=

We are hiring! Windows Kernel Developer (Remote), apply here!

G7ABVJxc3Z.dll

Status: finished

Submission Time: 2021-12-26 17:16:09 +01:00

Malicious

Trojan

Evader

Dridex

Comments

Tags

Details

Analysis ID:
545442
API (Web) ID:
912964
Analysis Started:

2021-12-26 17:16:09 +01:00
Analysis Finished:

2021-12-26 17:32:46 +01:00
MD5:
47c59530065e8e7e05a855879bf8a922
SHA1:
8fba3ea2428f92e8dc8497514d0817b54edc5be0
SHA256:
e4db910a4147ac44bef76f71e6b0d6bd193b89a6268dda35f3b1c210cc111fe4
Technologies:

Engines
IOCs

Full Report	Management Report	IOC Report	Engine	Info	Verdict	Score	Reports

				System: Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211		80/100
				System: Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211 Run Condition: Run with higher sleep bypass		80/100
						44/68
						29/43

IPs

IP	Country	Detection
162.241.33.132	United States
104.36.167.47	United States
217.160.5.104	Germany
Click to see the 1 hidden entries
188.40.48.93	Germany

URLs

Name	Detection
http://upx.sf.net

Dropped files

Name	File Type	Hashes	Detection
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_4d42c1f24c11b6c9a2fc199d7a28c798fe9e5a_82810a17_186b5001\Report.wer	Little-endian UTF-16 Unicode text, with CRLF line terminators	#
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_dd9d398ae70aa8478325646a49f7ebef948b8_82810a17_1a2b65ac\Report.wer	Little-endian UTF-16 Unicode text, with CRLF line terminators	#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3834.tmp.dmp	Mini DuMP crash report, 14 streams, Mon Dec 27 01:17:40 2021, 0x1205a4 type	#
Click to see the 7 hidden entries
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3FD6.tmp.WERInternalMetadata.xml	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators	#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4296.tmp.xml	XML 1.0 document, ASCII text, with CRLF line terminators	#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER47D4.tmp.dmp	Mini DuMP crash report, 15 streams, Mon Dec 27 01:17:45 2021, 0x1205a4 type	#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5293.tmp.WERInternalMetadata.xml	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators	#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5582.tmp.xml	XML 1.0 document, ASCII text, with CRLF line terminators	#
C:\Windows\appcompat\Programs\Amcache.hve	MS Windows registry file, NT/2000 or above	#
C:\Windows\appcompat\Programs\Amcache.hve.LOG1	MS Windows registry file, NT/2000 or above	#