo Tracker Reported CnC Server TCP group 3 192.168.2.4:49719 -> 1.234.2.232:8080
Source: Traffic	Snort IDS: 2404318 ET CNC Feodo Tracker Reported CnC Server TCP group 10 192.168.2.4:49721 -> 206.189.28.199:8080
Source: Traffic	Snort IDS: 2404320 ET CNC Feodo Tracker Reported CnC Server TCP group 11 192.168.2.4:49729 -> 213.239.212.5:443
Source: Traffic	Snort IDS: 2404324 ET CNC Feodo Tracker Reported CnC Server TCP group 13 192.168.2.4:49733 -> 45.235.8.30:8080

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	IPs: 91.121.146.47:8080
Source: Malware configuration extractor	IPs: 66.228.32.31:7080
Source: Malware configuration extractor	IPs: 182.162.143.56:443
Source: Malware configuration extractor	IPs: 187.63.160.88:80
Source: Malware configuration extractor	IPs: 167.172.199.165:8080
Source: Malware configuration extractor	IPs: 164.90.222.65:443
Source: Malware configuration extractor	IPs: 104.168.155.143:8080
Source: Malware configuration extractor	IPs: 163.44.196.120:8080
Source: Malware configuration extractor	IPs: 160.16.142.56:8080
Source: Malware configuration extractor	IPs: 159.89.202.34:443
Source: Malware configuration extractor	IPs: 159.65.88.10:8080
Source: Malware configuration extractor	IPs: 186.194.240.217:443
Source: Malware configuration extractor	IPs: 149.56.131.28:8080
Source: Malware configuration extractor	IPs: 72.15.201.15:8080
Source: Malware configuration extractor	IPs: 1.234.2.232:8080
Source: Malware configuration extractor	IPs: 82.223.21.224:8080
Source: Malware configuration extractor	IPs: 206.189.28.199:8080
Source: Malware configuration extractor	IPs: 169.57.156.166:8080
Source: Malware configuration extractor	IPs: 107.170.39.149:8080
Source: Malware configuration extractor	IPs: 103.43.75.120:443
Source: Malware configuration extractor	IPs: 91.207.28.33:8080
Source: Malware configuration extractor	IPs: 213.239.212.5:443
Source: Malware configuration extractor	IPs: 45.235.8.30:8080
Source: Malware configuration extractor	IPs: 119.59.103.152:8080
Source: Malware configuration extractor	IPs: 164.68.99.3:8080
Source: Malware configuration extractor	IPs: 95.217.221.146:8080
Source: Malware configuration extractor	IPs: 153.126.146.25:7080
Source: Malware configuration extractor	IPs: 197.242.150.244:8080
Source: Malware configuration extractor	IPs: 202.129.205.3:8080
Source: Malware configuration extractor	IPs: 103.132.242.26:8080
Source: Malware configuration extractor	IPs: 139.59.126.41:443
Source: Malware configuration extractor	IPs: 110.232.117.186:8080
Source: Malware configuration extractor	IPs: 183.111.227.137:8080
Source: Malware configuration extractor	IPs: 5.135.159.50:443
Source: Malware configuration extractor	IPs: 201.94.166.162:443
Source: Malware configuration extractor	IPs: 103.75.201.2:443
Source: Malware configuration extractor	IPs: 79.137.35.198:8080
Source: Malware configuration extractor	IPs: 172.105.226.75:8080
Source: Malware configuration extractor	IPs: 94.23.45.86:4143
Source: Malware configuration extractor	IPs: 115.68.227.76:8080
Source: Malware configuration extractor	IPs: 153.92.5.27:8080
Source: Malware configuration extractor	IPs: 167.172.253.162:8080
Source: Malware configuration extractor	IPs: 188.44.20.25:443
Source: Malware configuration extractor	IPs: 147.139.166.154:8080
Source: Malware configuration extractor	IPs: 129.232.188.93:443
Source: Malware configuration extractor	IPs: 173.212.193.249:8080
Source: Malware configuration extractor	IPs: 185.4.135.165:8080
Source: Malware configuration extractor	IPs: 45.176.232.124:443

Source: Joe Sandbox View

ASN Name: DIGITALOCEAN-ASNUS DIGITALOCEAN-ASNUS

Source: Joe Sandbox View

JA3 fingerprint: 8916410db85077a5460817142dcbc8de

Source: global traffic

HTTP traffic detected: POST /nnukk/upfurpftd/ltwomnfleb/ HTTP/1.1Connection: Keep-AliveContent-Length: 0Host: 164.90.222.65

Source: Joe Sandbox View

IP Address: 159.65.88.10 159.65.88.10

Source: global traffic	TCP traffic: 192.168.2.4:49695 -> 91.121.146.47:8080
Source: global traffic	TCP traffic: 192.168.2.4:49697 -> 66.228.32.31:7080
Source: global traffic	TCP traffic: 192.168.2.4:49703 -> 167.172.199.165:8080
Source: global traffic	TCP traffic: 192.168.2.4:49705 -> 104.168.155.143:8080
Source: global traffic	TCP traffic: 192.168.2.4:49706 -> 163.44.196.120:8080
Source: global traffic	TCP traffic: 192.168.2.4:49707 -> 160.16.142.56:8080
Source: global traffic	TCP traffic: 192.168.2.4:49712 -> 159.65.88.10:8080
Source: global traffic	TCP traffic: 192.168.2.4:49717 -> 149.56.131.28:8080
Source: global traffic	TCP traffic: 192.168.2.4:49718 -> 72.15.201.15:8080
Source: global traffic	TCP traffic: 192.168.2.4:49719 -> 1.234.2.232:8080
Source: global traffic	TCP traffic: 192.168.2.4:49720 -> 82.223.21.224:8080
Source: global traffic	TCP traffic: 192.168.2.4:49721 -> 206.189.28.199:8080
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 169.57.156.166:8080
Source: global traffic	TCP traffic: 192.168.2.4:49723 -> 107.170.39.149:8080
Source: global traffic	TCP traffic: 192.168.2.4:49728 -> 91.207.28.33:8080
Source: global traffic	TCP traffic: 192.168.2.4:49733 -> 45.235.8.30:8080
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 119.59.103.152:8080

Source: unknown

Network traffic detected: IP country count 17

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown	TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown	TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown	TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown	TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown	TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown	TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown	TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown	TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown	TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown	TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown	TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown	TCP traffic detected without corresponding DNS query: 66.228.32.31
Source: unknown	TCP traffic detected without corresponding DNS query: 66.228.32.31
Source: unknown	TCP traffic detected without corresponding DNS query: 66.228.32.31
Source: unknown	TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown	TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown	TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown	TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown	TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown	TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown	TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown	TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown	TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown	TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown	TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown	TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown	TCP traffic detected without corresponding DNS query: 187.63.160.88
Source: unknown	TCP traffic detected without corresponding DNS query: 187.63.160.88
Source: unknown	TCP traffic detected without corresponding DNS query: 187.63.160.88
Source: unknown	TCP traffic detected without corresponding DNS query: 167.172.199.165
Source: unknown	TCP traffic detected without corresponding DNS query: 167.172.199.165
Source: unknown	TCP traffic detected without corresponding DNS query: 167.172.199.165
Source: unknown	TCP traffic detected without corresponding DNS query: 167.172.199.165
Source: unknown	TCP traffic detected without corresponding DNS query: 167.172.199.165
Source: unknown	TCP traffic detected without corresponding DNS query: 167.172.199.165
Source: unknown	TCP traffic detected without corresponding DNS query: 167.172.199.165
Source: unknown	TCP traffic detected without corresponding DNS query: 167.172.199.165
Source: unknown	TCP traffic detected without corresponding DNS query: 167.172.199.165
Source: unknown	TCP traffic detected without corresponding DNS query: 167.172.199.165
Source: unknown	TCP traffic detected without corresponding DNS query: 164.90.222.65
Source: unknown	TCP traffic detected without corresponding DNS query: 164.90.222.65
Source: unknown	TCP traffic detected without corresponding DNS query: 164.90.222.65
Source: unknown	TCP traffic detected without corresponding DNS query: 164.90.222.65
Source: unknown	TCP traffic detected without corresponding DNS query: 164.90.222.65
Source: unknown	TCP traffic detected without corresponding DNS query: 164.90.222.65
Source: unknown	TCP traffic detected without corresponding DNS query: 164.90.222.65
Source: unknown	TCP traffic detected without corresponding DNS query: 164.90.222.65
Source: unknown	TCP traffic detected without corresponding DNS query: 164.90.222.65
Source: unknown	TCP traffic detected without corresponding DNS query: 164.90.222.65

