Register Login

sloganpng

top title background image

SecuriteInfo.com.Drixed-FJX345EADC8B1F5.514.dll

Status: finished

Submission Time: 2021-10-28 04:57:14 +02:00

Malicious

Trojan

Evader

Dridex

Comments

Tags

Details

Analysis ID:
510694
API (Web) ID:
878261
Analysis Started:

2021-10-28 05:03:00 +02:00
Analysis Finished:

2021-10-28 05:23:22 +02:00
MD5:
345eadc8b1f5d0b373b531902c06572e
SHA1:
a0a170c3bf53be55a625c7793bfe23edd4038f05
SHA256:
31bcae869dbae8bfd20fc177bf4158e75fc7fdf00c694ae13f23dff6229f8e8e
Technologies:

Engines
IOCs

Joe Sandbox

Engine	Download Report	Detection	Info
		malicious
	Full Report Management Report IOC Report	malicious Score: 76	System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
	Full Report Management Report IOC Report	malicious Score: 84	System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 Run Condition: Run with higher sleep bypass
	Full Report Management Report IOC Report	malicious 76/100

Third Party Analysis Engines

Open Full Report

malicious

Score: 15/67

malicious

Score: 12/44

IPs

IP	Country	Detection
66.147.235.11	United States
149.202.179.100	France
81.0.236.89	Czech Republic

URLs

Name	Detection
http://www.vomfass.deDVarFileInfo$

Dropped files

Name	File Type	Hashes	Detection
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5AF8.tmp.dmp	Mini DuMP crash report, 14 streams, Thu Oct 28 12:18:12 2021, 0x1205a4 type	#
C:\Users\user\AppData\Local\Temp\WERDE3.tmp.WERDataCollectionStatus.txt	Little-endian UTF-16 Unicode text, with CRLF, CR line terminators	#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER81DB.tmp.xml	XML 1.0 document, ASCII text, with CRLF line terminators	#
Click to see the 14 hidden entries
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7D94.tmp.WERInternalMetadata.xml	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators	#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7D28.tmp.xml	XML 1.0 document, ASCII text, with CRLF line terminators	#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER768F.tmp.WERInternalMetadata.xml	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators	#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7131.tmp.xml	XML 1.0 document, ASCII text, with CRLF line terminators	#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER6DB6.tmp.WERInternalMetadata.xml	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators	#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER6170.tmp.dmp	Mini DuMP crash report, 14 streams, Thu Oct 28 12:18:14 2021, 0x1205a4 type	#
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_2d53275b1be4ca5e6593e323a54ecdeda8efe761_82810a17_15a172f5\Report.wer	Little-endian UTF-16 Unicode text, with CRLF line terminators	#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5897.tmp.dmp	Mini DuMP crash report, 14 streams, Thu Oct 28 12:18:11 2021, 0x1205a4 type	#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3F06.tmp.xml	XML 1.0 document, ASCII text, with CRLF line terminators	#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3A52.tmp.WERInternalMetadata.xml	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators	#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2988.tmp.dmp	Mini DuMP crash report, 14 streams, Thu Oct 28 12:17:57 2021, 0x1205a4 type	#
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_e9d070cbac24d3d3fafff9232a9e7f59cde72c2_82810a17_0d31a2af\Report.wer	Little-endian UTF-16 Unicode text, with CRLF line terminators	#
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_86cc7caaf91494aa6af1cec8da5ba37782e9_82810a17_1811a30d\Report.wer	Little-endian UTF-16 Unicode text, with CRLF line terminators	#
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_4eea1987c3498f452f209a432782d7d6bd992397_82810a17_1259968a\Report.wer	Little-endian UTF-16 Unicode text, with CRLF line terminators	#