Source: regsvr32.exe, 00000006.00000003.405236343.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.490273767.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.839161422.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.490454644.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.490651926.00000000007A2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.489636970.0000000000797000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: regsvr32.exe, 00000006.00000003.403176312.00000000007F4000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.403664983.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/
Source: regsvr32.exe, 00000006.00000003.403176312.00000000007F4000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.403664983.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com//
Source: regsvr32.exe, 00000006.00000003.489636970.0000000000797000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.6.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: regsvr32.exe, 00000006.00000003.403176312.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?1bee005e237d0
Source: regsvr32.exe, 00000006.00000003.405118809.000000000075A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.490542704.000000000075A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.404596026.000000000075A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.839083307.000000000075A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/end
Source: regsvr32.exe, 00000006.00000002.839305348.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://103.44.196.120:8080/
Source: regsvr32.exe, 00000006.00000002.839483293.000000000285E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://104.168.155.143:8080/nnukk/upfurpftd/ltwomnfleb/
Source: regsvr32.exe, 00000006.00000002.839305348.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://107.170.39.149:8080/
Source: regsvr32.exe, 00000006.00000002.839483293.000000000285E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://107.170.39.149:8080/nnukk/upfurpftd/ltwomnfleb/
Source: regsvr32.exe, 00000006.00000002.839305348.00000000007F4000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.839483293.00000000027F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://119.59.103.152:8080/
Source: regsvr32.exe, 00000006.00000002.839305348.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://119.59.103.152:8080/l/z
Source: regsvr32.exe, 00000006.00000002.839161422.00000000007DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://119.59.103.152:8080/nnukk/upfurpftd/ltwomnfleb/
Source: regsvr32.exe, 00000006.00000002.839305348.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://119.59.103.152:8080/nnukk/upfurpftd/ltwomnfleb/%
Source: regsvr32.exe, 00000006.00000002.839161422.0000000000797000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://119.59.103.152:8080/nnukk/upfurpftd/ltwomnfleb/?
Source: regsvr32.exe, 00000006.00000002.839483293.000000000285E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://159.65.88.10:8080/nnukk/upfurpftd/ltwomnfleb/
Source: regsvr32.exe, 00000006.00000003.490273767.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.490542704.0000000000755000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.839161422.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.490454644.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.490651926.00000000007A2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.489636970.0000000000797000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://164.90.222.65/
Source: regsvr32.exe, 00000006.00000003.490273767.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.839161422.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.490454644.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.490651926.00000000007A2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.489636970.0000000000797000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://164.90.222.65/nnukk/upfurpftd/ltwomnfleb/
Source: regsvr32.exe, 00000006.00000003.490273767.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.490454644.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.490651926.00000000007A2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.489636970.0000000000797000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://164.90.222.65/nnukk/upfurpftd/ltwomnfleb//K
Source: regsvr32.exe, 00000006.00000003.490273767.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.839161422.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.490454644.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.490651926.00000000007A2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.489636970.0000000000797000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://164.90.222.65/nnukk/upfurpftd/ltwomnfleb/w
Source: regsvr32.exe, 00000006.00000003.489636970.0000000000797000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://164.90.222.65/wn
Source: regsvr32.exe, 00000006.00000003.489477256.000000000285E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://164.90.222.65:443/nnukk/upfurpftd/ltwomnfleb/b/X
Source: regsvr32.exe, 00000006.00000003.489636970.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://167.172.199.165:8080/
Source: regsvr32.exe, 00000006.00000003.489636970.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://167.172.199.165:8080/Y
Source: regsvr32.exe, 00000006.00000003.489636970.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://167.172.199.165:8080/nnukk/upfurpftd/ltwomnfleb/
Source: regsvr32.exe, 00000006.00000003.489636970.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://167.172.199.165:8080/o
Source: regsvr32.exe, 00000006.00000003.490542704.000000000075A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://187.172.199.165:8080/
Source: regsvr32.exe, 00000006.00000003.489636970.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.489477256.000000000285E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://187.63.160.88:80/nnukk/upfurpftd/ltwomnfleb/
Source: regsvr32.exe, 00000006.00000002.839483293.00000000027F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://189.56.131.28:8080/
Source: regsvr32.exe, 00000006.00000002.839483293.00000000027F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://21.235.8.30:8080/
Source: regsvr32.exe, 00000006.00000002.839305348.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://213.239.212.5/nnukk/upfurpftd/ltwomnfleb/
Source: regsvr32.exe, 00000006.00000002.839305348.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://213.239.212.5/~
Source: regsvr32.exe, 00000006.00000002.839483293.000000000285E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://213.239.212.5:443/nnukk/upfurpftd/ltwomnfleb/N
Source: regsvr32.exe, 00000006.00000002.839305348.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.235.8.30:8080/
Source: regsvr32.exe, 00000006.00000002.839161422.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.839305348.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.235.8.30:8080/nnukk/upfurpftd/ltwomnfleb/
Source: regsvr32.exe, 00000006.00000002.839483293.000000000285E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.235.8.30:8080/nnukk/upfurpftd/ltwomnfleb//
Source: regsvr32.exe, 00000006.00000002.839161422.00000000007DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.235.8.30:8080/nnukk/upfurpftd/ltwomnfleb/0u
Source: regsvr32.exe, 00000006.00000002.839305348.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.235.8.30:8080/nnukk/upfurpftd/ltwomnfleb/Y
Source: regsvr32.exe, 00000006.00000003.489636970.0000000000797000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://66.228.32.31:7080/
Source: regsvr32.exe, 00000006.00000002.839305348.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://82.223.21.224:8080/
Source: regsvr32.exe, 00000006.00000002.839161422.00000000007DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://82.223.21.224:8080/nnukk/upfurpftd/ltwomnfleb/
Source: regsvr32.exe, 00000006.00000002.839010466.000000000072B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://91.121.146.47:8080/
Source: regsvr32.exe, 00000006.00000002.839010466.000000000072B000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.839083307.0000000000783000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.490273767.0000000000783000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.404883022.0000000000783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://91.121.146.47:8080/nnukk/upfurpftd/ltwomnfleb/
Source: regsvr32.exe, 00000006.00000002.839305348.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://91.207.28.33:8080/-

Source: unknown

HTTP traffic detected: POST /nnukk/upfurpftd/ltwomnfleb/ HTTP/1.1Connection: Keep-AliveContent-Length: 0Host: 164.90.222.65

Source: unknown

HTTPS traffic detected: 164.90.222.65:443 -> 192.168.2.4:49704 version: TLS 1.2

E-Banking Fraud

Yara detected Emotet

Source: Yara match	File source: 00000006.00000002.839010466.000000000072B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 5.2.rundll32.exe.1caef360000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.24067ea0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.24067ea0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.regsvr32.exe.22d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.regsvr32.exe.22d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.1caef360000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.regsvr32.exe.1fe0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.regsvr32.exe.1fe0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.320583141.0000024067ED1000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.839406801.0000000002031000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.839356776.0000000001FE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.319426857.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.320938696.000001CAEF360000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.320487184.0000024067EA0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.320983303.000001CAEF391000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Windows\System32\regsvr32.exe

File deleted: C:\Windows\System32\ZbmMPnDvLqwXll\QyzgcRWJYZS.dll:Zone.Identifier

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

File created: C:\Windows\system32\ZbmMPnDvLqwXll\

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180006818
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000B878
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180007110
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180008D28
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180014555
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_022A0000
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0230263C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02308BC8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02318FC8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0230CC14
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0231A000
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0231709C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02307D6C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0230BA2C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02318A2C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02310E2C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0231662C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02304214
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0230461C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02315A00
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02328A00
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02318E08
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02303E0C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0231020C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02310A70
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02303274
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0230A660
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0230B258
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0230F65C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0231A244
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0230AAB8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02304EB8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02303ABC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0231A6BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0230BE90
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02314A90
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02308A8C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02324E8C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_023092F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_023196D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0231EAC0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0230D6CC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0230D33C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0231E310
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0230EF14
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02313B14
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02314F18
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0231D770
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0231CF70
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02308378
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0230F77C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0231E750
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02304758
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0230975C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02308FB0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0230FFB8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02318BB8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0230DBA0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02301B94
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02315384
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0230A7F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_023227EC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02313FD0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02302FD4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_023033D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_023197CC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02311030
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0231EC30
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0230B83C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0232181C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02301000
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02309408
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02307C08
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02316C70
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0230D474
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02302C78
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0230C078
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0230B07C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0231B460
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02325450
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0231C058
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02307840
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0231C44C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0231A8B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0230DCB8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_023294BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_023098AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0230AC94
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02315880
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02304C84
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0231CC84
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02303CF4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_023090F8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_023048FC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_023120E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_023014D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02313CD4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_023018DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0230F8C4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02315CC4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_023080CC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_023108CC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02307530
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0231B130
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02306138
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02314D20
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02311924
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0231AD28
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02329910
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02317518
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02328500
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0231610C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_023095BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0231BDA0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0231D5F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_023115C8
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180006818
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018000B878
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180007110
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180008D28
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180014555
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067E90000
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED263C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED7D6C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE709C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EEA000
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EDCC14
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED8BC8
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE8FC8
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EDBA2C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE8A2C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE0E2C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE662C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED3E0C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE020C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE8E08
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE5A00
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EF8A00
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED461C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED4214
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EED5F0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE15C8
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EEBDA0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED95BC
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EEAD28
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE1924
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE4D20
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED6138
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED7530
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EEB130
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE610C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EF8500
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE7518
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EF9910
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE20E0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED48FC
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED90F8
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED3CF4
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED80CC
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE08CC
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE5CC4
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EDF8C4
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED18DC
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED14D4
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE3CD4
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED98AC
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EF94BC
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EDDCB8
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EEA8B0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED4C84
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EECC84
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE5880
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EDAC94
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EEB460
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EDB07C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED2C78
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EDC078
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EDD474
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE6C70
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EEC44C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED7840
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EEC058
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EF5450
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EDB83C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE1030
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EEEC30
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED9408
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED7C08
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED1000
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EF181C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EF27EC
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EDA7F0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE97CC
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED2FD4
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED33D4
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE3FD0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EDDBA0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EDFFB8
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE8BB8
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED8FB0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE5384
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED1B94
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EDF77C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED8378
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EED770
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EECF70
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED975C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED4758
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EEE750
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EDD33C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE4F18
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EDEF14
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE3B14
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EEE310
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED92F0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EDD6CC
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EEEAC0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE96D4
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED3ABC
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EEA6BC
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EDAAB8
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED4EB8
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED8A8C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EF4E8C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EDBE90
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE4A90
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EDA660
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED3274
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE0A70
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EEA244
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EDF65C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EDB258
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF350000
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3A8FC8
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF398BC8
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3AA000
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF39CC14
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF39263C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3A709C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF397D6C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF39FFB8
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3A8BB8
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF398FB0
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF39DBA0
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF391B94
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF399408
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF397C08
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF391000
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3B27EC
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF39A7F0
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF392FD4
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3933D4
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3A97CC
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3A3FD0
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF39B83C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF397840
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3A1030
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3AEC30
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3B181C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3ACC84
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF394C84
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF39B07C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3A5880
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF39D474
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF392C78
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF39C078
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3A6C70
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3AB460
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3AC058
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3AC44C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3B5450
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3AA6BC
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF393ABC
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3AEAC0
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF39AAB8
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF394EB8
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3B4E8C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF398A8C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3A4A90
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF39BE90
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3992F0
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3A96D4
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF39D6CC
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF39D33C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF39EF14
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3A3B14
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3A4F18
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3AE310
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3A5384
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF39F77C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF398378
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3AD770
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3ACF70
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF39975C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF394758
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3AE750
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3A15C8
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3995BC
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3ABDA0
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3A8E08
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3A5A00
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3B8A00
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3AD5F0
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3AA244
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3A8A2C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3A0E2C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3A662C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF39BA2C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF39461C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF394214
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3A020C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF393E0C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF393274
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3A0A70
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF39F65C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF39A660
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF39B258
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3A5CC4
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF39F8C4
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3B94BC
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF39DCB8
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3998AC
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3AA8B0
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF39AC94
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3948FC
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3B8500
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF393CF4
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3990F8
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3918DC
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3A20E0
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3A3CD4
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3914D4
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3A08CC
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3980CC
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF396138
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3AB130
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF397530
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3A1924
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3AAD28
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3A4D20
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3A7518
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3A610C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3B9910
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_01FD0000
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02050618
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02036E42
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02039B79
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_020573A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02038BC8
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02048FC8
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02043FD0
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_020363F4
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0203640A
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0203CC14
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_020408CC
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02037D6C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02045A00
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02058A00
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0204020C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02048E08
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02033E0C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02034214
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0203461C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02048A2C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02040E2C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0204662C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0203BA2C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0203263C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0204A244
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02056E48
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0203B258
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0203F65C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0203A660
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02040A70
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02033274
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02052E84
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02054E8C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02038A8C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0203BE90
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02044A90
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02052AB0
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0204A6BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02047EBE
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0203AAB8
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02034EB8
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02033ABC
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0204EAC0
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0203D6CC
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_020496D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_020392F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_020536FC
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02043B14
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0204E310
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02058310
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0203EF14
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02055B1C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02044F18
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0203D33C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0204E750
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02034758
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0203975C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02058B68
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0204D770
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0204CF70
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02038378
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0203F77C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02045384
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02031B94
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0204779A
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0203DBA0
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_020547A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02038FB0
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0203FFB8
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02048BB8
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_020497CC
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02032FD4
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_020333D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_020527EC
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0203A7F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0204FFFC
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02031000
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0204A000
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02039408
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02037C08
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02037410
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0205181C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02041030
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0204EC30
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0203B83C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02037840
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0204C44C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02055450
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0204C058
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0204B460
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02055868
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02046C70
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0203D474
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02032C78
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0203C078
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0203B07C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0204CC84
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02045880
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02034C84
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0205488C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02051494
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0203AC94
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0204709C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_020544A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_020398AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0204A8B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_020594BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0203DCB8
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02045CC4
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0203F8C4
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_020380CC
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02043CD4
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02051CD4
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_020314D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_020318DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_020420E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02033CF4
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_020390F8
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_020348FC
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02058500
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02052100
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0204610C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02059910
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02047518
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02041924
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02044D20
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0204AD28
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0204B130
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02036138
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02054D64
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0204BDA0
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_020395BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_020415C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0204D5F0

Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180010C10 LdrFindResource_U,LdrAccessResource,NtAllocateVirtualMemory,
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180010AC0 ExitProcess,RtlQueueApcWow64Thread,NtTestAlert,
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180010DB0 ZwOpenSymbolicLinkObject,ZwOpenSymbolicLinkObject,
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180010C10 LdrFindResource_U,LdrAccessResource,NtAllocateVirtualMemory,
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180010AC0 ExitProcess,RtlQueueApcWow64Thread,NtTestAlert,
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180010DB0 ZwOpenSymbolicLinkObject,ZwOpenSymbolicLinkObject,

Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll

Source: f_00321b.dll	Virustotal: Detection: 60%
Source: f_00321b.dll	ReversingLabs: Detection: 79%

Source: f_00321b.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\f_00321b.dll"
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\f_00321b.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\f_00321b.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\f_00321b.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\f_00321b.dll,DllRegisterServer
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ZbmMPnDvLqwXll\QyzgcRWJYZS.dll"
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\RymKYMmySRfU\EAqrfXJOpHznppsf.dll"
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\IzuSuDitBV\QmEREbzuu.dll"
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\f_00321b.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\f_00321b.dll
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\f_00321b.dll,DllRegisterServer
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\f_00321b.dll",#1
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ZbmMPnDvLqwXll\QyzgcRWJYZS.dll"
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\RymKYMmySRfU\EAqrfXJOpHznppsf.dll"
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\IzuSuDitBV\QmEREbzuu.dll"

Source: C:\Windows\System32\regsvr32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Source: classification engine

Classification label: mal100.troj.evad.winDLL@17/2@0/48

Source: C:\Windows\System32\regsvr32.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

Code function: 3_2_02308BC8 Process32NextW,Process32FirstW,CreateToolhelp32Snapshot,FindCloseChangeNotification,

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\f_00321b.dll",#1

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2516:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5432:120:WilError_01

Source: C:\Windows\System32\regsvr32.exe

File read: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe	Automated click: OK
Source: C:\Windows\System32\regsvr32.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: f_00321b.dll

Static PE information: Image base 0x180000000 > 0x60000000

Source: f_00321b.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: f_00321b.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: f_00321b.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: f_00321b.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: f_00321b.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: f_00321b.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: f_00321b.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: f_00321b.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: f_00321b.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: f_00321b.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: f_00321b.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: f_00321b.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180005C69 push rdi; ret
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800056DD push rdi; ret
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0230A26E push ebp; ret
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02317EAF push 458BCC5Ah; retf
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02309E8B push eax; retf
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0231C731 push esi; iretd
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02306C9F pushad ; ret
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0230A0FC push ebp; iretd
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_023180D7 push ebp; retf
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02306CDE push esi; iretd
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02317D3C push ebp; retf
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02317D25 push 4D8BFFFFh; retf
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02309D51 push ebp; retf
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02318157 push ebp; retf
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02317D4E push ebp; iretd
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02317987 push ebp; iretd
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0230A1D2 push ebp; iretd
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180005C69 push rdi; ret
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000001800056DD push rdi; ret
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EDA1D2 push ebp; iretd
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE7987 push ebp; iretd
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE7D4E push ebp; iretd
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE8157 push ebp; retf
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED9D51 push ebp; retf
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE7D25 push 4D8BFFFFh; retf
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE7D3C push ebp; retf
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EDA0FC push ebp; iretd
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED6CDE push esi; iretd
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE80D7 push ebp; retf
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED6C9F pushad ; ret
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EEC731 push esi; iretd

Source: f_00321b.dll

Static PE information: section name: _RDATA

Source: C:\Windows\System32\loaddll64.exe

Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\f_00321b.dll

Source: C:\Windows\System32\regsvr32.exe

PE file moved: C:\Windows\System32\ZbmMPnDvLqwXll\QyzgcRWJYZS.dll

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\System32\regsvr32.exe	File opened: C:\Windows\system32\ZbmMPnDvLqwXll\QyzgcRWJYZS.dll:Zone.Identifier read attributes \| delete
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\system32\RymKYMmySRfU\EAqrfXJOpHznppsf.dll:Zone.Identifier read attributes \| delete
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\system32\IzuSuDitBV\QmEREbzuu.dll:Zone.Identifier read attributes \| delete

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\regsvr32.exe TID: 5164

Thread sleep time: -660000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\regsvr32.exe

API coverage: 9.3 %

Source: C:\Windows\System32\regsvr32.exe

Process information queried: ProcessInformation

Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180008D28 FindFirstFileExW,
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180008D28 FindFirstFileExW,

Source: C:\Windows\System32\regsvr32.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\rundll32.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\rundll32.exe	File Volume queried: C:\ FullSizeInformation

Source: regsvr32.exe, 00000006.00000003.405236343.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.490273767.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.839161422.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.490454644.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.489636970.0000000000797000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWN
Source: regsvr32.exe, 00000006.00000003.405236343.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.490273767.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.490273767.000000000074B000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.839161422.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.490454644.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.489636970.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.404596026.000000000074B000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.839083307.000000000074B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: rundll32.exe, 00000004.00000003.318175405.0000024067CAE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Windows\System32\regsvr32.exe

Code function: 3_2_0000000180001C48 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

Source: C:\Windows\System32\regsvr32.exe

Code function: 3_2_000000018000A878 GetProcessHeap,

Source: C:\Windows\System32\loaddll64.exe

Process queried: DebugPort

Source: C:\Windows\System32\regsvr32.exe

Code function: 3_2_0000000180010C10 LdrFindResource_U,LdrAccessResource,NtAllocateVirtualMemory,

Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180001C48 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800082EC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800017DC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180001C48 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000001800082EC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000001800017DC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

HIPS / PFW / Operating System Protection Evasion

Early bird code injection technique detected

Source: C:\Windows\System32\cmd.exe

Process created / APC Queued / Resumed: C:\Windows\System32\rundll32.exe

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\regsvr32.exe	Network Connect: 159.65.88.10 8080
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 164.90.222.65 443
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 213.239.212.5 443
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 186.194.240.217 443
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 104.168.155.143 8080
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 119.59.103.152 8080
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 159.89.202.34 443
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 160.16.142.56 8080
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 91.121.146.47 8080
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 91.207.28.33 8080
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 103.43.75.120 443
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 45.235.8.30 8080
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 72.15.201.15 8080
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 163.44.196.120 8080
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 206.189.28.199 8080
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 107.170.39.149 8080
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 187.63.160.88 80
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 66.228.32.31 7080
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 82.223.21.224 8080
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 149.56.131.28 8080
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 169.57.156.166 8080
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 182.162.143.56 443
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 1.234.2.232 8080
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 167.172.199.165 8080

Queues an APC in another process (thread injection)

Source: C:\Windows\System32\regsvr32.exe

Thread APC queued: target process: C:\Windows\System32\rundll32.exe

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\f_00321b.dll",#1

Source: C:\Windows\System32\regsvr32.exe

Queries volume information: C:\ VolumeInformation

Source: C:\Windows\System32\regsvr32.exe

Code function: 3_2_00000001800070A0 cpuid

Source: C:\Windows\System32\regsvr32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: C:\Windows\System32\regsvr32.exe

Code function: 3_2_0000000180001D98 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

Stealing of Sensitive Information

Yara detected Emotet

Source: Yara match	File source: 00000006.00000002.839010466.000000000072B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 5.2.rundll32.exe.1caef360000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.24067ea0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.24067ea0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.regsvr32.exe.22d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.regsvr32.exe.22d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.1caef360000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.regsvr32.exe.1fe0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.regsvr32.exe.1fe0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.320583141.0000024067ED1000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.839406801.0000000002031000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.839356776.0000000001FE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.319426857.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.320938696.000001CAEF360000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.320487184.0000024067EA0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.320983303.000001CAEF391000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	311 Process Injection	2 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	11 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	2 Virtualization/Sandbox Evasion	LSASS Memory	31 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	311 Process Injection	Security Account Manager	2 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Hidden Files and Directories	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	12 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Regsvr32	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Rundll32	DCSync	24 System Information Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	1 File Deletion	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
f_00321b.dll	60%	Virustotal		Browse
f_00321b.dll	79%	ReversingLabs	Win64.Trojan.Emotet

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
5.2.rundll32.exe.1caef360000.1.unpack	100%	Avira	HEUR/AGEN.1215476	Download File
4.2.rundll32.exe.24067ea0000.1.unpack	100%	Avira	HEUR/AGEN.1215476	Download File
3.2.regsvr32.exe.22d0000.0.unpack	100%	Avira	HEUR/AGEN.1215476	Download File
6.2.regsvr32.exe.1fe0000.0.unpack	100%	Avira	HEUR/AGEN.1215476	Download File

Domains

Source	Detection	Scanner	Label	Link
c-0001.c-msedge.net	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
https://164.90.222.65/	0%	URL Reputation	safe
https://45.235.8.30:8080/nnukk/upfurpftd/ltwomnfleb/0u	100%	Avira URL Cloud	malware
https://45.235.8.30:8080/nnukk/upfurpftd/ltwomnfleb//	100%	Avira URL Cloud	malware
https://213.239.212.5/~	100%	Avira URL Cloud	malware
https://45.235.8.30:8080/nnukk/upfurpftd/ltwomnfleb/	100%	Avira URL Cloud	malware
https://21.235.8.30:8080/	0%	Avira URL Cloud	safe
https://213.239.212.5/nnukk/upfurpftd/ltwomnfleb/	100%	Avira URL Cloud	malware
https://119.59.103.152:8080/nnukk/upfurpftd/ltwomnfleb/	100%	Avira URL Cloud	malware
https://82.223.21.224:8080/nnukk/upfurpftd/ltwomnfleb/	100%	Avira URL Cloud	malware
https://107.170.39.149:8080/	100%	Avira URL Cloud	malware
https://167.172.199.165:8080/Y	100%	Avira URL Cloud	malware
https://82.223.21.224:8080/	100%	Avira URL Cloud	malware
https://91.207.28.33:8080/-	100%	Avira URL Cloud	malware
https://159.65.88.10:8080/nnukk/upfurpftd/ltwomnfleb/	100%	Avira URL Cloud	malware
https://104.168.155.143:8080/nnukk/upfurpftd/ltwomnfleb/	100%	Avira URL Cloud	malware
https://119.59.103.152:8080/nnukk/upfurpftd/ltwomnfleb/?	100%	Avira URL Cloud	malware
https://164.90.222.65/nnukk/upfurpftd/ltwomnfleb//K	100%	Avira URL Cloud	malware
https://164.90.222.65:443/nnukk/upfurpftd/ltwomnfleb/b/X	100%	Avira URL Cloud	malware
https://91.121.146.47:8080/nnukk/upfurpftd/ltwomnfleb/	100%	Avira URL Cloud	malware
https://189.56.131.28:8080/	0%	Avira URL Cloud	safe
https://107.170.39.149:8080/nnukk/upfurpftd/ltwomnfleb/	100%	Avira URL Cloud	malware
https://91.121.146.47:8080/	100%	Avira URL Cloud	malware
https://119.59.103.152:8080/	100%	Avira URL Cloud	malware
https://119.59.103.152:8080/l/z	100%	Avira URL Cloud	malware
https://187.172.199.165:8080/	0%	Avira URL Cloud	safe
https://167.172.199.165:8080/nnukk/upfurpftd/ltwomnfleb/	100%	Avira URL Cloud	malware
https://187.63.160.88:80/nnukk/upfurpftd/ltwomnfleb/	100%	Avira URL Cloud	malware
https://45.235.8.30:8080/	100%	Avira URL Cloud	malware
https://167.172.199.165:8080/o	100%	Avira URL Cloud	malware
https://66.228.32.31:7080/	100%	Avira URL Cloud	malware
https://167.172.199.165:8080/	100%	Avira URL Cloud	malware
https://164.90.222.65/nnukk/upfurpftd/ltwomnfleb/w	100%	Avira URL Cloud	malware
https://164.90.222.65/nnukk/upfurpftd/ltwomnfleb/	100%	Avira URL Cloud	malware
https://103.44.196.120:8080/	0%	Avira URL Cloud	safe
https://119.59.103.152:8080/nnukk/upfurpftd/ltwomnfleb/%	100%	Avira URL Cloud	malware
https://164.90.222.65/wn	100%	Avira URL Cloud	malware
https://45.235.8.30:8080/nnukk/upfurpftd/ltwomnfleb/Y	100%	Avira URL Cloud	malware
https://213.239.212.5:443/nnukk/upfurpftd/ltwomnfleb/N	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
c-0001.c-msedge.net	13.107.4.50	true	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://164.90.222.65/nnukk/upfurpftd/ltwomnfleb/	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://45.235.8.30:8080/nnukk/upfurpftd/ltwomnfleb//	regsvr32.exe, 00000006.00000002.839483293.000000000285E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://45.235.8.30:8080/nnukk/upfurpftd/ltwomnfleb/0u	regsvr32.exe, 00000006.00000002.839161422.00000000007DE000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://167.172.199.165:8080/Y	regsvr32.exe, 00000006.00000003.489636970.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://213.239.212.5/~	regsvr32.exe, 00000006.00000002.839305348.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://45.235.8.30:8080/nnukk/upfurpftd/ltwomnfleb/	regsvr32.exe, 00000006.00000002.839161422.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.839305348.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://119.59.103.152:8080/nnukk/upfurpftd/ltwomnfleb/	regsvr32.exe, 00000006.00000002.839161422.00000000007DE000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://21.235.8.30:8080/	regsvr32.exe, 00000006.00000002.839483293.00000000027F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://164.90.222.65/	regsvr32.exe, 00000006.00000003.490273767.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.490542704.0000000000755000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.839161422.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.490454644.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.490651926.00000000007A2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.489636970.0000000000797000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://213.239.212.5/nnukk/upfurpftd/ltwomnfleb/	regsvr32.exe, 00000006.00000002.839305348.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://82.223.21.224:8080/	regsvr32.exe, 00000006.00000002.839305348.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://107.170.39.149:8080/	regsvr32.exe, 00000006.00000002.839305348.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://82.223.21.224:8080/nnukk/upfurpftd/ltwomnfleb/	regsvr32.exe, 00000006.00000002.839161422.00000000007DE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://91.207.28.33:8080/-	regsvr32.exe, 00000006.00000002.839305348.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://159.65.88.10:8080/nnukk/upfurpftd/ltwomnfleb/	regsvr32.exe, 00000006.00000002.839483293.000000000285E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://164.90.222.65/nnukk/upfurpftd/ltwomnfleb//K	regsvr32.exe, 00000006.00000003.490273767.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.490454644.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.490651926.00000000007A2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.489636970.0000000000797000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://104.168.155.143:8080/nnukk/upfurpftd/ltwomnfleb/	regsvr32.exe, 00000006.00000002.839483293.000000000285E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://119.59.103.152:8080/nnukk/upfurpftd/ltwomnfleb/?	regsvr32.exe, 00000006.00000002.839161422.0000000000797000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://164.90.222.65:443/nnukk/upfurpftd/ltwomnfleb/b/X	regsvr32.exe, 00000006.00000003.489477256.000000000285E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://91.121.146.47:8080/nnukk/upfurpftd/ltwomnfleb/	regsvr32.exe, 00000006.00000002.839010466.000000000072B000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.839083307.0000000000783000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.490273767.0000000000783000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.404883022.0000000000783000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://189.56.131.28:8080/	regsvr32.exe, 00000006.00000002.839483293.00000000027F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://107.170.39.149:8080/nnukk/upfurpftd/ltwomnfleb/	regsvr32.exe, 00000006.00000002.839483293.000000000285E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://119.59.103.152:8080/	regsvr32.exe, 00000006.00000002.839305348.00000000007F4000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.839483293.00000000027F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://119.59.103.152:8080/l/z	regsvr32.exe, 00000006.00000002.839305348.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://91.121.146.47:8080/	regsvr32.exe, 00000006.00000002.839010466.000000000072B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://187.172.199.165:8080/	regsvr32.exe, 00000006.00000003.490542704.000000000075A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://167.172.199.165:8080/nnukk/upfurpftd/ltwomnfleb/	regsvr32.exe, 00000006.00000003.489636970.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://187.63.160.88:80/nnukk/upfurpftd/ltwomnfleb/	regsvr32.exe, 00000006.00000003.489636970.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.489477256.000000000285E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://45.235.8.30:8080/	regsvr32.exe, 00000006.00000002.839305348.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://167.172.199.165:8080/o	regsvr32.exe, 00000006.00000003.489636970.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://66.228.32.31:7080/	regsvr32.exe, 00000006.00000003.489636970.0000000000797000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://167.172.199.165:8080/	regsvr32.exe, 00000006.00000003.489636970.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://119.59.103.152:8080/nnukk/upfurpftd/ltwomnfleb/%	regsvr32.exe, 00000006.00000002.839305348.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://164.90.222.65/nnukk/upfurpftd/ltwomnfleb/w	regsvr32.exe, 00000006.00000003.490273767.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.839161422.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.490454644.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.490651926.00000000007A2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.489636970.0000000000797000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://164.90.222.65/wn	regsvr32.exe, 00000006.00000003.489636970.0000000000797000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://103.44.196.120:8080/	regsvr32.exe, 00000006.00000002.839305348.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://45.235.8.30:8080/nnukk/upfurpftd/ltwomnfleb/Y	regsvr32.exe, 00000006.00000002.839305348.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://213.239.212.5:443/nnukk/upfurpftd/ltwomnfleb/N	regsvr32.exe, 00000006.00000002.839483293.000000000285E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
159.65.88.10	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
172.105.226.75	unknown	United States	63949	LINODE-APLinodeLLCUS	true
164.90.222.65	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
110.232.117.186	unknown	Australia	56038	RACKCORP-APRackCorpAU	true
213.239.212.5	unknown	Germany	24940	HETZNER-ASDE	true
5.135.159.50	unknown	France	16276	OVHFR	true
186.194.240.217	unknown	Brazil	262733	NetceteraTelecomunicacoesLtdaBR	true
103.132.242.26	unknown	India	45117	INPL-IN-APIshansNetworkIN	true
104.168.155.143	unknown	United States	54290	HOSTWINDSUS	true
119.59.103.152	unknown	Thailand	56067	METRABYTE-TH453LadplacoutJorakhaebuaTH	true
79.137.35.198	unknown	France	16276	OVHFR	true
159.89.202.34	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
91.121.146.47	unknown	France	16276	OVHFR	true
160.16.142.56	unknown	Japan	9370	SAKURA-BSAKURAInternetIncJP	true
201.94.166.162	unknown	Brazil	28573	CLAROSABR	true
91.207.28.33	unknown	Kyrgyzstan	39819	PROHOSTKG	true
103.75.201.2	unknown	Thailand	133496	CDNPLUSCOLTD-AS-APCDNPLUSCOLTDTH	true
103.43.75.120	unknown	Japan	20473	AS-CHOOPAUS	true
115.68.227.76	unknown	Korea Republic of	38700	SMILESERV-AS-KRSMILESERVKR	true
188.44.20.25	unknown	Macedonia	57374	GIV-ASMK	true
45.235.8.30	unknown	Brazil	267405	WIKINETTELECOMUNICACOESBR	true
153.126.146.25	unknown	Japan	7684	SAKURA-ASAKURAInternetIncJP	true
72.15.201.15	unknown	United States	13649	ASN-VINSUS	true
163.44.196.120	unknown	Singapore	135161	GMO-Z-COM-THGMO-ZcomNetDesignHoldingsCoLtdSG	true
206.189.28.199	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
107.170.39.149	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
66.228.32.31	unknown	United States	63949	LINODE-APLinodeLLCUS	true
187.63.160.88	unknown	Brazil	28169	BITCOMPROVEDORDESERVICOSDEINTERNETLTDABR	true
82.223.21.224	unknown	Spain	8560	ONEANDONE-ASBrauerstrasse48DE	true
197.242.150.244	unknown	South Africa	37611	AfrihostZA	true
173.212.193.249	unknown	Germany	51167	CONTABODE	true
185.4.135.165	unknown	Greece	199246	TOPHOSTGR	true
183.111.227.137	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	true
45.176.232.124	unknown	Colombia	267869	CABLEYTELECOMUNICACIONESDECOLOMBIASASCABLETELCOC	true
95.217.221.146	unknown	Germany	24940	HETZNER-ASDE	true
149.56.131.28	unknown	Canada	16276	OVHFR	true
169.57.156.166	unknown	United States	36351	SOFTLAYERUS	true
164.68.99.3	unknown	Germany	51167	CONTABODE	true
182.162.143.56	unknown	Korea Republic of	3786	LGDACOMLGDACOMCorporationKR	true
139.59.126.41	unknown	Singapore	14061	DIGITALOCEAN-ASNUS	true
1.234.2.232	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	true
167.172.253.162	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
129.232.188.93	unknown	South Africa	37153	xneeloZA	true
167.172.199.165	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
202.129.205.3	unknown	Thailand	45328	NIPA-AS-THNIPATECHNOLOGYCOLTDTH	true
147.139.166.154	unknown	United States	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	true
153.92.5.27	unknown	Germany	47583	AS-HOSTINGERLT	true
94.23.45.86	unknown	France	16276	OVHFR	true

General Information

Joe Sandbox Version:	37.0.0 Beryl
Analysis ID:	829552
Start date and time:	2023-03-18 15:56:02 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 56s
Hypervisor based Inspection enabled:	false
Report type:	light
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	f_00321b.dll (renamed file extension from none to dll, renamed because original name is a hash value)
Original Sample Name:	f_00321b
Detection:	MAL
Classification:	mal100.troj.evad.winDLL@17/2@0/48
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 50.2% (good quality ratio 42.4%) Quality average: 60.5% Quality standard deviation: 35.6%
HCA Information:	Successful, ratio: 84% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Override analysis time to 240s for rundll32

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, WMIADAP.exe, backgroundTaskHost.exe
TCP Packets have been reduced to 100
Excluded IPs from analysis (whitelisted): 13.107.4.50
Excluded domains from analysis (whitelisted): ctldl.windowsupdate.com, wu-bg-shim.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
15:57:44	API Interceptor	23x Sleep call for process: regsvr32.exe modified

Process:	C:\Windows\System32\regsvr32.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 62582 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	62582
Entropy (8bit):	7.996063107774368
Encrypted:	true
SSDEEP:	1536:Jk3XPi43VgGp0gB2itudTSRAn/TWTdWftu:CHa43V5p022iZ4CgA
MD5:	E71C8443AE0BC2E282C73FAEAD0A6DD3
SHA1:	0C110C1B01E68EDFACAEAE64781A37B1995FA94B
SHA-256:	95B0A5ACC5BF70D3ABDFD091D0C9F9063AA4FDE65BD34DBF16786082E1992E72
SHA-512:	B38458C7FA2825AFB72794F374827403D5946B1132E136A0CE075DFD351277CF7D957C88DC8A1E4ADC3BCAE1FA8010DAE3831E268E910D517691DE24326391A6
Malicious:	false
Preview:	MSCF....v.......,...................I.................BVrl .authroot.stl....oJ5..CK..8U....a..3.1.P. J.".t..2F2e.dHH......$E.KB.2D..-SJE....^..'..y.}..,{m.....\...]4.G.......h....148...e.gr.....48:.L...g.....Xef.x:..t...J...6-....kW6Z>....&......ye.U.Q&z:.vZ..._....a...]..T.E.....B.h.,...[....V.O.3..EW.x.?.Q..$.@.W..=.B.f..8a.Y.JK..g./%p..C.4CD.s..Jd.u..@.g=...a.. .h%..'.xjy7.E..\.....A..':.4TdW?Ko3$.Hg.z.d~....../q..C.....`...A[ W(.........9...GZ.;....l&?........F...p?... .p.....{S.L4..v.+...7.T?.....p..`..&..9.......f...0+.L.....1.2b)..vX5L'.~....2vz.,E.Ni.{#...o..w.?.#.3..h.v<.S%.].tD@!Le.w.q.7.8....QW.FT.....hE.........Y............./.%Q...k....Y.n..v.A..../...>B..5\..-Ko.......O<.b.K.{.O.b...._.7...4.;%9N..K.X>......kg-9..r.c.g.G\|.[.-...HT...",?.q...ad....7RE.......!f..#../....?.-.^.K.c^...+{.g......]<..$.=.O....ii7.wJ+S..Z..d.....>..J*...T..Q7..`.r,<$....\d:K`..T.n....N.....C..j.;.1SX..j....1...R....+....Yg....]....3..9..S..D..`.

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\System32\regsvr32.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.123641537625697
Encrypted:	false
SSDEEP:	6:kKOry/7UN+SkQlPlEGYRMY9z+4KlDA3RUecZUt:mCvkPlE99SNxAhUext
MD5:	1D721B64039DC653E2772556CCB02D45
SHA1:	804188A5F346A929ADFE4618FBE24CDF9BB0C38F
SHA-256:	10F85BCAB9F99A4D5BF26EA9A275348685020D302B71C4CAF4ABB46EA66940B4
SHA-512:	BAC9FCC93AD14D431147EDBB4C1986839274A47B1E53BF0C9085F445AD6B8B654F51DAC40E21ADD3F44F66FA891C1C6C7471B75159D7BF3A3AAF68866BE25CB8
Malicious:	false
Preview:	p...... ........9....Y..(....................................................... ..........).K......&...........v...h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".0.d.2.f.9.2.9.a.7.4.b.d.9.1.:.0."...

Static File Info

General

File type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy (8bit):	7.337848702590508
TrID:	Win64 Dynamic Link Library (generic) (102004/3) 86.43% Win64 Executable (generic) (12005/4) 10.17% Generic Win/DOS Executable (2004/3) 1.70% DOS Executable Generic (2002/1) 1.70% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.01%
File name:	f_00321b.dll
File size:	316928
MD5:	bfc060937dc90b273eccb6825145f298
SHA1:	c156c00c7e918f0cb7363614fb1f177c90d8108a
SHA256:	2f39c2879989ddd7f9ecf52b6232598e5595f8bf367846ff188c9dfbf1251253
SHA512:	cc1fee19314b0a0f9e292fa84f6e98f087033d77db937848dda1da0c88f49997866cba5465df04bf929b810b42fdb81481341064c4565c9b6272fa7f3b473ac5
SSDEEP:	6144:cwNQMQTlfdUPABVy559hhR3iP7TfPYbrF1EFVw0todxKROsCt:rNbadDBkZ6rPeEFizdxxsCt
TLSH:	2C649D47E2A601E7FC62763DA0734708A766B0524314EB5F02B04F5B2F637A3FD5AA25
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L`.=...n...n...nCy.o...nCy.o...nCy.o...n.z.o(..n.z.o...n.z.o...nCy.o...n...nq..n.z.o...n.z.o...n.zsn...n...n...n.z.o...nRich...

File Icon


Icon Hash:	74f0e4ecccdce0e4

Static PE Info

General

Entrypoint:	0x18000179c
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x180000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, DLL
DLL Characteristics:	HIGH_ENTROPY_VA, NX_COMPAT
Time Stamp:	0x640B360F [Fri Mar 10 13:52:15 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	abb9300283e542fb453de5c4c87cd55d

Entrypoint Preview

Instruction
dec eax
mov dword ptr [esp+08h], ebx
dec eax
mov dword ptr [esp+10h], esi
push edi
dec eax
sub esp, 20h
dec ecx
mov edi, eax
mov ebx, edx
dec eax
mov esi, ecx
cmp edx, 01h
jne 00007FDE20B6DC67h
call 00007FDE20B6E240h
dec esp
mov eax, edi
mov edx, ebx
dec eax
mov ecx, esi
dec eax
mov ebx, dword ptr [esp+30h]
dec eax
mov esi, dword ptr [esp+38h]
dec eax
add esp, 20h
pop edi
jmp 00007FDE20B6DAF4h
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
xor ecx, ecx
call dword ptr [00014903h]
dec eax
mov ecx, ebx
call dword ptr [000148F2h]
call dword ptr [000148FCh]
dec eax
mov ecx, eax
mov edx, C0000409h
dec eax
add esp, 20h
pop ebx
dec eax
jmp dword ptr [000148F0h]
dec eax
mov dword ptr [esp+08h], ecx
dec eax
sub esp, 38h
mov ecx, 00000017h
call dword ptr [000148E4h]
test eax, eax
je 00007FDE20B6DC69h
mov ecx, 00000002h
int 29h
dec eax
lea ecx, dword ptr [0002038Ah]
call 00007FDE20B6DE2Eh
dec eax
mov eax, dword ptr [esp+38h]
dec eax
mov dword ptr [00020471h], eax
dec eax
lea eax, dword ptr [esp+38h]
dec eax
add eax, 08h
dec eax
mov dword ptr [00020401h], eax
dec eax
mov eax, dword ptr [0002045Ah]
dec eax
mov dword ptr [000202CBh], eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x1f910	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1f964	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x26000	0x2bd28	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x23000	0x11a0	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x52000	0x684	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1e1b0	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1e070	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x16000	0x360	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x14415	0x14600	False	0.5082438650306749	data	6.388870950832575	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x16000	0xa4b4	0xa600	False	0.4210749246987952	data	4.746360898517369	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x21000	0x1ea4	0xc00	False	0.1513671875	DOS executable (block device driver \322f\324\377\3772)	2.0951973339816368	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x23000	0x11a0	0x1200	False	0.4715711805555556	data	4.892908366942992	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x25000	0x15c	0x200	False	0.408203125	data	2.8023223995708944	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x26000	0x2bd28	0x2be00	False	0.8690349002849003	data	7.841437382818367	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x52000	0x684	0x800	False	0.51708984375	data	4.920748452777265	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
LXGUM	0x26130	0xa2c	data	English	United States
LXGUM	0x26b60	0x2b000	data	English	United States
RT_STRING	0x51b60	0x48	data	English	United States
RT_MANIFEST	0x51ba8	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States

Imports

DLL	Import
KERNEL32.dll	SetFilePointerEx, GetConsoleMode, GetConsoleOutputCP, WriteFile, FlushFileBuffers, SetStdHandle, HeapSize, GetStringTypeW, GetFileType, GetStdHandle, GetProcessHeap, CreateFileW, CloseHandle, WriteConsoleW, ExitProcess, HeapReAlloc, GetLastError, LCMapStringW, FlsFree, FlsSetValue, FlsGetValue, FlsAlloc, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwindEx, InterlockedFlushSList, SetLastError, EncodePointer, RaiseException, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, RtlPcToFileHeader, GetModuleHandleExW, GetModuleFileNameW, HeapAlloc, HeapFree, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, MultiByteToWideChar, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW
USER32.dll	GetGestureInfo, InvalidateRect, ScreenToClient, CloseGestureInfoHandle, EndPaint, BeginPaint, UpdateWindow, PostQuitMessage, LoadCursorW, GetMessageW, DefWindowProcW, DestroyWindow, CreateWindowExW, RegisterClassExW, LoadStringW, ShowWindow, DispatchMessageW, SetGestureConfig, TranslateAcceleratorW, TranslateMessage
GDI32.dll	Polyline, LineTo, CreatePen, MoveToEx, DeleteObject, SelectObject
ntdll.dll	NtQueueApcThread, ZwOpenSymbolicLinkObject, LdrFindResource_U, NtAllocateVirtualMemory, NtTestAlert, LdrAccessResource, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind

Exports

Name	Ordinal	Address
DllRegisterServer	1	0x180010a70

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.4213.239.212.5497294432404320 03/18/23-16:00:53.457464	TCP	2404320	ET CNC Feodo Tracker Reported CnC Server TCP group 11	49729	443	192.168.2.4	213.239.212.5
192.168.2.4104.168.155.1434970580802404302 03/18/23-15:58:29.445426	TCP	2404302	ET CNC Feodo Tracker Reported CnC Server TCP group 2	49705	8080	192.168.2.4	104.168.155.143
192.168.2.445.235.8.304973380802404324 03/18/23-16:00:58.958124	TCP	2404324	ET CNC Feodo Tracker Reported CnC Server TCP group 13	49733	8080	192.168.2.4	45.235.8.30
192.168.2.4167.172.199.1654970380802404310 03/18/23-15:58:19.699415	TCP	2404310	ET CNC Feodo Tracker Reported CnC Server TCP group 6	49703	8080	192.168.2.4	167.172.199.165
192.168.2.4164.90.222.65497044432404308 03/18/23-15:58:24.948314	TCP	2404308	ET CNC Feodo Tracker Reported CnC Server TCP group 5	49704	443	192.168.2.4	164.90.222.65
192.168.2.4187.63.160.8849702802404314 03/18/23-15:58:11.945439	TCP	2404314	ET CNC Feodo Tracker Reported CnC Server TCP group 8	49702	80	192.168.2.4	187.63.160.88
192.168.2.41.234.2.2324971980802404304 03/18/23-15:59:46.453351	TCP	2404304	ET CNC Feodo Tracker Reported CnC Server TCP group 3	49719	8080	192.168.2.4	1.234.2.232
192.168.2.491.121.146.474969580802404344 03/18/23-15:57:43.982133	TCP	2404344	ET CNC Feodo Tracker Reported CnC Server TCP group 23	49695	8080	192.168.2.4	91.121.146.47
192.168.2.4206.189.28.1994972180802404318 03/18/23-16:00:02.963968	TCP	2404318	ET CNC Feodo Tracker Reported CnC Server TCP group 10	49721	8080	192.168.2.4	206.189.28.199
192.168.2.466.228.32.314969770802404330 03/18/23-15:57:49.653644	TCP	2404330	ET CNC Feodo Tracker Reported CnC Server TCP group 16	49697	7080	192.168.2.4	66.228.32.31
192.168.2.4182.162.143.56496984432404312 03/18/23-15:58:05.445458	TCP	2404312	ET CNC Feodo Tracker Reported CnC Server TCP group 7	49698	443	192.168.2.4	182.162.143.56

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 18, 2023 15:57:43.982132912 CET	49695	8080	192.168.2.4	91.121.146.47
Mar 18, 2023 15:57:44.010421038 CET	8080	49695	91.121.146.47	192.168.2.4
Mar 18, 2023 15:57:44.010539055 CET	49695	8080	192.168.2.4	91.121.146.47
Mar 18, 2023 15:57:44.013843060 CET	49695	8080	192.168.2.4	91.121.146.47
Mar 18, 2023 15:57:44.041975975 CET	8080	49695	91.121.146.47	192.168.2.4
Mar 18, 2023 15:57:44.064595938 CET	8080	49695	91.121.146.47	192.168.2.4
Mar 18, 2023 15:57:44.064632893 CET	8080	49695	91.121.146.47	192.168.2.4
Mar 18, 2023 15:57:44.064770937 CET	49695	8080	192.168.2.4	91.121.146.47
Mar 18, 2023 15:57:44.077897072 CET	49695	8080	192.168.2.4	91.121.146.47
Mar 18, 2023 15:57:44.107184887 CET	8080	49695	91.121.146.47	192.168.2.4
Mar 18, 2023 15:57:44.155500889 CET	49695	8080	192.168.2.4	91.121.146.47
Mar 18, 2023 15:57:45.521246910 CET	49695	8080	192.168.2.4	91.121.146.47
Mar 18, 2023 15:57:45.521328926 CET	49695	8080	192.168.2.4	91.121.146.47
Mar 18, 2023 15:57:45.553070068 CET	8080	49695	91.121.146.47	192.168.2.4
Mar 18, 2023 15:57:45.563245058 CET	8080	49695	91.121.146.47	192.168.2.4
Mar 18, 2023 15:57:45.608760118 CET	49695	8080	192.168.2.4	91.121.146.47
Mar 18, 2023 15:57:48.559087038 CET	8080	49695	91.121.146.47	192.168.2.4
Mar 18, 2023 15:57:48.559130907 CET	8080	49695	91.121.146.47	192.168.2.4
Mar 18, 2023 15:57:48.559294939 CET	49695	8080	192.168.2.4	91.121.146.47
Mar 18, 2023 15:57:48.559461117 CET	49695	8080	192.168.2.4	91.121.146.47
Mar 18, 2023 15:57:48.559514999 CET	49695	8080	192.168.2.4	91.121.146.47
Mar 18, 2023 15:57:48.587496996 CET	8080	49695	91.121.146.47	192.168.2.4
Mar 18, 2023 15:57:48.587532997 CET	8080	49695	91.121.146.47	192.168.2.4
Mar 18, 2023 15:57:49.653644085 CET	49697	7080	192.168.2.4	66.228.32.31
Mar 18, 2023 15:57:52.656811953 CET	49697	7080	192.168.2.4	66.228.32.31
Mar 18, 2023 15:57:58.703701019 CET	49697	7080	192.168.2.4	66.228.32.31
Mar 18, 2023 15:58:05.445457935 CET	49698	443	192.168.2.4	182.162.143.56
Mar 18, 2023 15:58:05.445525885 CET	443	49698	182.162.143.56	192.168.2.4
Mar 18, 2023 15:58:05.445621014 CET	49698	443	192.168.2.4	182.162.143.56
Mar 18, 2023 15:58:05.446594000 CET	49698	443	192.168.2.4	182.162.143.56
Mar 18, 2023 15:58:05.446608067 CET	443	49698	182.162.143.56	192.168.2.4
Mar 18, 2023 15:58:05.713150024 CET	443	49698	182.162.143.56	192.168.2.4
Mar 18, 2023 15:58:05.713974953 CET	49699	443	192.168.2.4	182.162.143.56
Mar 18, 2023 15:58:05.714050055 CET	443	49699	182.162.143.56	192.168.2.4
Mar 18, 2023 15:58:05.714160919 CET	49699	443	192.168.2.4	182.162.143.56
Mar 18, 2023 15:58:05.715395927 CET	49699	443	192.168.2.4	182.162.143.56
Mar 18, 2023 15:58:05.715436935 CET	443	49699	182.162.143.56	192.168.2.4
Mar 18, 2023 15:58:05.987780094 CET	443	49699	182.162.143.56	192.168.2.4
Mar 18, 2023 15:58:05.989764929 CET	49700	443	192.168.2.4	182.162.143.56
Mar 18, 2023 15:58:05.989820957 CET	443	49700	182.162.143.56	192.168.2.4
Mar 18, 2023 15:58:05.990039110 CET	49700	443	192.168.2.4	182.162.143.56
Mar 18, 2023 15:58:05.991280079 CET	49700	443	192.168.2.4	182.162.143.56
Mar 18, 2023 15:58:05.991303921 CET	443	49700	182.162.143.56	192.168.2.4
Mar 18, 2023 15:58:06.239960909 CET	443	49700	182.162.143.56	192.168.2.4
Mar 18, 2023 15:58:06.241710901 CET	49701	443	192.168.2.4	182.162.143.56
Mar 18, 2023 15:58:06.241755962 CET	443	49701	182.162.143.56	192.168.2.4
Mar 18, 2023 15:58:06.241857052 CET	49701	443	192.168.2.4	182.162.143.56
Mar 18, 2023 15:58:06.242470980 CET	49701	443	192.168.2.4	182.162.143.56
Mar 18, 2023 15:58:06.242486954 CET	443	49701	182.162.143.56	192.168.2.4
Mar 18, 2023 15:58:06.501095057 CET	443	49701	182.162.143.56	192.168.2.4
Mar 18, 2023 15:58:11.945439100 CET	49702	80	192.168.2.4	187.63.160.88
Mar 18, 2023 15:58:12.179195881 CET	80	49702	187.63.160.88	192.168.2.4
Mar 18, 2023 15:58:12.689225912 CET	49702	80	192.168.2.4	187.63.160.88
Mar 18, 2023 15:58:12.922725916 CET	80	49702	187.63.160.88	192.168.2.4
Mar 18, 2023 15:58:13.423608065 CET	49702	80	192.168.2.4	187.63.160.88
Mar 18, 2023 15:58:13.661552906 CET	80	49702	187.63.160.88	192.168.2.4
Mar 18, 2023 15:58:19.699414968 CET	49703	8080	192.168.2.4	167.172.199.165
Mar 18, 2023 15:58:19.867234945 CET	8080	49703	167.172.199.165	192.168.2.4
Mar 18, 2023 15:58:19.867444038 CET	49703	8080	192.168.2.4	167.172.199.165
Mar 18, 2023 15:58:19.868233919 CET	49703	8080	192.168.2.4	167.172.199.165
Mar 18, 2023 15:58:20.035275936 CET	8080	49703	167.172.199.165	192.168.2.4
Mar 18, 2023 15:58:20.045103073 CET	8080	49703	167.172.199.165	192.168.2.4
Mar 18, 2023 15:58:20.045140028 CET	8080	49703	167.172.199.165	192.168.2.4
Mar 18, 2023 15:58:20.045212030 CET	49703	8080	192.168.2.4	167.172.199.165
Mar 18, 2023 15:58:20.051392078 CET	49703	8080	192.168.2.4	167.172.199.165
Mar 18, 2023 15:58:20.219124079 CET	8080	49703	167.172.199.165	192.168.2.4
Mar 18, 2023 15:58:20.220163107 CET	49703	8080	192.168.2.4	167.172.199.165
Mar 18, 2023 15:58:20.428314924 CET	8080	49703	167.172.199.165	192.168.2.4
Mar 18, 2023 15:58:21.038682938 CET	8080	49703	167.172.199.165	192.168.2.4
Mar 18, 2023 15:58:21.080550909 CET	49703	8080	192.168.2.4	167.172.199.165
Mar 18, 2023 15:58:24.038556099 CET	8080	49703	167.172.199.165	192.168.2.4
Mar 18, 2023 15:58:24.038588047 CET	8080	49703	167.172.199.165	192.168.2.4
Mar 18, 2023 15:58:24.038654089 CET	49703	8080	192.168.2.4	167.172.199.165
Mar 18, 2023 15:58:24.039973974 CET	49703	8080	192.168.2.4	167.172.199.165
Mar 18, 2023 15:58:24.040021896 CET	49703	8080	192.168.2.4	167.172.199.165
Mar 18, 2023 15:58:24.207125902 CET	8080	49703	167.172.199.165	192.168.2.4
Mar 18, 2023 15:58:24.207159042 CET	8080	49703	167.172.199.165	192.168.2.4
Mar 18, 2023 15:58:24.948313951 CET	49704	443	192.168.2.4	164.90.222.65
Mar 18, 2023 15:58:24.948385954 CET	443	49704	164.90.222.65	192.168.2.4
Mar 18, 2023 15:58:24.948482990 CET	49704	443	192.168.2.4	164.90.222.65
Mar 18, 2023 15:58:24.949033022 CET	49704	443	192.168.2.4	164.90.222.65
Mar 18, 2023 15:58:24.949058056 CET	443	49704	164.90.222.65	192.168.2.4
Mar 18, 2023 15:58:25.070983887 CET	443	49704	164.90.222.65	192.168.2.4
Mar 18, 2023 15:58:25.071180105 CET	49704	443	192.168.2.4	164.90.222.65
Mar 18, 2023 15:58:25.075246096 CET	49704	443	192.168.2.4	164.90.222.65
Mar 18, 2023 15:58:25.075273991 CET	443	49704	164.90.222.65	192.168.2.4
Mar 18, 2023 15:58:25.075628996 CET	443	49704	164.90.222.65	192.168.2.4
Mar 18, 2023 15:58:25.127825975 CET	49704	443	192.168.2.4	164.90.222.65
Mar 18, 2023 15:58:25.402632952 CET	49704	443	192.168.2.4	164.90.222.65
Mar 18, 2023 15:58:25.402668953 CET	443	49704	164.90.222.65	192.168.2.4
Mar 18, 2023 15:58:25.615834951 CET	443	49704	164.90.222.65	192.168.2.4
Mar 18, 2023 15:58:25.615917921 CET	443	49704	164.90.222.65	192.168.2.4
Mar 18, 2023 15:58:25.616075039 CET	49704	443	192.168.2.4	164.90.222.65
Mar 18, 2023 15:58:25.616332054 CET	49704	443	192.168.2.4	164.90.222.65
Mar 18, 2023 15:58:25.616355896 CET	443	49704	164.90.222.65	192.168.2.4
Mar 18, 2023 15:58:25.616396904 CET	49704	443	192.168.2.4	164.90.222.65
Mar 18, 2023 15:58:25.616406918 CET	443	49704	164.90.222.65	192.168.2.4
Mar 18, 2023 15:58:29.445425987 CET	49705	8080	192.168.2.4	104.168.155.143
Mar 18, 2023 15:58:29.608290911 CET	8080	49705	104.168.155.143	192.168.2.4
Mar 18, 2023 15:58:30.112575054 CET	49705	8080	192.168.2.4	104.168.155.143

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 18, 2023 15:57:44.642750978 CET	8.8.8.8	192.168.2.4	0x901a	No error (0)	au.c-0001.c-msedge.net	c-0001.c-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 18, 2023 15:57:44.642750978 CET	8.8.8.8	192.168.2.4	0x901a	No error (0)	c-0001.c-msedge.net		13.107.4.50	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

164.90.222.65

Target ID:	0
Start time:	15:57:02
Start date:	18/03/2023
Path:	C:\Windows\System32\loaddll64.exe
Wow64 process (32bit):	false
Commandline:	loaddll64.exe "C:\Users\user\Desktop\f_00321b.dll"
Imagebase:	0x7ff73c1f0000
File size:	139776 bytes
MD5 hash:	C676FC0263EDD17D4CE7D644B8F3FCD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: conhost.exePID: 2516, Parent PID: 4224

General

Target ID:	1
Start time:	15:57:02
Start date:	18/03/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: cmd.exePID: 3216, Parent PID: 4224

General

Target ID:	2
Start time:	15:57:02
Start date:	18/03/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\f_00321b.dll",#1
Imagebase:	0x7ff632260000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: regsvr32.exePID: 4888, Parent PID: 4224

General

Target ID:	3
Start time:	15:57:02
Start date:	18/03/2023
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	regsvr32.exe /s C:\Users\user\Desktop\f_00321b.dll
Imagebase:	0x7ff6746f0000
File size:	24064 bytes
MD5 hash:	D78B75FC68247E8A63ACBA846182740E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000003.00000002.319426857.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Analysis Process: rundll32.exePID: 1264, Parent PID: 3216

General

Target ID:	4
Start time:	15:57:02
Start date:	18/03/2023
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\f_00321b.dll",#1
Imagebase:	0x7ff669490000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.320583141.0000024067ED1000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.320487184.0000024067EA0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Analysis Process: rundll32.exePID: 1240, Parent PID: 4224

General

Target ID:	5
Start time:	15:57:02
Start date:	18/03/2023
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\f_00321b.dll,DllRegisterServer
Imagebase:	0x7ff669490000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000005.00000002.320938696.000001CAEF360000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000005.00000002.320983303.000001CAEF391000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Analysis Process: regsvr32.exePID: 1312, Parent PID: 4888

General

Target ID:	6
Start time:	15:57:04
Start date:	18/03/2023
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ZbmMPnDvLqwXll\QyzgcRWJYZS.dll"
Imagebase:	0x7ff6746f0000
File size:	24064 bytes
MD5 hash:	D78B75FC68247E8A63ACBA846182740E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000006.00000002.839406801.0000000002031000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_3, Description: Yara detected Emotet, Source: 00000006.00000002.839010466.000000000072B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000006.00000002.839356776.0000000001FE0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security

Analysis Process: regsvr32.exePID: 5968, Parent PID: 1264

General

Target ID:	7
Start time:	15:57:05
Start date:	18/03/2023
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\regsvr32.exe "C:\Windows\system32\RymKYMmySRfU\EAqrfXJOpHznppsf.dll"
Imagebase:	0x7ff6746f0000
File size:	24064 bytes
MD5 hash:	D78B75FC68247E8A63ACBA846182740E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: regsvr32.exePID: 4768, Parent PID: 1240

General

Target ID:	8
Start time:	15:57:05
Start date:	18/03/2023
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\regsvr32.exe "C:\Windows\system32\IzuSuDitBV\QmEREbzuu.dll"
Imagebase:	0x7ff6746f0000
File size:	24064 bytes
MD5 hash:	D78B75FC68247E8A63ACBA846182740E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: conhost.exePID: 5432, Parent PID: 1240

General

Target ID:	10
Start time:	15:57:50
Start date:	18/03/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Disassembly

⊘No disassembly

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. Regsvr32.exe is also a Microsoft signed binary.
Tactics:	Defense Evasion
Data Sources:	Loaded DLLs, Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report f_00321b.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Emotet

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Snort IDS Alerts

Windows Analysis Report
f_00321b.dll